2026-09-06_934ce96f6d1afd8813a65f8a6afbd08a_cobalt-strike_icedid_luca-stealer_njrat_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-06_934ce96f6d1afd8813a65f8a6afbd08a_cobalt-strike_icedid_luca-stealer_njrat_stealc
Size 201KB
Sample260906-2ccxqshm21
SHA256 0acdbca093178ed1f5f3de0af961329d7857a46b6864cceb15dfd28fb403af48
MD5 934ce96f6d1afd8813a65f8a6afbd08a
SHA1 d43ae3dbd3f6ae3868c9c5acfdba7010da569ac5
SHA512 0b5142bc465e20ebe466bbc109bb01d67311ebe4efd87eb32c680917ec644f720f320d067e43579d2637cbb4de52ce9c52da13654a2acbf5e57e51faeb44f006
SSDEEP 3072:TqVSjWOgH8fQwcNRdOkg1JduAmfT9PbwoFmJ1W+13GDVq/lI+:TwKgcfQFRA71HYlT+1WiY
TLSH
T18C148E29F6A510FAD1B79534C9414D46EA737C4607A0EADF07900BF69E33AE09E3E712
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects executables referencing many IR and analysis tools 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_References_SecTools

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-06_934ce96f6d1afd8813a65f8a6afbd08a_cobalt-strike_icedid_luca-stealer_njrat_stealc

File Explorer

2026-09-06_934ce96f6d1afd8813a65f8a6afbd08a_cobalt-strike_icedid_luca-stealer_njrat_stealc

.exe 201KB

2026-09-06_934ce96f6d1afd8813a65f8a6afbd08a_cobalt-strike_icedid_luca-stealer_njrat_stealc

IMPHASH e266443bb3a2965bf388aa545bea0e33
SHA256 0acdbca093178ed1f5f3de0af961329d7857a46b6864cceb15dfd28fb403af48
MD5 934ce96f6d1afd8813a65f8a6afbd08a
SHA1 d43ae3dbd3f6ae3868c9c5acfdba7010da569ac5
SHA512 0b5142bc465e20ebe466bbc109bb01d67311ebe4efd87eb32c680917ec644f720f320d067e43579d2637cbb4de52ce9c52da13654a2acbf5e57e51faeb44f006
SSDEEP 3072:TqVSjWOgH8fQwcNRdOkg1JduAmfT9PbwoFmJ1W+13GDVq/lI+:TwKgcfQFRA71HYlT+1WiY
TLSH
T18C148E29F6A510FAD1B79534C9414D46EA737C4607A0EADF07900BF69E33AE09E3E712
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects executables referencing many IR and analysis tools
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

31756

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

CloseHandle GetLastError GetWindowsDirectoryA SetConsoleTextAttribute OpenProcess CreateToolhelp32Snapshot Process32First Process32Next WaitForSingleObject CreateRemoteThread GetExitCodeThread VirtualAllocEx WriteProcessMemory VirtualFreeEx GetModuleHandleA GetProcAddress ContinueDebugEvent WaitForDebugEvent DebugActiveProcessStop Sleep TerminateProcess GetExitCodeProcess SuspendThread ResumeThread CreateProcessA ReadFile ReadProcessMemory GetDiskFreeSpaceExA WriteFile IsDebuggerPresent CheckRemoteDebuggerPresent QueryPerformanceCounter QueryPerformanceFrequency GetCurrentProcess GetCurrentProcessId ExitProcess GetCurrentThread GetThreadContext GlobalMemoryStatusEx GetSystemInfo GetTickCount64 GetSystemDirectoryA VirtualAlloc VirtualProtect MapViewOfFile UnmapViewOfFile LoadLibraryA CreateFileMappingA GetComputerNameA WriteConsoleW GetFileSize CreateFileA VirtualProtectEx GetStdHandle CreateFileW HeapReAlloc HeapSize SetFilePointerEx GetFileSizeEx GetConsoleMode GetConsoleOutputCP FlushFileBuffers GetProcessHeap GetStringTypeW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead GetStartupInfoW GetModuleHandleW RtlPcToFileHeader RaiseException RtlUnwindEx SetLastError EncodePointer EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW GetModuleFileNameW GetModuleHandleExW GetCommandLineA GetCommandLineW HeapAlloc HeapFree FlsAlloc FlsGetValue FlsSetValue FlsFree InitializeCriticalSectionEx CompareStringW LCMapStringW GetFileType FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle

advapi32

RegCloseKey GetUserNameA RegOpenKeyExA

oleaut32

SafeArrayCreate SafeArrayDestroy SafeArrayAccessData VariantInit SafeArrayCreateVector SafeArrayPutElement SafeArrayUnaccessData

ole32

CoInitializeEx

mscoree

CLRCreateInstance

Name

.text

Size

125KB

Virtual Size

125KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

62KB

Virtual Size

61KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-06_934ce96f6d1afd8813a65f8a6afbd08a_cobalt-strike_icedid_luca-stealer_njrat_stealc

kernel32

advapi32

oleaut32

ole32

mscoree

generic