2026-09-26_9f1c7dacfe5f488f0dbc9a6f78fd3ba9_cobalt-strike_icedid_luca-stealer_njrat_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-26_9f1c7dacfe5f488f0dbc9a6f78fd3ba9_cobalt-strike_icedid_luca-stealer_njrat_stealc
Size 440KB
Sample260926-wax71aycja
SHA256 8b1fdb0b898b6acadecd4e19f594e72f4e594a366c69e91d8c9c9d52d957d526
MD5 9f1c7dacfe5f488f0dbc9a6f78fd3ba9
SHA1 f3a360f3c9eb12f0b3fe17e58c05c3ca816ade22
SHA512 4137eac77cab375f85a56bf8f4ddb6f36d34dccf8a6339e2d95e296bc0193556d371203770407cf2757e401067d7ab71d520dafc4a631f31acd787548577e95d
SSDEEP 6144:lQDRgct/sxgfawA8JJuvJ9poEgffOtAkmgBPnZPyISczYE9u6L:yDRgMsxBjpntynczYEh
TLSH
T149A45A1BB75218F8DC7AC17F8D5E0A95A732B91513A1CBCF136082169F232C56F39BA1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-26_9f1c7dacfe5f488f0dbc9a6f78fd3ba9_cobalt-strike_icedid_luca-stealer_njrat_stealc

File Explorer

2026-09-26_9f1c7dacfe5f488f0dbc9a6f78fd3ba9_cobalt-strike_icedid_luca-stealer_njrat_stealc

.exe 440KB

2026-09-26_9f1c7dacfe5f488f0dbc9a6f78fd3ba9_cobalt-strike_icedid_luca-stealer_njrat_stealc

IMPHASH 98bfc34312feb59790c0e81be2901549
SHA256 8b1fdb0b898b6acadecd4e19f594e72f4e594a366c69e91d8c9c9d52d957d526
MD5 9f1c7dacfe5f488f0dbc9a6f78fd3ba9
SHA1 f3a360f3c9eb12f0b3fe17e58c05c3ca816ade22
SHA512 4137eac77cab375f85a56bf8f4ddb6f36d34dccf8a6339e2d95e296bc0193556d371203770407cf2757e401067d7ab71d520dafc4a631f31acd787548577e95d
SSDEEP 6144:lQDRgct/sxgfawA8JJuvJ9poEgffOtAkmgBPnZPyISczYE9u6L:yDRgMsxBjpntynczYEh
TLSH
T149A45A1BB75218F8DC7AC17F8D5E0A95A732B91513A1CBCF136082169F232C56F39BA1
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

364544

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

rpcrt4

RpcBindingFree RpcStringFreeW RpcBindingSetAuthInfoExW RpcStringBindingComposeW NdrClientCall3 RpcBindingFromStringBindingW

advapi32

EventRegister RegCloseKey RegOpenKeyExW RegQueryValueExW GetSecurityDescriptorDacl SetSecurityInfo ConvertStringSecurityDescriptorToSecurityDescriptorW EventUnregister EventSetInformation EventWriteTransfer

version

VerQueryValueW GetFileVersionInfoW GetFileVersionInfoSizeW

ntdll

NtQuerySystemInformation RtlLookupFunctionEntry RtlVirtualUnwind RtlUnwindEx RtlPcToFileHeader RtlCaptureContext

kernel32

MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW WriteConsoleW CreateFileW HeapReAlloc HeapSize GetConsoleMode GetConsoleOutputCP GetCurrentProcess SetProcessMitigationPolicy LocalFree HeapFree GetModuleFileNameW CreateToolhelp32Snapshot Process32NextW Process32FirstW CloseHandle HeapAlloc GetCurrentProcessId GetProcessHeap ReadFile GetStdHandle WriteFile GetLastError GetCPInfo FlushFileBuffers SetFilePointerEx GetFileSizeEx GetStringTypeW ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW GetModuleHandleW RaiseException GetOEMCP SetLastError EncodePointer EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary GetProcAddress LoadLibraryExW ExitProcess GetModuleHandleExW GetCommandLineA GetCommandLineW GetFileType FlsAlloc FlsGetValue FlsSetValue FlsFree InitializeCriticalSectionEx VirtualProtect CompareStringW LCMapStringW FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP SetStdHandle

Name

.text

Size

104KB

Virtual Size

103KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

116KB

Virtual Size

115KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

8KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

4KB

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

56KB

Virtual Size

105KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rcd003

Size

84KB

Virtual Size

84KB

Characteristics

IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-26_9f1c7dacfe5f488f0dbc9a6f78fd3ba9_cobalt-strike_icedid_luca-stealer_njrat_stealc

rpcrt4

advapi32

version

ntdll

kernel32

generic