2026-09-08_e1c2c81a11b9a0427a6eee5655d5ad23_cobalt-strike_icedid_luca-stealer_njrat_stealc

General

Target
2026-09-08_e1c2c81a11b9a0427a6eee5655d5ad23_cobalt-strike_icedid_luca-stealer_njrat_stealc
Size 184KB
Sample260910-cl33vawtct
SHA256 c6f82a518e217f46aaa263de09695924447d6fdcadb2da804584d4e0a44d09cf
MD5 e1c2c81a11b9a0427a6eee5655d5ad23
SHA1 448d01ced854bea9a66bd549de89d28fb9dcee85
SHA512 eaeb581133ceaa303016590f9046e1ca5493815409e0daa9169f370610b68f61cd241b3d4a92ec4868a0d5fceefe1b5ee9c36df26e45a4fbb01f8e9c154c1bf9
SSDEEP 3072:BL8slHnp/tb8Zh9X6wvj+tz4HIdGhVyXl32HhHjaDrMlP/:BbHp/l8Z/6wvQ4ocUn
TLSH
T17E047D15B6A610FED167C538CA551901FB727C4A47A0AEEB07900BF69F23BD05E3E712
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-08_e1c2c81a11b9a0427a6eee5655d5ad23_cobalt-strike_icedid_luca-stealer_njrat_stealc

File Explorer

2026-09-08_e1c2c81a11b9a0427a6eee5655d5ad23_cobalt-strike_icedid_luca-stealer_njrat_stealc

.exe 184KB

2026-09-08_e1c2c81a11b9a0427a6eee5655d5ad23_cobalt-strike_icedid_luca-stealer_njrat_stealc

IMPHASH 8b6418726515e7fe75e29c055e9bf838
SHA256 c6f82a518e217f46aaa263de09695924447d6fdcadb2da804584d4e0a44d09cf
MD5 e1c2c81a11b9a0427a6eee5655d5ad23
SHA1 448d01ced854bea9a66bd549de89d28fb9dcee85
SHA512 eaeb581133ceaa303016590f9046e1ca5493815409e0daa9169f370610b68f61cd241b3d4a92ec4868a0d5fceefe1b5ee9c36df26e45a4fbb01f8e9c154c1bf9
SSDEEP 3072:BL8slHnp/tb8Zh9X6wvj+tz4HIdGhVyXl32HhHjaDrMlP/:BbHp/l8Z/6wvQ4ocUn
TLSH
T17E047D15B6A610FED167C538CA551901FB727C4A47A0AEEB07900BF69F23BD05E3E712
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

30608

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

TlsSetValue VirtualProtect VirtualAlloc GetModuleFileNameW SetEnvironmentVariableW GetFileAttributesW GetLastError TlsAlloc CloseHandle CreateProcessW GetModuleHandleW WriteConsoleW CreateFileW GetConsoleMode GetConsoleOutputCP FlushFileBuffers HeapReAlloc HeapSize SetFilePointerEx ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW RtlUnwindEx RtlPcToFileHeader RaiseException SetLastError EncodePointer EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsGetValue TlsFree FreeLibrary GetProcAddress LoadLibraryExW GetStdHandle WriteFile ExitProcess GetModuleHandleExW HeapFree HeapAlloc GetFileType FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle GetStringTypeW FlsAlloc FlsGetValue FlsSetValue FlsFree InitializeCriticalSectionEx LCMapStringW GetProcessHeap

winhttp

WinHttpReadData WinHttpOpenRequest WinHttpReceiveResponse WinHttpSendRequest WinHttpConnect WinHttpQueryDataAvailable WinHttpCloseHandle WinHttpOpen

Name

.text

Size

112KB

Virtual Size

112KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

58KB

Virtual Size

57KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-08_e1c2c81a11b9a0427a6eee5655d5ad23_cobalt-strike_icedid_luca-stealer_njrat_stealc

kernel32

winhttp

generic