2026-09-21_b4fa9de0d7603edc305f0b5464d45150_cobalt-strike_icedid_luca-stealer_njrat_stealc

General

Target
2026-09-21_b4fa9de0d7603edc305f0b5464d45150_cobalt-strike_icedid_luca-stealer_njrat_stealc
Size 495KB
Sample260922-mp45escc26
SHA256 a321d2d0cc1a8888506f189e3d5ccd94986cd4da8d5e03e2e56eb5e077849432
MD5 b4fa9de0d7603edc305f0b5464d45150
SHA1 ddeabac25c42063fc83023ec76b22efc1deabab3
SHA512 88c3bdd6ff668a02154fbfa7787bf382af7558f6759bc122c24d1f3a407140e155a78760ccd3055606864626eb9c2755fbc2c5e6b5a3b7d29340da3ee99e0255
SSDEEP 6144:qn6o55c9U61KYlpipBLHCgRQtVgrhrqCfYfzo1Nfn:OcBlp6HbQqNqqwq
TLSH
T146B4D84BE6B651E5D4BAC0388662713BFCB238594374ABD79B808B531772BE0E53E740
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-21_b4fa9de0d7603edc305f0b5464d45150_cobalt-strike_icedid_luca-stealer_njrat_stealc

File Explorer

2026-09-21_b4fa9de0d7603edc305f0b5464d45150_cobalt-strike_icedid_luca-stealer_njrat_stealc

.exe 495KB

2026-09-21_b4fa9de0d7603edc305f0b5464d45150_cobalt-strike_icedid_luca-stealer_njrat_stealc

IMPHASH ea0fa5d651a475650dc624504c8ed89a
SHA256 a321d2d0cc1a8888506f189e3d5ccd94986cd4da8d5e03e2e56eb5e077849432
MD5 b4fa9de0d7603edc305f0b5464d45150
SHA1 ddeabac25c42063fc83023ec76b22efc1deabab3
SHA512 88c3bdd6ff668a02154fbfa7787bf382af7558f6759bc122c24d1f3a407140e155a78760ccd3055606864626eb9c2755fbc2c5e6b5a3b7d29340da3ee99e0255
SSDEEP 6144:qn6o55c9U61KYlpipBLHCgRQtVgrhrqCfYfzo1Nfn:OcBlp6HbQqNqqwq
TLSH
T146B4D84BE6B651E5D4BAC0388662713BFCB238594374ABD79B808B531772BE0E53E740
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

297148

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

GetCommConfig RemoveDirectoryTransactedW HeapCreate AddDllDirectory RtlCaptureContext EnumResourceTypesW SetConsoleWindowInfo CompareStringOrdinal OpenFileById OpenFile GetCommMask GetCommTimeouts GlobalDeleteAtom ClosePrivateNamespace ConvertThreadToFiberEx FormatMessageW CancelSynchronousIo ReleaseSRWLockExclusive ReclaimVirtualMemory CompareStringEx GetCurrentDirectoryW GetProcessPreferredUILanguages FindNextChangeNotification UnlockFile InitAtomTable SetProtectedPolicy DisableThreadProfiling CreateFiberEx GetCurrentConsoleFont InitializeProcThreadAttributeList UpdateProcThreadAttribute CloseHandle HeapAlloc GetCurrentProcessId GetProcessHeap CreateProcessA lstrlenA SizeofResource GetVolumeInformationW CompareFileTime GetBinaryTypeW GetPhysicallyInstalledSystemMemory DeleteTimerQueue SetConsoleMode GetConsoleHistoryInfo VirtualUnlock GetUserDefaultUILanguage InitializeCriticalSectionAndSpinCount GetConsoleAliasExesW QueryThreadCycleTime IsSystemResumeAutomatic GetSystemDefaultLangID CancelWaitableTimer GetPrivateProfileStringW ResolveLocaleName Sleep MoveFileWithProgressW FillConsoleOutputCharacterW GlobalFindAtomW GetMemoryErrorHandlingCapabilities GetNamedPipeClientSessionId UnregisterWaitEx GetOverlappedResultEx GetThreadTimes GetCalendarInfoEx LocalUnlock GetFileTime EnumResourceTypesExW RtlUnwind SetWaitableTimer GetLongPathNameW GetCurrentProcess RegisterWaitForSingleObject GetProfileIntW SetFileTime AddSecureMemoryCacheCallback WaitForMultipleObjects TryAcquireSRWLockShared FlsGetValue EnumResourceNamesW CreateBoundaryDescriptorW EnumCalendarInfoExW GetFileAttributesTransactedW GetVersionExW WaitForThreadpoolWorkCallbacks HeapWalk GetACP OpenProcess SwitchToFiber GetLogicalDriveStringsW GetLastError TzSpecificLocalTimeToSystemTime GetFileAttributesExW GetThreadUILanguage CloseThreadpoolTimer TerminateThread CreateHardLinkTransactedW GetSystemInfo Wow64SuspendThread SetVolumeMountPointW ReadDirectoryChangesW VirtualLock UnregisterApplicationRestart SetThreadStackGuarantee FindAtomW GetTempFileNameW GetThreadGroupAffinity ConvertThreadToFiber VirtualQuery OpenThread AreFileApisANSI GetStartupInfoW SetSystemTimeAdjustment ReadFile WriteProfileStringW QueryThreadpoolStackInformation GetOEMCP GetConsoleOutputCP GetStdHandle SetProcessShutdownParameters GetNumaProcessorNodeEx InitializeCriticalSectionEx UnregisterBadMemoryNotification GetModuleHandleA DisconnectNamedPipe ApplicationRecoveryInProgress BuildCommDCBAndTimeoutsW PowerCreateRequest BuildCommDCBW LCMapStringEx ClearCommError UpdateResourceW CloseThreadpoolIo CreateFileMappingFromApp ExitProcess SetConsoleCP SetThreadExecutionState GetConsoleWindow DeleteTimerQueueTimer EnumSystemFirmwareTables lstrcmpW lstrlenW CreateFileW GetConsoleMode FlushFileBuffers HeapSize SetFilePointerEx QueryPerformanceCounter QueryPerformanceFrequency InitOnceComplete InitOnceBeginInitialize WideCharToMultiByte GetSystemTimeAsFileTime GetModuleHandleW GetProcAddress EnterCriticalSection LeaveCriticalSection DeleteCriticalSection EncodePointer DecodePointer MultiByteToWideChar GetStringTypeW GetCPInfo IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent GetCurrentThreadId InitializeSListHead TerminateProcess RtlUnwindEx RtlPcToFileHeader RaiseException SetLastError TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW GetModuleHandleExW GetModuleFileNameW WriteFile HeapReAlloc HeapFree GetFileType FlsAlloc FlsSetValue FlsFree LCMapStringW FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle WriteConsoleW

user32

MessageBoxW MessageBoxA

ntdll

RtlLookupFunctionEntry RtlVirtualUnwind

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-21_b4fa9de0d7603edc305f0b5464d45150_cobalt-strike_icedid_luca-stealer_njrat_stealc

kernel32

user32

ntdll

generic