2026-09-04_38481fb8492f3e64df650d6a2131ae0d_cobalt-strike_icedid_luca-stealer_njrat_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-04_38481fb8492f3e64df650d6a2131ae0d_cobalt-strike_icedid_luca-stealer_njrat_stealc
Size 782KB
Sample260905-rfgd8adn9s
SHA256 6754b0c43ac04e0baa350f90e31e12699c531addc8c2a1bc02d2df38ad702504
MD5 38481fb8492f3e64df650d6a2131ae0d
SHA1 3df93233d9bf78d00634208072ea69d6e44da8a6
SHA512 8fadfa5de3120c57f72f1ebf5183e64537a6c915735ee484581cf20f8a1cecf5184267cebbb821adbd7fe2e8d59f3a803f492cd67d513f42e54ca2c42ec6092c
SSDEEP 24576:SJO1PAJI7s5doLPJc/OzOTQAs9qripzw:TB7s5doLPMxs9qrip
TLSH
T1ED05D0016B9182BFE122C83555474B41DFBBFC456B214AA36398B67F5E3F3A07E19322
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-04_38481fb8492f3e64df650d6a2131ae0d_cobalt-strike_icedid_luca-stealer_njrat_stealc

File Explorer

2026-09-04_38481fb8492f3e64df650d6a2131ae0d_cobalt-strike_icedid_luca-stealer_njrat_stealc

.exe 782KB

2026-09-04_38481fb8492f3e64df650d6a2131ae0d_cobalt-strike_icedid_luca-stealer_njrat_stealc

IMPHASH a165f62f913e63193e3d31c9bc7f7652
SHA256 6754b0c43ac04e0baa350f90e31e12699c531addc8c2a1bc02d2df38ad702504
MD5 38481fb8492f3e64df650d6a2131ae0d
SHA1 3df93233d9bf78d00634208072ea69d6e44da8a6
SHA512 8fadfa5de3120c57f72f1ebf5183e64537a6c915735ee484581cf20f8a1cecf5184267cebbb821adbd7fe2e8d59f3a803f492cd67d513f42e54ca2c42ec6092c
SSDEEP 24576:SJO1PAJI7s5doLPJc/OzOTQAs9qripzw:TB7s5doLPMxs9qrip
TLSH
T1ED05D0016B9182BFE122C83555474B41DFBBFC456B214AA36398B67F5E3F3A07E19322
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

38472

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\app_compile\pub\bin64\Publish\QyLauncher.pdb

kernel32

K32GetProcessImageFileNameW CloseHandle GetProcAddress GetModuleHandleW GetCurrentProcess FindFirstFileW FindNextFileW FindClose CompareFileTime OutputDebugStringW HeapFree GetLastError HeapSize HeapReAlloc HeapAlloc DeleteCriticalSection GetProcessHeap WriteConsoleW CreateFileW OpenProcess GetCommandLineW WritePrivateProfileStringW InitializeCriticalSectionEx GetPrivateProfileStringW SetFilePointerEx GetFileSizeEx GetConsoleMode GetConsoleOutputCP FlushFileBuffers GetStringTypeW IsDebuggerPresent RaiseException EnterCriticalSection LeaveCriticalSection RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent GetStartupInfoW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead RtlUnwindEx RtlPcToFileHeader SetLastError EncodePointer InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW ExitProcess GetModuleHandleExW GetModuleFileNameW GetStdHandle WriteFile FlsAlloc FlsGetValue FlsSetValue FlsFree VirtualProtect CompareStringW LCMapStringW GetFileType FindFirstFileExW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle

user32

MessageBoxW

advapi32

RegCloseKey RegQueryValueExW RegOpenKeyExW RegDeleteTreeW

shell32

ShellExecuteExW SHGetSpecialFolderPathW

shlwapi

PathFileExistsW PathCombineW

Name

.text

Size

124KB

Virtual Size

123KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

60KB

Virtual Size

60KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

585KB

Virtual Size

584KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-04_38481fb8492f3e64df650d6a2131ae0d_cobalt-strike_icedid_luca-stealer_njrat_stealc

kernel32

user32

advapi32

shell32

shlwapi

generic