2026-09-30_3403d14c7705e71ed658ba987dbc202b_cobalt-strike_icedid_luca-stealer_njrat_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-30_3403d14c7705e71ed658ba987dbc202b_cobalt-strike_icedid_luca-stealer_njrat_stealc
Size 305KB
Sample261001-txecasyapc
SHA256 c8a79d366a2025c82924fc44cab8e7ae25165890372823c3a86381d2c13833d7
MD5 3403d14c7705e71ed658ba987dbc202b
SHA1 83d237fc7030f0c128b1d940cc4c5c6932dc3dca
SHA512 50039722d18cc85ca64ecb1af81da12e6d1dcb4a4b00ce8d749a5bb6d6b2495e7a707676c58c81264a4e150d1636e4892b6226aaf022697428abe370dda88e9f
SSDEEP 3072:XhRpx7gzAGG2jSNa4n8EGMg1mcpnSH2rBRDelFx2h/7wZ0h2KHXWUHL7YcUM/BXi:Xbz7Na6qSH2TefaxfIQkkl
TLSH
T1BF647B1AE7A510FDD5B7827CC9464906EB727C1607A0E7CF13D04AA62F276E09E3E712
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-30_3403d14c7705e71ed658ba987dbc202b_cobalt-strike_icedid_luca-stealer_njrat_stealc

File Explorer

2026-09-30_3403d14c7705e71ed658ba987dbc202b_cobalt-strike_icedid_luca-stealer_njrat_stealc

.exe 305KB

2026-09-30_3403d14c7705e71ed658ba987dbc202b_cobalt-strike_icedid_luca-stealer_njrat_stealc

IMPHASH fb879923a8e6efed3dc3e54b581c2938
SHA256 c8a79d366a2025c82924fc44cab8e7ae25165890372823c3a86381d2c13833d7
MD5 3403d14c7705e71ed658ba987dbc202b
SHA1 83d237fc7030f0c128b1d940cc4c5c6932dc3dca
SHA512 50039722d18cc85ca64ecb1af81da12e6d1dcb4a4b00ce8d749a5bb6d6b2495e7a707676c58c81264a4e150d1636e4892b6226aaf022697428abe370dda88e9f
SSDEEP 3072:XhRpx7gzAGG2jSNa4n8EGMg1mcpnSH2rBRDelFx2h/7wZ0h2KHXWUHL7YcUM/BXi:Xbz7Na6qSH2TefaxfIQkkl
TLSH
T1BF647B1AE7A510FDD5B7827CC9464906EB727C1607A0E7CF13D04AA62F276E09E3E712
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

80200

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

ws2_32

connect getaddrinfo gethostname inet_ntop freeaddrinfo WSACleanup WSAStartup send recv WSAGetLastError closesocket inet_addr socket htons

advapi32

LookupAccountSidA OpenProcessToken GetTokenInformation GetUserNameA

secur32

QueryContextAttributesA InitializeSecurityContextA EncryptMessage DecryptMessage FreeCredentialsHandle FreeContextBuffer DeleteSecurityContext AcquireCredentialsHandleA

kernel32

SetStdHandle GetProcessHeap CreateFileW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP GetACP HeapSize WriteConsoleW SetEndOfFile FreeEnvironmentStringsW GetModuleHandleW IsValidCodePage FindFirstFileExW HeapReAlloc ReadConsoleW MoveFileExW GetConsoleMode GetConsoleOutputCP FlushFileBuffers Sleep SetConsoleCP SetConsoleOutputCP ReadFile GetModuleFileNameA GetStdHandle OpenProcess CreateToolhelp32Snapshot MultiByteToWideChar ProcessIdToSessionId GetFileAttributesA Process32NextW Process32FirstW CloseHandle GetNativeSystemInfo WideCharToMultiByte IsWow64Process GetLogicalDrives FindFirstFileW FindNextFileW FindClose FileTimeToSystemTime DeleteFileA SetFileAttributesA RemoveDirectoryA SystemTimeToTzSpecificLocalTime GetFileType SetFilePointerEx GetFileSizeEx QueryPerformanceCounter QueryPerformanceFrequency ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive GetCurrentThreadId InitializeCriticalSectionEx GetSystemTimeAsFileTime RtlUnwind GetProcAddress EnterCriticalSection LeaveCriticalSection DeleteCriticalSection EncodePointer DecodePointer LCMapStringEx GetStringTypeW GetCPInfo RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent GetCurrentProcessId InitializeSListHead GetCurrentProcess TerminateProcess RtlPcToFileHeader RaiseException RtlUnwindEx GetLastError SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW ExitProcess GetModuleHandleExW GetModuleFileNameW WriteFile HeapFree HeapAlloc FlsAlloc FlsGetValue FlsSetValue FlsFree VirtualProtect LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW CreateDirectoryW

user32

SetProcessDPIAware

Name

.text

Size

208KB

Virtual Size

208KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

76KB

Virtual Size

75KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

11KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.fig

Size

512B

Virtual Size

72B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-30_3403d14c7705e71ed658ba987dbc202b_cobalt-strike_icedid_luca-stealer_njrat_stealc

ws2_32

advapi32

secur32

kernel32

user32

generic