2026-09-27_8fc315505b46e38a3f0d3e38439854ec_cobalt-strike_icedid_luca-stealer_njrat_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-27_8fc315505b46e38a3f0d3e38439854ec_cobalt-strike_icedid_luca-stealer_njrat_stealc
Size 912KB
Sample260928-djh6bstdqa
SHA256 3098ee59b11d1c6fb0dd264416ecb61df9c8f0354f6bbdb7c4bc1c94d6d93563
MD5 8fc315505b46e38a3f0d3e38439854ec
SHA1 f06fd99863be2538476ee03fe580d0380cf4c40f
SHA512 1855db5f7c5d3448e28e26e3f387721537e9f4a0cac0e4972619ee82e372d9982f4cab5447bf9ebc337a502d945d76e2cc648ee8c26b410f916775a10421db52
SSDEEP 12288:JQlUz263PsV98K3/nl1G9Bdf1HqPB8IadUBwr7Dnc24qV:JkUaakV98Sl18HdKPB8IanDncPy
TLSH
T15F15AE1AB7F801F6D1AB9134C9966A07E6727C5507209ADF13E4056A3FB36E00FBB712
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-27_8fc315505b46e38a3f0d3e38439854ec_cobalt-strike_icedid_luca-stealer_njrat_stealc

File Explorer

2026-09-27_8fc315505b46e38a3f0d3e38439854ec_cobalt-strike_icedid_luca-stealer_njrat_stealc

.exe 912KB

2026-09-27_8fc315505b46e38a3f0d3e38439854ec_cobalt-strike_icedid_luca-stealer_njrat_stealc

IMPHASH 209325fe0fbfe6b9e0c4c333968f2e62
SHA256 3098ee59b11d1c6fb0dd264416ecb61df9c8f0354f6bbdb7c4bc1c94d6d93563
MD5 8fc315505b46e38a3f0d3e38439854ec
SHA1 f06fd99863be2538476ee03fe580d0380cf4c40f
SHA512 1855db5f7c5d3448e28e26e3f387721537e9f4a0cac0e4972619ee82e372d9982f4cab5447bf9ebc337a502d945d76e2cc648ee8c26b410f916775a10421db52
SSDEEP 12288:JQlUz263PsV98K3/nl1G9Bdf1HqPB8IadUBwr7Dnc24qV:JkUaakV98Sl18HdKPB8IanDncPy
TLSH
T15F15AE1AB7F801F6D1AB9134C9966A07E6727C5507209ADF13E4056A3FB36E00FBB712
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

446048

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

d3d11

D3D11CreateDeviceAndSwapChain

d3dcompiler_47

D3DCompile

advapi32

OpenProcessToken GetTokenInformation

shell32

ShellExecuteA

comdlg32

GetOpenFileNameA

user32

TranslateMessage DispatchMessageA LoadCursorA ScreenToClient ClientToScreen GetCursorPos SetCursor SetCursorPos GetClientRect ReleaseCapture SetCapture GetCapture GetKeyState IsChild EmptyClipboard GetClipboardData SetClipboardData CloseClipboard OpenClipboard CallNextHookEx UnhookWindowsHookEx SetWindowsHookExA GetWindowThreadProcessId MessageBeep SetWindowTextA GetForegroundWindow UpdateWindow GetSystemMetrics MapVirtualKeyA SendInput GetKeyNameTextA SetWindowPos ShowWindow DestroyWindow CreateWindowExW RegisterClassExW UnregisterClassW PostQuitMessage DefWindowProcW GetMessageExtraInfo PeekMessageA

imm32

ImmSetCompositionWindow ImmReleaseContext ImmGetContext

xinput1_4

ord4 ord2

kernel32

SetStdHandle GetProcessHeap SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW OutputDebugStringW HeapReAlloc ReadConsoleW SetFilePointerEx GetFileSizeEx CreateFileW GetConsoleOutputCP FlushFileBuffers EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW VirtualProtect FlsFree FlsSetValue FlsGetValue FlsAlloc HeapFree HeapAlloc GetCommandLineW GetCommandLineA WriteFile ExitProcess WriteConsoleW HeapSize SetEndOfFile GetConsoleMode WakeAllConditionVariable GetModuleFileNameW GetFileType GetStdHandle CreateDirectoryA DeleteFileA FindClose FindFirstFileA FindNextFileA CloseHandle WaitForSingleObject Sleep GetCurrentProcess GetCurrentProcessId CreateRemoteThread GetExitCodeThread FlushInstructionCache OpenProcess GetLocalTime GetTickCount64 VirtualAllocEx VirtualProtectEx WriteProcessMemory VirtualFreeEx GetModuleFileNameA GetModuleHandleA GetProcAddress LoadLibraryA GetPrivateProfileStringA WritePrivateProfileStringA WideCharToMultiByte CreateToolhelp32Snapshot Process32FirstW Process32NextW GlobalAlloc GlobalUnlock GlobalLock GlobalFree QueryPerformanceCounter QueryPerformanceFrequency GetCurrentThreadId ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection RtlUnwind SleepConditionVariableSRW EncodePointer DecodePointer MultiByteToWideChar LCMapStringEx GetSystemTimeAsFileTime GetModuleHandleW GetStringTypeW GetCPInfo RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent TerminateProcess InitializeSListHead ReadFile RtlPcToFileHeader RaiseException RtlUnwindEx GetLastError SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW CreateThread ExitThread FreeLibraryAndExitThread GetModuleHandleExW

Name

.text

Size

635KB

Virtual Size

634KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

170KB

Virtual Size

170KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

76KB

Virtual Size

83KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

26KB

Virtual Size

25KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-27_8fc315505b46e38a3f0d3e38439854ec_cobalt-strike_icedid_luca-stealer_njrat_stealc

d3d11

d3dcompiler_47

advapi32

shell32

comdlg32

user32

imm32

xinput1_4

kernel32

generic