2026-09-29_2293707736b229c37bde3bf523a524d3_cobalt-strike_icedid_luca-stealer_njrat_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-29_2293707736b229c37bde3bf523a524d3_cobalt-strike_icedid_luca-stealer_njrat_stealc
Size 385KB
Sample260930-e1tttsxanb
SHA256 c253e73abf10b837df22966dca6ce004e121314f79a4fa44713624c993c31b3f
MD5 2293707736b229c37bde3bf523a524d3
SHA1 1f65c2f2ba752458694c3f54fb62a88df1abd39c
SHA512 50ff0292ebd378be13618d147daa13490731c399e3c59221e45279127e359da89b751fd81f2cc10c93792eaa74545a091ece2c1e766e8ccf6478e23b50084976
SSDEEP 6144:R2DJiR3p+RoMM9bn/1B9Q50UDNQznNKbLmaV5bwWI8zTG2wzsI:zGR/oQDInsvFVzbwzs
TLSH
T134849D29E7A511F9E977817CCD928901EB727C5647B0DBDF076049662F23AE08E3E702
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-29_2293707736b229c37bde3bf523a524d3_cobalt-strike_icedid_luca-stealer_njrat_stealc

File Explorer

2026-09-29_2293707736b229c37bde3bf523a524d3_cobalt-strike_icedid_luca-stealer_njrat_stealc

.exe 385KB

2026-09-29_2293707736b229c37bde3bf523a524d3_cobalt-strike_icedid_luca-stealer_njrat_stealc

IMPHASH 27658bd5b27383d9987089da4b01e7fc
SHA256 c253e73abf10b837df22966dca6ce004e121314f79a4fa44713624c993c31b3f
MD5 2293707736b229c37bde3bf523a524d3
SHA1 1f65c2f2ba752458694c3f54fb62a88df1abd39c
SHA512 50ff0292ebd378be13618d147daa13490731c399e3c59221e45279127e359da89b751fd81f2cc10c93792eaa74545a091ece2c1e766e8ccf6478e23b50084976
SSDEEP 6144:R2DJiR3p+RoMM9bn/1B9Q50UDNQznNKbLmaV5bwWI8zTG2wzsI:zGR/oQDInsvFVzbwzs
TLSH
T134849D29E7A511F9E977817CCD928901EB727C5647B0DBDF076049662F23AE08E3E702
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

78452

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

d3d11

CreateDirect3D11DeviceFromDXGIDevice D3D11CreateDevice

d3d12

ord101

d3dcompiler_47

D3DCompile

dwmapi

DwmGetWindowAttribute

api-ms-win-core-synch-l1-1-0

ReleaseSRWLockExclusive SetEvent AcquireSRWLockExclusive TryAcquireSRWLockExclusive LeaveCriticalSection WaitForSingleObject EnterCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount CreateEventW WaitForSingleObjectEx InitializeCriticalSectionEx

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime GetLocalTime GetTickCount64

api-ms-win-core-console-l3-2-0

GetConsoleProcessList

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcess GetExitCodeThread ExitProcess TlsAlloc TlsGetValue TlsSetValue TlsFree GetCurrentProcessId CreateThread ExitThread GetCurrentThreadId TerminateProcess GetStartupInfoW

api-ms-win-core-libraryloader-l1-2-0

GetProcAddress FreeLibrary GetModuleFileNameW FreeLibraryAndExitThread GetModuleHandleExW GetModuleHandleW LoadLibraryExW

api-ms-win-core-file-l1-1-0

SetFilePointerEx FindFirstFileExW GetFileSizeEx WriteFile CreateFileW ReadFile FindFirstFileW GetFileAttributesW FindClose FlushFileBuffers GetFileType FindNextFileW GetFileAttributesExW

api-ms-win-core-privateprofile-l1-1-0

GetPrivateProfileStringW WritePrivateProfileStringW

api-ms-win-core-processenvironment-l1-1-0

GetStdHandle SetEnvironmentVariableW GetCommandLineA SetStdHandle GetEnvironmentStringsW GetCommandLineW FreeEnvironmentStringsW

api-ms-win-core-errorhandling-l1-1-0

SetUnhandledExceptionFilter SetLastError RaiseException UnhandledExceptionFilter GetLastError

