2026-09-30_36c086b8f845d05ac4c33e5359ffa069_cobalt-strike_icedid_luca-stealer_njrat_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-30_36c086b8f845d05ac4c33e5359ffa069_cobalt-strike_icedid_luca-stealer_njrat_stealc
Size 852KB
Sample260930-pkwzcsty8p
SHA256 972f41e35940458c6ef490f0a7170ae1795c7d9e9c30e86cc26226fbadb3675f
MD5 36c086b8f845d05ac4c33e5359ffa069
SHA1 5899ba408ce4127bcc9a265c7c927790ba5582ea
SHA512 f25018ec89211cae7b3c4e216284bd28f777b108aaa3587dfc9db8e394c5464a0d95fcab74d5fb8de498941673f9faad42e6ef9a7d3155eaeb0fc722ae22cf30
SSDEEP 12288:dDjM0U1Ya9gEWn+C5aa8GQ1otyLuZFsG8boXU:dDw0U1Ya9gEWn+CsataosuZ2d
TLSH
T107059F95ABE801F9F1B7D574C9724D02EA727C410B65CACF079066AA1E37BD08F3A712
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-30_36c086b8f845d05ac4c33e5359ffa069_cobalt-strike_icedid_luca-stealer_njrat_stealc

File Explorer

2026-09-30_36c086b8f845d05ac4c33e5359ffa069_cobalt-strike_icedid_luca-stealer_njrat_stealc

.exe 852KB

2026-09-30_36c086b8f845d05ac4c33e5359ffa069_cobalt-strike_icedid_luca-stealer_njrat_stealc

IMPHASH 28e5f0a3ac3af07e9d663b38b0082338
SHA256 972f41e35940458c6ef490f0a7170ae1795c7d9e9c30e86cc26226fbadb3675f
MD5 36c086b8f845d05ac4c33e5359ffa069
SHA1 5899ba408ce4127bcc9a265c7c927790ba5582ea
SHA512 f25018ec89211cae7b3c4e216284bd28f777b108aaa3587dfc9db8e394c5464a0d95fcab74d5fb8de498941673f9faad42e6ef9a7d3155eaeb0fc722ae22cf30
SSDEEP 12288:dDjM0U1Ya9gEWn+C5aa8GQ1otyLuZFsG8boXU:dDw0U1Ya9gEWn+CsataosuZ2d
TLSH
T107059F95ABE801F9F1B7D574C9724D02EA727C410B65CACF079066AA1E37BD08F3A712
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

761856

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

mpclient

MpFreeMemory MpUtilsExportFunctions MpAllocMemory MpManagerVersionQuery MpHandleClose MpConveyUserChoiceForDlpNotificationEx MpGetDlpEvents MpManagerOpen MpConfigInitialize MpConfigClose MpConfigOpen MpConfigUninitialize MpConfigGetValue MpConfigGetValueAlloc MpClientUtilExportFunctions

comctl32

InitCommonControlsEx ord410 ord413

gdi32

SetTextColor SetBkColor

uxtheme

DrawThemeBackground OpenThemeData GetThemeMargins GetThemePartSize

ole32

IIDFromString

ntdll

RtlUnwindEx RtlLookupFunctionEntry RtlCaptureContext RtlVirtualUnwind RtlPcToFileHeader

kernel32

ReleaseSRWLockExclusive OutputDebugStringW AcquireSRWLockExclusive CreateThreadpoolWait SetThreadpoolWait HeapAlloc GetProcessHeap DebugBreak IsDebuggerPresent GetSystemTimeAsFileTime EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionAndSpinCount DeleteCriticalSection SetEnvironmentVariableW ExpandEnvironmentStringsW FindFirstFileExW GetFileSizeEx ReadFile SetFilePointerEx WriteFile GetModuleFileNameA FormatMessageA MultiByteToWideChar WideCharToMultiByte HeapSetInformation GetSystemDirectoryW FormatMessageW GetModuleFileNameW LocalFree InitOnceComplete GetFileAttributesW FindClose FindNextFileW GetLocaleInfoEx CreateFileW DeviceIoControl GetLocaleInfoW GetCurrentProcess LoadLibraryExW GetProcAddress MulDiv FreeLibrary GetModuleHandleW CloseHandle Process32FirstW Process32NextW GetLastError CreateToolhelp32Snapshot GetCurrentThreadId SetLastError SetErrorMode WriteConsoleW WaitForThreadpoolWaitCallbacks Sleep GetModuleHandleExW CloseThreadpoolWait CreateEventExW HeapFree InitOnceBeginInitialize InitializeCriticalSectionEx EncodePointer DecodePointer GetStringTypeW GetCPInfo UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent WakeAllConditionVariable SleepConditionVariableSRW GetStartupInfoW QueryPerformanceCounter GetCurrentProcessId InitializeSListHead RaiseException SetEndOfFile ReadConsoleW HeapSize GetConsoleMode GetConsoleOutputCP FlushFileBuffers SetStdHandle FreeEnvironmentStringsW GetEnvironmentStringsW HeapReAlloc GetFileType EnumSystemLocalesW GetUserDefaultLCID IsValidLocale LCMapStringW CompareStringW VirtualProtect FlsFree FlsSetValue FlsGetValue FlsAlloc GetCommandLineW GetCommandLineA GetStdHandle ExitProcess GetOEMCP GetACP IsValidCodePage GetProductInfo TlsFree TlsSetValue TlsGetValue TlsAlloc TerminateProcess

advapi32

GetTraceLoggerHandle RegEnumValueW EventSetInformation RegNotifyChangeKeyValue RegCreateKeyExW RegOpenKeyExW EventUnregister EventRegister RegCloseKey RegQueryValueExW EventWriteTransfer TraceMessage GetTraceEnableFlags GetTraceEnableLevel RegisterTraceGuidsW UnregisterTraceGuids

user32

GetParent GetWindowThreadProcessId DestroyWindow GetDpiForWindow SetWindowLongPtrW CreateWindowExW SendMessageW EndDialog SetWindowTextW GetWindowLongPtrW LoadStringW RedrawWindow ClientToScreen AttachThreadInput GetSysColor GetForegroundWindow LoadIconW LoadCursorW SetCursor GetDlgItem GetSysColorBrush GetWindowTextW DialogBoxParamW SetForegroundWindow EnableWindow

shell32

ShellExecuteW

Name

.text

Size

324KB

Virtual Size

322KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

140KB

Virtual Size

137KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

8KB

Virtual Size

14KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

20KB

Virtual Size

17KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

4KB

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

128KB

Virtual Size

125KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

60KB

Virtual Size

107KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rcdf17

Size

108KB

Virtual Size

108KB

Characteristics

IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-30_36c086b8f845d05ac4c33e5359ffa069_cobalt-strike_icedid_luca-stealer_njrat_stealc

mpclient

comctl32

gdi32

uxtheme

ole32

ntdll

kernel32

advapi32

user32

shell32

generic