2026-09-27_7a5395839c218bf5e469c371f0cbe9a9_cobalt-strike_icedid_luca-stealer_njrat_stealc

General

Target
2026-09-27_7a5395839c218bf5e469c371f0cbe9a9_cobalt-strike_icedid_luca-stealer_njrat_stealc
Size 369KB
Sample260928-evyktsvbla
SHA256 c09a8406b04f6332704efc9eff3eaace7cf1576655261bc32f4b648280f60fd5
MD5 7a5395839c218bf5e469c371f0cbe9a9
SHA1 24ac317130b3b402c585e99ee9ba8634a7cc1370
SHA512 0066c3baa435d17d0867f3fa173105d33b4c058b1352d97ec534b136cc57b56a4cf728195504e735bd3086e18a9bdec7e2cbe11cd45c39993dda1fb5f5fe5322
SSDEEP 6144:YmJJAsMXQqRTsawQMJMCQ1C7XlxDWllbnx:V/zMFjwQEDLCV
TLSH
T19A849E16E76414F9E967D17CC9624902EBB2BC9E0760E7CF13A449A60F237E05E3E712
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-27_7a5395839c218bf5e469c371f0cbe9a9_cobalt-strike_icedid_luca-stealer_njrat_stealc

File Explorer

2026-09-27_7a5395839c218bf5e469c371f0cbe9a9_cobalt-strike_icedid_luca-stealer_njrat_stealc

.exe 369KB

2026-09-27_7a5395839c218bf5e469c371f0cbe9a9_cobalt-strike_icedid_luca-stealer_njrat_stealc

IMPHASH 52fe4d0827e22629dd9cf0bcffc373bb
SHA256 c09a8406b04f6332704efc9eff3eaace7cf1576655261bc32f4b648280f60fd5
MD5 7a5395839c218bf5e469c371f0cbe9a9
SHA1 24ac317130b3b402c585e99ee9ba8634a7cc1370
SHA512 0066c3baa435d17d0867f3fa173105d33b4c058b1352d97ec534b136cc57b56a4cf728195504e735bd3086e18a9bdec7e2cbe11cd45c39993dda1fb5f5fe5322
SSDEEP 6144:YmJJAsMXQqRTsawQMJMCQ1C7XlxDWllbnx:V/zMFjwQEDLCV
TLSH
T19A849E16E76414F9E967D17CC9624902EBB2BC9E0760E7CF13A449A60F237E05E3E712
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

64812

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

user32

MessageBoxA

kernel32

FindClose CreateMutexA Sleep GetConsoleMode GetLastError SetConsoleCursorInfo CloseHandle SetConsoleOutputCP GetSystemTimeAsFileTime VirtualFree VirtualAlloc GetCurrentThreadId GetModuleHandleA GetProcAddress GetCurrentProcessId DeviceIoControl CreateFileW GetModuleFileNameW GetTempPathW WriteConsoleW GetConsoleCursorInfo SetConsoleMode GetStdHandle SetConsoleTitleA SetEndOfFile SetConsoleTitleW IsProcessorFeaturePresent HeapSize SetStdHandle GetProcessHeap SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP GetACP IsValidCodePage FindNextFileW EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer MultiByteToWideChar WideCharToMultiByte LCMapStringEx GetStringTypeW GetCPInfo ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess RtlUnwind IsDebuggerPresent GetStartupInfoW GetModuleHandleW QueryPerformanceCounter InitializeSListHead RtlUnwindEx RtlPcToFileHeader RaiseException SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW GetConsoleCP DeleteFileW ExitProcess GetModuleHandleExW WriteFile GetCommandLineA GetCommandLineW HeapAlloc HeapFree FlsAlloc FlsGetValue FlsSetValue FlsFree VirtualProtect CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetFileType ReadConsoleInputW ReadConsoleW WaitForSingleObject GetExitCodeProcess CreateProcessW GetFileAttributesExW GetFileSizeEx SetFilePointerEx FlushFileBuffers GetConsoleOutputCP ReadFile HeapReAlloc FindFirstFileExW

advapi32

RegCloseKey RegDeleteTreeW RegCreateKeyW RegOpenKeyW AllocateAndInitializeSid FreeSid CheckTokenMembership RegSetKeyValueW

ntdll

RtlInitUnicodeString NtQuerySystemInformation RtlAdjustPrivilege RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind NtUnloadDriver NtLoadDriver

Name

.text

Size

208KB

Virtual Size

207KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

141KB

Virtual Size

140KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

11KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

488B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-27_7a5395839c218bf5e469c371f0cbe9a9_cobalt-strike_icedid_luca-stealer_njrat_stealc

user32

kernel32

advapi32

ntdll

generic