2026-08-31_d6fed23bbb5b7e1ce7ac03c1fd36abea_cobalt-strike_icedid_luca-stealer_njrat_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-31_d6fed23bbb5b7e1ce7ac03c1fd36abea_cobalt-strike_icedid_luca-stealer_njrat_stealc
Size 958KB
Sample260831-rew4aabl9t
SHA256 12c8adccc4e3f5faab8fc7b8167f64bbf47aa2f546b5081fe59e2a2395002a56
MD5 d6fed23bbb5b7e1ce7ac03c1fd36abea
SHA1 b6a806fa97ff77794a48f29b7ce51718f6bc91f6
SHA512 2765b0ae00cd0530b2116a973a022b2f7c4d99582117672d7aab4313e980add384c58a3cc11020078f19363132a7d80557029c8f05b8468034c3d69c5de62414
SSDEEP 12288:lxgQFLyVrVMBBPqdbzQk6b1n92W9M3WdJu2PYiyn6FMW:PgCLyV5B9zQzH2W9CWy2wiyn6iW
TLSH
T1F5259E4AA7E400F8E0BBD274C9B1661BDA7178951B3096CF13D4066D2F737E05A7AB23
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-31_d6fed23bbb5b7e1ce7ac03c1fd36abea_cobalt-strike_icedid_luca-stealer_njrat_stealc

File Explorer

2026-08-31_d6fed23bbb5b7e1ce7ac03c1fd36abea_cobalt-strike_icedid_luca-stealer_njrat_stealc

.exe 958KB

2026-08-31_d6fed23bbb5b7e1ce7ac03c1fd36abea_cobalt-strike_icedid_luca-stealer_njrat_stealc

IMPHASH 2b76a489bb4a6f38939d0a83c7547784
SHA256 12c8adccc4e3f5faab8fc7b8167f64bbf47aa2f546b5081fe59e2a2395002a56
MD5 d6fed23bbb5b7e1ce7ac03c1fd36abea
SHA1 b6a806fa97ff77794a48f29b7ce51718f6bc91f6
SHA512 2765b0ae00cd0530b2116a973a022b2f7c4d99582117672d7aab4313e980add384c58a3cc11020078f19363132a7d80557029c8f05b8468034c3d69c5de62414
SSDEEP 12288:lxgQFLyVrVMBBPqdbzQk6b1n92W9M3WdJu2PYiyn6FMW:PgCLyV5B9zQzH2W9CWy2wiyn6iW
TLSH
T1F5259E4AA7E400F8E0BBD274C9B1661BDA7178951B3096CF13D4066D2F737E05A7AB23
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

449140

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

d3d11

D3D11CreateDeviceAndSwapChain

user32

PeekMessageA PostQuitMessage UpdateWindow ShowWindow GetKeyState GetMessageExtraInfo LoadCursorA ScreenToClient GetCapture ClientToScreen TrackMouseEvent GetKeyboardLayout GetForegroundWindow SetCapture SetCursor GetClientRect RegisterClassExW IsWindowUnicode ReleaseCapture SetCursorPos GetCursorPos OpenClipboard CloseClipboard EmptyClipboard GetClipboardData SetClipboardData DefWindowProcW DispatchMessageA DestroyWindow CreateWindowExW UnregisterClassW TranslateMessage

kernel32

GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW VirtualProtect FlsFree FlsSetValue FlsGetValue FlsAlloc HeapFree HeapAlloc EnumSystemLocalesW GetFileSizeEx SetFilePointerEx FlushFileBuffers Process32First CreateToolhelp32Snapshot Sleep Process32Next CloseHandle GetModuleHandleW TerminateProcess SetEnvironmentVariableA DeviceIoControl CreateFileW GetLastError GetConsoleOutputCP GetTempPathW DeleteFileW OutputDebugStringA MultiByteToWideChar GlobalAlloc GlobalFree GlobalLock WideCharToMultiByte GlobalUnlock GetLocaleInfoA LoadLibraryA QueryPerformanceFrequency IsDBCSLeadByte GetProcAddress FreeLibrary QueryPerformanceCounter IsValidCodePage GetACP GetOEMCP GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetProcessHeap SetStdHandle HeapReAlloc HeapSize SetEndOfFile ExitProcess WriteConsoleW GetModuleFileNameW GetConsoleMode ReadConsoleW GetTimeZoneInformation WriteFile OutputDebugStringW GetFileType GetStdHandle ReadFile GetModuleHandleExW OpenProcess ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead WaitForSingleObjectEx RtlUnwind GetExitCodeThread LocalFree FormatMessageA GetLocaleInfoEx CreateDirectoryW FindClose FindFirstFileW FindFirstFileExW FindNextFileW GetFileAttributesExW SetFileInformationByHandle AreFileApisANSI GetFileInformationByHandleEx TryAcquireSRWLockExclusive EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer LCMapStringEx GetStringTypeW GetCPInfo RtlUnwindEx RtlPcToFileHeader RaiseException SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW GetCurrentProcess CreateThread ExitThread FreeLibraryAndExitThread

advapi32

StartServiceW RegSetValueExW CreateServiceW CloseServiceHandle OpenSCManagerW DeleteService ControlService RegOpenKeyExW OpenServiceW RegCloseKey RegCreateKeyExW RegEnumKeyExW

shell32

ShellExecuteW SHGetFolderPathA

imm32

ImmGetContext ImmSetCandidateWindow ImmSetCompositionWindow ImmReleaseContext

d3dcompiler_47

D3DCompile

Name

.text

Size

640KB

Virtual Size

640KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

242KB

Virtual Size

242KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

6KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

30KB

Virtual Size

29KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

34KB

Virtual Size

34KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-31_d6fed23bbb5b7e1ce7ac03c1fd36abea_cobalt-strike_icedid_luca-stealer_njrat_stealc

d3d11

user32

kernel32

advapi32

shell32

imm32

d3dcompiler_47

generic