2026-09-30_0f75da2077fcbd560fe47f6f2d9740b9_cobalt-strike_icedid_luca-stealer_njrat_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-30_0f75da2077fcbd560fe47f6f2d9740b9_cobalt-strike_icedid_luca-stealer_njrat_stealc
Size 293KB
Sample261001-xe98sswanf
SHA256 c9c40991fc311816dec84b3a0bb0ea91c23437648a07e5d6ff83fe73ebd2b2f1
MD5 0f75da2077fcbd560fe47f6f2d9740b9
SHA1 59394dd62f29159e390f33e91714de7f6bd59878
SHA512 55894c0bba3863d507df485112216e6a0a23a9943a098ce8ae84d2b3cc295620784c12da1b2b99dfc6606d4b77011bbeba02fc8b9aa6eaacce29bacf619d1e23
SSDEEP 3072:xU643u3QagMLttw1wtq/dgqQ9PADnV5BOSQkNw+faTbCk6cOAbbp0JTMCu+piH90:Ku3Q2nqFgYnj9xs0AbbLRu
TLSH
T131547D5AA7A511FDD9B7C13DC9524906EB72BC0647A0E6CF03A00AA63F276E05E3F711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-30_0f75da2077fcbd560fe47f6f2d9740b9_cobalt-strike_icedid_luca-stealer_njrat_stealc

File Explorer

2026-09-30_0f75da2077fcbd560fe47f6f2d9740b9_cobalt-strike_icedid_luca-stealer_njrat_stealc

.exe 293KB

2026-09-30_0f75da2077fcbd560fe47f6f2d9740b9_cobalt-strike_icedid_luca-stealer_njrat_stealc

IMPHASH 259d67e724428f3ea4e12a9391f5e93b
SHA256 c9c40991fc311816dec84b3a0bb0ea91c23437648a07e5d6ff83fe73ebd2b2f1
MD5 0f75da2077fcbd560fe47f6f2d9740b9
SHA1 59394dd62f29159e390f33e91714de7f6bd59878
SHA512 55894c0bba3863d507df485112216e6a0a23a9943a098ce8ae84d2b3cc295620784c12da1b2b99dfc6606d4b77011bbeba02fc8b9aa6eaacce29bacf619d1e23
SSDEEP 3072:xU643u3QagMLttw1wtq/dgqQ9PADnV5BOSQkNw+faTbCk6cOAbbp0JTMCu+piH90:Ku3Q2nqFgYnj9xs0AbbLRu
TLSH
T131547D5AA7A511FDD9B7C13DC9524906EB72BC0647A0E6CF03A00AA63F276E05E3F711
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

69324

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

ws2_32

connect getaddrinfo gethostname inet_ntop freeaddrinfo WSACleanup WSAStartup send recv WSAGetLastError closesocket inet_addr socket htons

secur32

QueryContextAttributesA InitializeSecurityContextA EncryptMessage DecryptMessage FreeCredentialsHandle FreeContextBuffer DeleteSecurityContext AcquireCredentialsHandleA

kernel32

WriteConsoleW HeapSize CreateFileW GetProcessHeap SetStdHandle FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP GetACP IsValidCodePage FindFirstFileExW HeapReAlloc ReadConsoleW MoveFileExW GetConsoleMode GetConsoleOutputCP FlushFileBuffers Sleep FreeConsole SetEndOfFile SetConsoleOutputCP ReadFile GetModuleFileNameA GetStdHandle MultiByteToWideChar GetFileAttributesA CloseHandle GetNativeSystemInfo WideCharToMultiByte GetLogicalDrives FindFirstFileW FindNextFileW FindClose FileTimeToSystemTime DeleteFileA SetFileAttributesA RemoveDirectoryA SystemTimeToTzSpecificLocalTime GetFileType SetFilePointerEx GetFileSizeEx SetConsoleCP EnterCriticalSection QueryPerformanceCounter QueryPerformanceFrequency ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive GetCurrentThreadId InitializeCriticalSectionEx GetSystemTimeAsFileTime GetModuleHandleW GetProcAddress RtlUnwind LeaveCriticalSection DeleteCriticalSection EncodePointer DecodePointer LCMapStringEx GetStringTypeW GetCPInfo GetCurrentProcessId InitializeSListHead RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent GetCurrentProcess TerminateProcess RtlPcToFileHeader RaiseException RtlUnwindEx GetLastError SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW WriteFile GetModuleFileNameW ExitProcess GetModuleHandleExW HeapFree HeapAlloc FlsAlloc FlsGetValue FlsSetValue FlsFree VirtualProtect LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW CreateDirectoryW

user32

SetProcessDPIAware

advapi32

GetUserNameA

Name

.text

Size

198KB

Virtual Size

198KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

75KB

Virtual Size

74KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

10KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-30_0f75da2077fcbd560fe47f6f2d9740b9_cobalt-strike_icedid_luca-stealer_njrat_stealc

ws2_32

secur32

kernel32

user32

advapi32

generic