2026-09-23_a94efd7ac2dc76da85ecf0e6b4067c92_cobalt-strike_icedid_luca-stealer_njrat_stealc

General

Target
2026-09-23_a94efd7ac2dc76da85ecf0e6b4067c92_cobalt-strike_icedid_luca-stealer_njrat_stealc
Size 501KB
Sample260924-fgca4sec29
SHA256 22111ec5e5969a1a7b90510aa33541154b1c36ee42919de281ebcd6c888999d3
MD5 a94efd7ac2dc76da85ecf0e6b4067c92
SHA1 09ad853e5abe4cbdeba9762eac719bd8f44544fc
SHA512 8eeccd07f06d2dcb0120ae820d9abb9249fef6234fdb8cce53fb3ad2cf19f8761a507642a3aeadfd7e98bc2dd93101d5491dcd90d02e9a72acf1556dac858c63
SSDEEP 6144:yn6o55c9U61KYlpipBLHCgRQtVgrhrqCfYfzLVNfZ:GcBlp6HbQqNqqw7
TLSH
T15CB4E84BE6B651E5D4BAC0388662713BFCB238594374ABD79B808B531772BE0E53E740
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-23_a94efd7ac2dc76da85ecf0e6b4067c92_cobalt-strike_icedid_luca-stealer_njrat_stealc

File Explorer

2026-09-23_a94efd7ac2dc76da85ecf0e6b4067c92_cobalt-strike_icedid_luca-stealer_njrat_stealc

.exe 501KB

2026-09-23_a94efd7ac2dc76da85ecf0e6b4067c92_cobalt-strike_icedid_luca-stealer_njrat_stealc

IMPHASH ea0fa5d651a475650dc624504c8ed89a
SHA256 22111ec5e5969a1a7b90510aa33541154b1c36ee42919de281ebcd6c888999d3
MD5 a94efd7ac2dc76da85ecf0e6b4067c92
SHA1 09ad853e5abe4cbdeba9762eac719bd8f44544fc
SHA512 8eeccd07f06d2dcb0120ae820d9abb9249fef6234fdb8cce53fb3ad2cf19f8761a507642a3aeadfd7e98bc2dd93101d5491dcd90d02e9a72acf1556dac858c63
SSDEEP 6144:yn6o55c9U61KYlpipBLHCgRQtVgrhrqCfYfzLVNfZ:GcBlp6HbQqNqqw7
TLSH
T15CB4E84BE6B651E5D4BAC0388662713BFCB238594374ABD79B808B531772BE0E53E740
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

297148

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

GetCommConfig RemoveDirectoryTransactedW HeapCreate AddDllDirectory RtlCaptureContext EnumResourceTypesW SetConsoleWindowInfo CompareStringOrdinal OpenFileById OpenFile GetCommMask GetCommTimeouts GlobalDeleteAtom ClosePrivateNamespace ConvertThreadToFiberEx FormatMessageW CancelSynchronousIo ReleaseSRWLockExclusive ReclaimVirtualMemory CompareStringEx GetCurrentDirectoryW GetProcessPreferredUILanguages FindNextChangeNotification UnlockFile InitAtomTable SetProtectedPolicy DisableThreadProfiling CreateFiberEx GetCurrentConsoleFont InitializeProcThreadAttributeList UpdateProcThreadAttribute CloseHandle HeapAlloc GetCurrentProcessId GetProcessHeap CreateProcessA lstrlenA SizeofResource GetVolumeInformationW CompareFileTime GetBinaryTypeW GetPhysicallyInstalledSystemMemory DeleteTimerQueue SetConsoleMode GetConsoleHistoryInfo VirtualUnlock GetUserDefaultUILanguage InitializeCriticalSectionAndSpinCount GetConsoleAliasExesW QueryThreadCycleTime IsSystemResumeAutomatic GetSystemDefaultLangID CancelWaitableTimer GetPrivateProfileStringW ResolveLocaleName Sleep MoveFileWithProgressW FillConsoleOutputCharacterW GlobalFindAtomW GetMemoryErrorHandlingCapabilities GetNamedPipeClientSessionId UnregisterWaitEx GetOverlappedResultEx GetThreadTimes GetCalendarInfoEx LocalUnlock GetFileTime EnumResourceTypesExW RtlUnwind SetWaitableTimer GetLongPathNameW GetCurrentProcess RegisterWaitForSingleObject GetProfileIntW SetFileTime AddSecureMemoryCacheCallback WaitForMultipleObjects TryAcquireSRWLockShared FlsGetValue EnumResourceNamesW CreateBoundaryDescriptorW EnumCalendarInfoExW GetFileAttributesTransactedW GetVersionExW WaitForThreadpoolWorkCallbacks HeapWalk GetACP OpenProcess SwitchToFiber GetLogicalDriveStringsW GetLastError TzSpecificLocalTimeToSystemTime GetFileAttributesExW GetThreadUILanguage CloseThreadpoolTimer TerminateThread CreateHardLinkTransactedW GetSystemInfo Wow64SuspendThread SetVolumeMountPointW ReadDirectoryChangesW VirtualLock UnregisterApplicationRestart SetThreadStackGuarantee FindAtomW GetTempFileNameW GetThreadGroupAffinity ConvertThreadToFiber VirtualQuery OpenThread AreFileApisANSI GetStartupInfoW SetSystemTimeAdjustment ReadFile WriteProfileStringW QueryThreadpoolStackInformation GetOEMCP GetConsoleOutputCP GetStdHandle SetProcessShutdownParameters GetNumaProcessorNodeEx InitializeCriticalSectionEx UnregisterBadMemoryNotification GetModuleHandleA DisconnectNamedPipe ApplicationRecoveryInProgress BuildCommDCBAndTimeoutsW PowerCreateRequest BuildCommDCBW LCMapStringEx ClearCommError UpdateResourceW CloseThreadpoolIo CreateFileMappingFromApp ExitProcess SetConsoleCP SetThreadExecutionState GetConsoleWindow DeleteTimerQueueTimer EnumSystemFirmwareTables lstrcmpW lstrlenW CreateFileW GetConsoleMode FlushFileBuffers HeapSize SetFilePointerEx QueryPerformanceCounter QueryPerformanceFrequency InitOnceComplete InitOnceBeginInitialize WideCharToMultiByte GetSystemTimeAsFileTime GetModuleHandleW GetProcAddress EnterCriticalSection LeaveCriticalSection DeleteCriticalSection EncodePointer DecodePointer MultiByteToWideChar GetStringTypeW GetCPInfo IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent GetCurrentThreadId InitializeSListHead TerminateProcess RtlUnwindEx RtlPcToFileHeader RaiseException SetLastError TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW GetModuleHandleExW GetModuleFileNameW WriteFile HeapReAlloc HeapFree GetFileType FlsAlloc FlsSetValue FlsFree LCMapStringW FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle WriteConsoleW

user32

MessageBoxW MessageBoxA

ntdll

RtlLookupFunctionEntry RtlVirtualUnwind

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-23_a94efd7ac2dc76da85ecf0e6b4067c92_cobalt-strike_icedid_luca-stealer_njrat_stealc

kernel32

user32

ntdll

generic