2026-09-29_5e46c941261e94fcd4e0f0bb9f043111_cobalt-strike_icedid_luca-stealer_njrat_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-29_5e46c941261e94fcd4e0f0bb9f043111_cobalt-strike_icedid_luca-stealer_njrat_stealc
Size 746KB
Sample260930-acj79swv2n
SHA256 af264b7a5fdaec301c25a8d43d92e74bfe486f312f635fbcd69a612e7def2c8e
MD5 5e46c941261e94fcd4e0f0bb9f043111
SHA1 405d0ecbefb27f7784fa2b49e645a1d8f1951a0e
SHA512 e8f31e16389bc486ff236d5795183904e9d498d38e23f0b634db7cc5155d2cb837e0f9dd28c9d9be2ee8c324e82980b7a59eef85bdb9c2f728b9505b5a5809a2
SSDEEP 12288:7vHKRHSaOfKtq4wLJH9Bz6fZQswHP6lsOP1Nf7i2n4or+ryjN:TKVVOfKtpwLJvaZNwHP6lsO/i2n45y
TLSH
T1D1F4BF49F2F901E8E1BB9534D5A2661BE53278550B308ACF23E4056D6F737D04BBBB22
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-29_5e46c941261e94fcd4e0f0bb9f043111_cobalt-strike_icedid_luca-stealer_njrat_stealc

File Explorer

2026-09-29_5e46c941261e94fcd4e0f0bb9f043111_cobalt-strike_icedid_luca-stealer_njrat_stealc

.exe 746KB

2026-09-29_5e46c941261e94fcd4e0f0bb9f043111_cobalt-strike_icedid_luca-stealer_njrat_stealc

IMPHASH c7bb51b8b2e563773d6e5f4a673ad93e
SHA256 af264b7a5fdaec301c25a8d43d92e74bfe486f312f635fbcd69a612e7def2c8e
MD5 5e46c941261e94fcd4e0f0bb9f043111
SHA1 405d0ecbefb27f7784fa2b49e645a1d8f1951a0e
SHA512 e8f31e16389bc486ff236d5795183904e9d498d38e23f0b634db7cc5155d2cb837e0f9dd28c9d9be2ee8c324e82980b7a59eef85bdb9c2f728b9505b5a5809a2
SSDEEP 12288:7vHKRHSaOfKtq4wLJH9Bz6fZQswHP6lsOP1Nf7i2n4or+ryjN:TKVVOfKtpwLJvaZNwHP6lsO/i2n45y
TLSH
T1D1F4BF49F2F901E8E1BB9534D5A2661BE53278550B308ACF23E4056D6F737D04BBBB22
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

378804

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

d3d11

D3D11CreateDeviceAndSwapChain

d3dcompiler_47

D3DCompile

user32

PeekMessageA DispatchMessageA TranslateMessage GetCapture PostQuitMessage SetProcessDPIAware LoadCursorA ScreenToClient ClientToScreen GetCursorPos SetCursor SetCursorPos GetClientRect GetForegroundWindow IsWindowUnicode ReleaseCapture SetCapture UnregisterClassW GetKeyState GetMessageExtraInfo TrackMouseEvent GetKeyboardLayout EmptyClipboard GetClipboardData SetClipboardData CloseClipboard OpenClipboard UpdateWindow ShowWindow DestroyWindow CreateWindowExW RegisterClassExW DefWindowProcW

kernel32

FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetCPInfo GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW FindClose GetFileSizeEx SetFilePointerEx ReadConsoleW GetConsoleMode GetConsoleOutputCP FlushFileBuffers OutputDebugStringW LCMapStringW VirtualProtect FlsFree GetFileAttributesA CloseHandle GetLastError WaitForSingleObject Sleep OpenProcess VirtualQueryEx ReadProcessMemory WriteProcessMemory GetModuleHandleA CreateToolhelp32Snapshot Process32FirstW Process32NextW Module32FirstW Module32NextW GlobalAlloc GlobalUnlock GlobalLock GlobalFree MultiByteToWideChar WideCharToMultiByte VerSetConditionMask QueryPerformanceCounter QueryPerformanceFrequency HeapSize LoadLibraryA GetLocaleInfoA WaitForSingleObjectEx GetCurrentThreadId GetExitCodeThread ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive SleepConditionVariableSRW InitializeCriticalSectionEx GetSystemTimeAsFileTime GetModuleHandleW WakeAllConditionVariable RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent GetCurrentProcessId InitializeSListHead IsDebuggerPresent GetStartupInfoW FlsSetValue FlsGetValue FlsAlloc SetStdHandle GetStringTypeW GetProcessHeap GetProcAddress CreateFileW HeapReAlloc SetEndOfFile FreeLibrary HeapAlloc HeapFree ExitProcess RtlPcToFileHeader RaiseException RtlUnwindEx SetLastError EncodePointer EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW CreateThread ExitThread FreeLibraryAndExitThread GetModuleHandleExW GetStdHandle GetFileType GetModuleFileNameW WriteConsoleW ReadFile WriteFile

shell32

ShellExecuteW

imm32

ImmSetCompositionWindow ImmReleaseContext ImmGetContext ImmSetCandidateWindow

Name

.text

Size

533KB

Virtual Size

532KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

180KB

Virtual Size

179KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

25KB

Virtual Size

25KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-29_5e46c941261e94fcd4e0f0bb9f043111_cobalt-strike_icedid_luca-stealer_njrat_stealc

d3d11

d3dcompiler_47

user32

kernel32

shell32

imm32

generic