2026-09-09_d5b550a8aaca0747c789745fa7fb75aa_cobalt-strike_helldown_icedid_luca-stealer_njrat_remcos_stealc

General

Target
2026-09-09_d5b550a8aaca0747c789745fa7fb75aa_cobalt-strike_helldown_icedid_luca-stealer_njrat_remcos_stealc
Size 864KB
Sample260910-2ymztshp5v
SHA256 a4a1f1c97a89c4f620a0f7eec391de997aba528e1280e50b7b0788de460e4b8d
MD5 d5b550a8aaca0747c789745fa7fb75aa
SHA1 46cc9a1fe84f352c2262a871e50dd3b43087e06f
SHA512 ff333d2d19f72c02c2339fa5b3b3cf5484327f92b0a52e127777829dcd03754fbc3069558c3274dd7472898cfb499502d803e49e4b139a95aaa5a06701fa9ec4
SSDEEP 12288:cqgIyOZvUxcxFbN+cRVEuiBMRHh1VsXWlnd425iGwZJ14xWXb+Dc0:c+x9UxcB+cRCuiBMRXaXanVMGwOCx0
TLSH
T1DF156D5AE6E405FAC467C179C9462607FBB6B41A1360A7DF07E14AA63F23BE14B3D310
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-09_d5b550a8aaca0747c789745fa7fb75aa_cobalt-strike_helldown_icedid_luca-stealer_njrat_remcos_stealc

File Explorer

2026-09-09_d5b550a8aaca0747c789745fa7fb75aa_cobalt-strike_helldown_icedid_luca-stealer_njrat_remcos_stealc

.exe 864KB

2026-09-09_d5b550a8aaca0747c789745fa7fb75aa_cobalt-strike_helldown_icedid_luca-stealer_njrat_remcos_stealc

IMPHASH 609931670668af33fd1fe1120d0e81fd
SHA256 a4a1f1c97a89c4f620a0f7eec391de997aba528e1280e50b7b0788de460e4b8d
MD5 d5b550a8aaca0747c789745fa7fb75aa
SHA1 46cc9a1fe84f352c2262a871e50dd3b43087e06f
SHA512 ff333d2d19f72c02c2339fa5b3b3cf5484327f92b0a52e127777829dcd03754fbc3069558c3274dd7472898cfb499502d803e49e4b139a95aaa5a06701fa9ec4
SSDEEP 12288:cqgIyOZvUxcxFbN+cRVEuiBMRHh1VsXWlnd425iGwZJ14xWXb+Dc0:c+x9UxcB+cRCuiBMRXaXanVMGwOCx0
TLSH
T1DF156D5AE6E405FAC467C179C9462607FBB6B41A1360A7DF07E14AA63F23BE14B3D310
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

505148

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

ws2_32

bind closesocket connect inet_pton freeaddrinfo getaddrinfo WSAGetLastError WSACleanup WSAStartup socket shutdown setsockopt send recv listen htons accept

bcrypt

BCryptGenRandom

kernel32

SetUnhandledExceptionFilter SetEndOfFile WriteConsoleW HeapReAlloc HeapSize CreateFileW GetStringTypeW SetStdHandle GetProcessHeap SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCPInfo GetOEMCP GetACP IsValidCodePage FindFirstFileExW DeleteFileW CompareFileTime CreateDirectoryA DeleteFileA GetFileAttributesA GetFileAttributesExA OutputDebugStringA Sleep GetLocalTime GetTickCount GetModuleFileNameA MoveFileA FindClose FindNextFileW GetLastError MultiByteToWideChar WideCharToMultiByte GetSystemTimeAsFileTime MoveFileExA CloseHandle WaitForSingleObjectEx GetCurrentThreadId GetExitCodeThread ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW QueryPerformanceCounter InitializeCriticalSectionEx GetModuleHandleW GetProcAddress RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW GetCurrentProcessId InitializeSListHead GetFileSizeEx RtlPcToFileHeader RaiseException RtlUnwindEx SetLastError EncodePointer EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW ReadFile CreateThread ExitThread FreeLibraryAndExitThread GetModuleHandleExW ExitProcess GetModuleFileNameW GetStdHandle WriteFile GetCommandLineA GetCommandLineW HeapFree FlushFileBuffers GetConsoleOutputCP GetConsoleMode GetFileType ReadConsoleW SetFilePointerEx HeapAlloc FlsAlloc FlsGetValue FlsSetValue FlsFree VirtualProtect CompareStringW LCMapStringW

Name

.text

Size

604KB

Virtual Size

604KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

221KB

Virtual Size

220KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

22KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

28KB

Virtual Size

27KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-09_d5b550a8aaca0747c789745fa7fb75aa_cobalt-strike_helldown_icedid_luca-stealer_njrat_remcos_stealc

ws2_32

bcrypt

kernel32

generic