2026-09-28_7b6c84031d3759a72ec9a412772b648c_cobalt-strike_icedid_luca-stealer_njrat_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-28_7b6c84031d3759a72ec9a412772b648c_cobalt-strike_icedid_luca-stealer_njrat_stealc
Size 318KB
Sample260928-ryf66sbc54
SHA256 22f973e48e6dff58d2c98019379fd2a11218292bcb3d2806290cbe61b9fc620e
MD5 7b6c84031d3759a72ec9a412772b648c
SHA1 bc892bad895c642ae7ee867a55a78d90eb2fde07
SHA512 5b0029bdcbbbb1adc5bff1f3fecb67f144f637b690f758278470f2e8404939c50a1637db6d30b3f58629ebe0f85d37bb63fad7e610c7832fae781ac2ee01fcf5
SSDEEP 3072:GSjyo33C8v7lF0YOFQQbUhGizRhSDLWvO2JD/vYy8hKE1J4loTpVV/:GSd3C6OaQIkBuFW
TLSH
T1BA646B15A7A50CF9FD77823DCD464902EA727C164BA0EADF03904AA61F237D09E3E712
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-28_7b6c84031d3759a72ec9a412772b648c_cobalt-strike_icedid_luca-stealer_njrat_stealc

File Explorer

2026-09-28_7b6c84031d3759a72ec9a412772b648c_cobalt-strike_icedid_luca-stealer_njrat_stealc

.exe 318KB

2026-09-28_7b6c84031d3759a72ec9a412772b648c_cobalt-strike_icedid_luca-stealer_njrat_stealc

IMPHASH 59f728701a2a9338a7775fbc66ec772e
SHA256 22f973e48e6dff58d2c98019379fd2a11218292bcb3d2806290cbe61b9fc620e
MD5 7b6c84031d3759a72ec9a412772b648c
SHA1 bc892bad895c642ae7ee867a55a78d90eb2fde07
SHA512 5b0029bdcbbbb1adc5bff1f3fecb67f144f637b690f758278470f2e8404939c50a1637db6d30b3f58629ebe0f85d37bb63fad7e610c7832fae781ac2ee01fcf5
SSDEEP 3072:GSjyo33C8v7lF0YOFQQbUhGizRhSDLWvO2JD/vYy8hKE1J4loTpVV/:GSd3C6OaQIkBuFW
TLSH
T1BA646B15A7A50CF9FD77823DCD464902EA727C164BA0EADF03904AA61F237D09E3E712
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

53704

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

CreateFileW GetFileAttributesW SetFileAttributesW MultiByteToWideChar Sleep GetLastError GetCurrentThread LockResource DeleteFileW CloseHandle CreateThread LoadResource FindResourceW MoveFileExW GetFileSize GetCurrentProcessId CreateProcessW WideCharToMultiByte WriteConsoleW GetTempPathW GetConsoleOutputCP FlushFileBuffers HeapSize SetFilePointerEx SetStdHandle GetProcessHeap FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW FindClose HeapReAlloc EnumSystemLocalesW GetUserDefaultLCID SetThreadPriority TerminateProcess WriteFile SizeofResource GetConsoleMode ReadFile IsValidLocale GetLocaleInfoW LCMapStringW VirtualProtect FlsFree FlsSetValue FlsGetValue FlsAlloc GetFileType HeapAlloc HeapFree GetStdHandle GetModuleFileNameW GetModuleHandleExW ExitProcess LoadLibraryExW GetProcAddress FreeLibrary TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount SetLastError RaiseException RtlPcToFileHeader RtlUnwindEx InitializeSListHead GetSystemTimeAsFileTime GetCurrentThreadId QueryPerformanceCounter GetModuleHandleW GetStartupInfoW IsDebuggerPresent IsProcessorFeaturePresent GetCurrentProcess EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer LCMapStringEx GetStringTypeW GetCPInfo RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter

user32

DispatchMessageW GetMessageW DefWindowProcW PostMessageW EndPaint BeginPaint ReleaseDC ReleaseCapture UpdateWindow PostQuitMessage KillTimer UpdateLayeredWindow LoadCursorW LoadIconW TranslateMessage GetWindowRect SetTimer ShowWindow RegisterClassExW GetSystemMetrics SendMessageW CreateWindowExW MessageBoxW GetDC DestroyWindow

gdi32

CreateDIBSection CreateCompatibleDC DeleteDC DeleteObject SelectObject

shell32

SHCreateDirectoryExW

gdiplus

GdipDeletePen GdipCreateBitmapFromScan0 GdipCreatePen1 GdipSetStringFormatAlign GdipDeleteFont GdipDeleteGraphics GdipAddPathArc GdipGetImageGraphicsContext GdipSetTextRenderingHint GdipDrawString GdipDrawPath GdipClosePathFigure GdipFillPath GdipResetPath GdipCreateSolidFill GdipSetInterpolationMode GdipCreateFont GdipSetStringFormatLineAlign GdipCreatePath GdipSetSmoothingMode GdipDisposeImage GdipDeletePath GdipDeleteBrush GdipCreateFontFamilyFromName GdipDeleteFontFamily GdipCreateStringFormat GdiplusShutdown GdiplusStartup GdipDeleteStringFormat

wininet

InternetOpenW HttpQueryInfoW InternetOpenUrlW InternetReadFile InternetCloseHandle InternetSetOptionW

Name

.text

Size

163KB

Virtual Size

163KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

77KB

Virtual Size

77KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

9KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1024B

Virtual Size

752B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-28_7b6c84031d3759a72ec9a412772b648c_cobalt-strike_icedid_luca-stealer_njrat_stealc

kernel32

user32

gdi32

shell32

gdiplus

wininet

generic