2026-09-30_d4e9d4833c82ba43667bd32a939f63a9_cobalt-strike_icedid_luca-stealer_njrat_stealc

General

Target
2026-09-30_d4e9d4833c82ba43667bd32a939f63a9_cobalt-strike_icedid_luca-stealer_njrat_stealc
Size 934KB
Sample260930-jdrheayckd
SHA256 00cacbfcfabf4aeed4461481381a943ecc3b571d54d5874a6ffe59fcb1f2be71
MD5 d4e9d4833c82ba43667bd32a939f63a9
SHA1 d7285dc90aa27f8e057ebd008e4ca341aebd8525
SHA512 7472b44526041135ba7920d32d880a7e39fab389f706f3dcbfb1106a4a27db68330534cf1a78c74c2f53756a61c41ff528583c1205f3c9e14d060a679143e888
SSDEEP 24576:09ED+ugR9q+dicaamo0sCBxbtbNQ0jJ+9Ms5T:0OvgSY9aFTtbNQ014Ms
TLSH
T15515F11AE79454FDF1BBC138C9529E06EA317C4E47A1A6DF23D44A921F232D05E3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-30_d4e9d4833c82ba43667bd32a939f63a9_cobalt-strike_icedid_luca-stealer_njrat_stealc

File Explorer

2026-09-30_d4e9d4833c82ba43667bd32a939f63a9_cobalt-strike_icedid_luca-stealer_njrat_stealc

.exe 934KB

2026-09-30_d4e9d4833c82ba43667bd32a939f63a9_cobalt-strike_icedid_luca-stealer_njrat_stealc

IMPHASH 39e34f3df338c9b6ad89b65d51c15154
SHA256 00cacbfcfabf4aeed4461481381a943ecc3b571d54d5874a6ffe59fcb1f2be71
MD5 d4e9d4833c82ba43667bd32a939f63a9
SHA1 d7285dc90aa27f8e057ebd008e4ca341aebd8525
SHA512 7472b44526041135ba7920d32d880a7e39fab389f706f3dcbfb1106a4a27db68330534cf1a78c74c2f53756a61c41ff528583c1205f3c9e14d060a679143e888
SSDEEP 24576:09ED+ugR9q+dicaamo0sCBxbtbNQ0jJ+9Ms5T:0OvgSY9aFTtbNQ014Ms
TLSH
T15515F11AE79454FDF1BBC138C9529E06EA317C4E47A1A6DF23D44A921F232D05E3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

101152

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

GetFileSizeEx WriteProcessMemory GetConsoleScreenBufferInfo SetConsoleTitleA FindNextFileW GetCurrentProcess GetStdHandle SetConsoleMode TerminateProcess GetModuleFileNameW CreateMutexW FindClose WaitForSingleObject CreateFileW GetFileAttributesW GetCurrentThreadId GetModuleHandleA OpenProcess CreateToolhelp32Snapshot GetExitCodeThread GetConsoleMode GetLastError Process32NextW K32GetProcessMemoryInfo FileTimeToSystemTime Process32FirstW CloseHandle FillConsoleOutputAttribute GetProcAddress SetFilePointerEx VirtualAllocEx ReadProcessMemory FindFirstFileW WideCharToMultiByte GetConsoleWindow CreateRemoteThread SystemTimeToTzSpecificLocalTime QueryFullProcessImageNameW SetConsoleOutputCP FormatMessageA VirtualFreeEx SetConsoleCursorPosition IsWow64Process GetFileTime WriteConsoleW HeapSize GetProcessHeap SetStdHandle SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP GetACP IsValidCodePage FindFirstFileExW HeapReAlloc GetConsoleOutputCP FlushFileBuffers GetFileType ReadConsoleW PeekConsoleInputA ReadConsoleInputW FillConsoleOutputCharacterA GetModuleHandleW ReadFile QueryPerformanceCounter QueryPerformanceFrequency ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive SleepConditionVariableSRW Sleep WaitForSingleObjectEx InitializeCriticalSectionEx GetSystemTimeAsFileTime EnterCriticalSection LeaveCriticalSection DeleteCriticalSection EncodePointer DecodePointer MultiByteToWideChar LCMapStringEx WakeAllConditionVariable GetStringTypeW GetCPInfo RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent GetCurrentProcessId InitializeSListHead IsDebuggerPresent GetStartupInfoW RtlUnwindEx RtlPcToFileHeader RaiseException SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW CreateThread ExitThread FreeLibraryAndExitThread GetModuleHandleExW GetConsoleCP WriteFile ExitProcess GetCommandLineA GetCommandLineW HeapAlloc HeapFree FlsAlloc FlsGetValue FlsSetValue FlsFree VirtualProtect CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetNumberOfConsoleInputEvents RtlUnwind

user32

GetWindowThreadProcessId PostMessageW MapVirtualKeyW GetWindow SetActiveWindow SendMessageW ShowWindow IsWindow GetWindowLongW GetForegroundWindow EnumWindows SetFocus BringWindowToTop LoadIconW GetClassNameW SetForegroundWindow IsIconic SendInput AttachThreadInput

advapi32

GetTokenInformation OpenProcessToken

Name

.text

Size

233KB

Virtual Size

232KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

87KB

Virtual Size

87KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

12KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

27KB

Virtual Size

27KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

568KB

Virtual Size

572KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-30_d4e9d4833c82ba43667bd32a939f63a9_cobalt-strike_icedid_luca-stealer_njrat_stealc

kernel32

user32

advapi32

generic