api-ms-win-core-file-l2-1-0

MoveFileExW GetFileInformationByHandleEx

api-ms-win-core-string-l1-1-0

GetStringTypeW CompareStringW WideCharToMultiByte MultiByteToWideChar

api-ms-win-core-console-l1-1-0

WriteConsoleW ReadConsoleW GetConsoleMode SetConsoleMode GetConsoleOutputCP

api-ms-win-core-console-l2-1-0

SetConsoleOutputCP

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-libraryloader-l1-2-1

LoadLibraryW

api-ms-win-core-largeinteger-l1-1-0

MulDiv

api-ms-win-core-toolhelp-l1-1-0

CreateToolhelp32Snapshot Process32NextW Process32FirstW

api-ms-win-core-version-l1-1-1

GetFileVersionInfoW

api-ms-win-core-version-l1-1-0

VerQueryValueW

gdi32

SelectObject SetTextColor CreateSolidBrush SetBkMode CreateFontW DeleteObject

version

GetFileVersionInfoSizeW

kernel32

K32EnumProcessModules

user32

SetWindowLongPtrW EqualRect FillRect GetClientRect EndPaint BeginPaint SetForegroundWindow DrawTextW GetDpiForWindow IsWindowVisible SetWindowPos SetLayeredWindowAttributes GetWindowLongPtrW CreateWindowExW RegisterClassW PostQuitMessage DefWindowProcW PostMessageW SetProcessDpiAwarenessContext GetForegroundWindow MsgWaitForMultipleObjects IsWindow UnregisterHotKey RegisterHotKey PeekMessageW DispatchMessageW TranslateMessage EnumWindows GetWindowThreadProcessId GetWindow LoadCursorW ShowWindow IsIconic

api-ms-win-core-synch-l1-2-0

WakeAllConditionVariable SleepConditionVariableSRW

api-ms-win-core-localization-l1-2-0

GetACP IsValidCodePage GetOEMCP GetCPInfo FormatMessageW LCMapStringW

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent

api-ms-win-core-rtlsupport-l1-1-0

RtlVirtualUnwind RtlUnwind RtlPcToFileHeader RtlCaptureContext RtlLookupFunctionEntry RtlUnwindEx

api-ms-win-core-debug-l1-1-0

IsDebuggerPresent

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead InterlockedPushEntrySList

api-ms-win-core-util-l1-1-0

EncodePointer

api-ms-win-core-heap-l1-1-0

GetProcessHeap HeapAlloc HeapFree HeapSize HeapReAlloc

api-ms-win-core-fibers-l1-1-0

FlsFree FlsSetValue FlsAlloc FlsGetValue

api-ms-win-core-memory-l1-1-0

VirtualProtect

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory

api-ms-win-core-winrt-error-l1-1-1

RoOriginateLanguageException

oleaut32

SysStringLen SetErrorInfo GetErrorInfo SysFreeString

api-ms-win-core-com-l1-1-0

CoCreateFreeThreadedMarshaler CoInitializeEx

Name

.text

Size

188KB

Virtual Size

187KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

88KB

Virtual Size

87KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

6KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

10KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

88KB

Virtual Size

88KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-29_2293707736b229c37bde3bf523a524d3_cobalt-strike_icedid_luca-stealer_njrat_stealc

d3d11

d3d12

d3dcompiler_47

dwmapi

api-ms-win-core-synch-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-console-l3-2-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-file-l1-1-0

api-ms-win-core-privateprofile-l1-1-0

api-ms-win-core-processenvironment-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-file-l2-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-console-l1-1-0

api-ms-win-core-console-l2-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-libraryloader-l1-2-1

api-ms-win-core-largeinteger-l1-1-0

api-ms-win-core-toolhelp-l1-1-0

api-ms-win-core-version-l1-1-1

api-ms-win-core-version-l1-1-0

gdi32

version

kernel32

user32

api-ms-win-core-synch-l1-2-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-processthreads-l1-1-1

api-ms-win-core-rtlsupport-l1-1-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-interlocked-l1-1-0

api-ms-win-core-util-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-fibers-l1-1-0

api-ms-win-core-memory-l1-1-0

api-ms-win-core-winrt-l1-1-0

api-ms-win-core-winrt-error-l1-1-1

oleaut32

api-ms-win-core-com-l1-1-0

generic