2026-09-29_4dca5f84ee27611ee87d5a98a289a89e_cobalt-strike_icedid_luca-stealer_njrat_stealc

General

Target
2026-09-29_4dca5f84ee27611ee87d5a98a289a89e_cobalt-strike_icedid_luca-stealer_njrat_stealc
Size 464KB
Sample260930-bvx3hswhjf
SHA256 dc2a334cb479db9f62d082d0354d471f32f432a3f8ce2dd8016338ed472f3b89
MD5 4dca5f84ee27611ee87d5a98a289a89e
SHA1 a20613f9d30627f99c33bc89d5bd4b6ada867982
SHA512 ec1d5e0a6ff84a1b071a29ea15bfd21188551647dd89638930f85ea897804b288aff0577e9d92e0f322a86c5ea53e31dfeeebb01a588c6b92085760e5a3a0e7a
SSDEEP 6144:edptB2v3m8y1ykB7HiunCE58Ft3d29B1d2sm/3TNmBi:e+3ABbIEyt3i1d6/35
TLSH
T19BA4D74BEAB211E4D4BAC1388662712BFCB134594374ABD7DB809B531772BE4A63E710
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-29_4dca5f84ee27611ee87d5a98a289a89e_cobalt-strike_icedid_luca-stealer_njrat_stealc

File Explorer

2026-09-29_4dca5f84ee27611ee87d5a98a289a89e_cobalt-strike_icedid_luca-stealer_njrat_stealc

.exe 464KB

2026-09-29_4dca5f84ee27611ee87d5a98a289a89e_cobalt-strike_icedid_luca-stealer_njrat_stealc

IMPHASH b32d579990706cf92573d7b9a067f3bc
SHA256 dc2a334cb479db9f62d082d0354d471f32f432a3f8ce2dd8016338ed472f3b89
MD5 4dca5f84ee27611ee87d5a98a289a89e
SHA1 a20613f9d30627f99c33bc89d5bd4b6ada867982
SHA512 ec1d5e0a6ff84a1b071a29ea15bfd21188551647dd89638930f85ea897804b288aff0577e9d92e0f322a86c5ea53e31dfeeebb01a588c6b92085760e5a3a0e7a
SSDEEP 6144:edptB2v3m8y1ykB7HiunCE58Ft3d29B1d2sm/3TNmBi:e+3ABbIEyt3i1d6/35
TLSH
T19BA4D74BEAB211E4D4BAC1388662712BFCB134594374ABD7DB809B531772BE4A63E710
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

268732

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

GetCommConfig RemoveDirectoryTransactedW HeapCreate AddDllDirectory RtlCaptureContext EnumResourceTypesW SetConsoleWindowInfo CompareStringOrdinal OpenFileById OpenFile GetCommMask GetCommTimeouts GlobalDeleteAtom ClosePrivateNamespace ConvertThreadToFiberEx FormatMessageW CancelSynchronousIo ReleaseSRWLockExclusive ReclaimVirtualMemory CompareStringEx GetCurrentDirectoryW GetProcessPreferredUILanguages FindNextChangeNotification UnlockFile InitAtomTable SetProtectedPolicy DisableThreadProfiling CreateFiberEx GetCurrentConsoleFont GetLongPathNameW FreeEnvironmentStringsW GetLogicalDriveStringsW LCMapStringEx GetLastError CloseHandle HeapAlloc GetCurrentProcessId GetProcessHeap GetModuleHandleW GetThreadGroupAffinity SizeofResource GetVolumeInformationW CompareFileTime GetBinaryTypeW GetPhysicallyInstalledSystemMemory DeleteTimerQueue SetConsoleMode GetConsoleHistoryInfo VirtualUnlock GetUserDefaultUILanguage InitializeCriticalSectionAndSpinCount GetConsoleAliasExesW QueryThreadCycleTime IsSystemResumeAutomatic GetSystemDefaultLangID CancelWaitableTimer GetPrivateProfileStringW ResolveLocaleName Sleep MoveFileWithProgressW FillConsoleOutputCharacterW GlobalFindAtomW GetMemoryErrorHandlingCapabilities GetNamedPipeClientSessionId UnregisterWaitEx GetOverlappedResultEx GetThreadTimes GetCalendarInfoEx LocalUnlock GetFileTime EnumResourceTypesExW RtlUnwind SetWaitableTimer GetCurrentProcess RegisterWaitForSingleObject GetProfileIntW SetFileTime AddSecureMemoryCacheCallback WaitForMultipleObjects TryAcquireSRWLockShared FlsGetValue EnumResourceNamesW CreateBoundaryDescriptorW EnumCalendarInfoExW GetFileAttributesTransactedW GetVersionExW WaitForThreadpoolWorkCallbacks HeapWalk GetACP OpenProcess SwitchToFiber TzSpecificLocalTimeToSystemTime GetFileAttributesExW GetThreadUILanguage CloseThreadpoolTimer TerminateThread CreateHardLinkTransactedW GetSystemInfo Wow64SuspendThread SetVolumeMountPointW ReadDirectoryChangesW VirtualLock UnregisterApplicationRestart SetThreadStackGuarantee FindAtomW GetTempFileNameW ConvertThreadToFiber VirtualQuery OpenThread AreFileApisANSI GetStartupInfoW SetSystemTimeAdjustment ReadFile WriteProfileStringW QueryThreadpoolStackInformation GetOEMCP GetConsoleOutputCP GetStdHandle SetProcessShutdownParameters GetNumaProcessorNodeEx InitializeCriticalSectionEx UnregisterBadMemoryNotification DisconnectNamedPipe ApplicationRecoveryInProgress BuildCommDCBAndTimeoutsW PowerCreateRequest BuildCommDCBW ClearCommError UpdateResourceW CloseThreadpoolIo CreateFileMappingFromApp ExitProcess SetConsoleCP SetThreadExecutionState GetConsoleWindow DeleteTimerQueueTimer EnumSystemFirmwareTables lstrcmpW lstrlenW CreateFileW GetConsoleMode FlushFileBuffers HeapSize SetFilePointerEx QueryPerformanceCounter QueryPerformanceFrequency WideCharToMultiByte GetSystemTimeAsFileTime GetProcAddress EnterCriticalSection LeaveCriticalSection DeleteCriticalSection EncodePointer DecodePointer MultiByteToWideChar GetStringTypeW GetCPInfo IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent GetCurrentThreadId InitializeSListHead TerminateProcess RtlUnwindEx RtlPcToFileHeader RaiseException SetLastError TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW GetModuleHandleExW GetModuleFileNameW WriteFile HeapReAlloc HeapFree GetFileType FlsAlloc FlsSetValue FlsFree LCMapStringW FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetCommandLineA GetCommandLineW GetEnvironmentStringsW SetStdHandle WriteConsoleW

ntdll

RtlLookupFunctionEntry RtlVirtualUnwind

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-29_4dca5f84ee27611ee87d5a98a289a89e_cobalt-strike_icedid_luca-stealer_njrat_stealc

kernel32

ntdll

generic