2026-10-02_43858df451962bc85110894fe05669d4_cobalt-strike_icedid_luca-stealer_njrat_stealc

General

Target
2026-10-02_43858df451962bc85110894fe05669d4_cobalt-strike_icedid_luca-stealer_njrat_stealc
Size 464KB
Sample261003-q3engazdmd
SHA256 4e275b4f45a13edaf9c4469880315b2e891ccf825733b3df164749aab45f9e9f
MD5 43858df451962bc85110894fe05669d4
SHA1 e2a33f40ce9b32e6b27a0295ca8b5a2acfb63761
SHA512 d98a25fbadf8251c0be0d8bd6596d40fb688edd364e0f09da14d2d2236c60644a2b03858eb9ca26036d05c1f0cd2e54efd01cda90c1e672ae4c3f7326439eb45
SSDEEP 6144:adptB2v3m8y1ykB7HiunCE58Ft3d29B1d24zvTDN6Bi:a+3ABbIEyt3i1dDzvTJ
TLSH
T1A7A4E84BE6B651E4D4BAC0388662712BFCB1345A4374ABD7AB809B531772BF4E53E700
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-02_43858df451962bc85110894fe05669d4_cobalt-strike_icedid_luca-stealer_njrat_stealc

File Explorer

2026-10-02_43858df451962bc85110894fe05669d4_cobalt-strike_icedid_luca-stealer_njrat_stealc

.exe 464KB

2026-10-02_43858df451962bc85110894fe05669d4_cobalt-strike_icedid_luca-stealer_njrat_stealc

IMPHASH b32d579990706cf92573d7b9a067f3bc
SHA256 4e275b4f45a13edaf9c4469880315b2e891ccf825733b3df164749aab45f9e9f
MD5 43858df451962bc85110894fe05669d4
SHA1 e2a33f40ce9b32e6b27a0295ca8b5a2acfb63761
SHA512 d98a25fbadf8251c0be0d8bd6596d40fb688edd364e0f09da14d2d2236c60644a2b03858eb9ca26036d05c1f0cd2e54efd01cda90c1e672ae4c3f7326439eb45
SSDEEP 6144:adptB2v3m8y1ykB7HiunCE58Ft3d29B1d24zvTDN6Bi:a+3ABbIEyt3i1dDzvTJ
TLSH
T1A7A4E84BE6B651E4D4BAC0388662712BFCB1345A4374ABD7AB809B531772BF4E53E700
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

268732

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

GetCommConfig RemoveDirectoryTransactedW HeapCreate AddDllDirectory RtlCaptureContext EnumResourceTypesW SetConsoleWindowInfo CompareStringOrdinal OpenFileById OpenFile GetCommMask GetCommTimeouts GlobalDeleteAtom ClosePrivateNamespace ConvertThreadToFiberEx FormatMessageW CancelSynchronousIo ReleaseSRWLockExclusive ReclaimVirtualMemory CompareStringEx GetCurrentDirectoryW GetProcessPreferredUILanguages FindNextChangeNotification UnlockFile InitAtomTable SetProtectedPolicy DisableThreadProfiling CreateFiberEx GetCurrentConsoleFont GetLongPathNameW FreeEnvironmentStringsW GetLogicalDriveStringsW LCMapStringEx GetLastError CloseHandle HeapAlloc GetCurrentProcessId GetProcessHeap GetModuleHandleW GetThreadGroupAffinity SizeofResource GetVolumeInformationW CompareFileTime GetBinaryTypeW GetPhysicallyInstalledSystemMemory DeleteTimerQueue SetConsoleMode GetConsoleHistoryInfo VirtualUnlock GetUserDefaultUILanguage InitializeCriticalSectionAndSpinCount GetConsoleAliasExesW QueryThreadCycleTime IsSystemResumeAutomatic GetSystemDefaultLangID CancelWaitableTimer GetPrivateProfileStringW ResolveLocaleName Sleep MoveFileWithProgressW FillConsoleOutputCharacterW GlobalFindAtomW GetMemoryErrorHandlingCapabilities GetNamedPipeClientSessionId UnregisterWaitEx GetOverlappedResultEx GetThreadTimes GetCalendarInfoEx LocalUnlock GetFileTime EnumResourceTypesExW RtlUnwind SetWaitableTimer GetCurrentProcess RegisterWaitForSingleObject GetProfileIntW SetFileTime AddSecureMemoryCacheCallback WaitForMultipleObjects TryAcquireSRWLockShared FlsGetValue EnumResourceNamesW CreateBoundaryDescriptorW EnumCalendarInfoExW GetFileAttributesTransactedW GetVersionExW WaitForThreadpoolWorkCallbacks HeapWalk GetACP OpenProcess SwitchToFiber TzSpecificLocalTimeToSystemTime GetFileAttributesExW GetThreadUILanguage CloseThreadpoolTimer TerminateThread CreateHardLinkTransactedW GetSystemInfo Wow64SuspendThread SetVolumeMountPointW ReadDirectoryChangesW VirtualLock UnregisterApplicationRestart SetThreadStackGuarantee FindAtomW GetTempFileNameW ConvertThreadToFiber VirtualQuery OpenThread AreFileApisANSI GetStartupInfoW SetSystemTimeAdjustment ReadFile WriteProfileStringW QueryThreadpoolStackInformation GetOEMCP GetConsoleOutputCP GetStdHandle SetProcessShutdownParameters GetNumaProcessorNodeEx InitializeCriticalSectionEx UnregisterBadMemoryNotification DisconnectNamedPipe ApplicationRecoveryInProgress BuildCommDCBAndTimeoutsW PowerCreateRequest BuildCommDCBW ClearCommError UpdateResourceW CloseThreadpoolIo CreateFileMappingFromApp ExitProcess SetConsoleCP SetThreadExecutionState GetConsoleWindow DeleteTimerQueueTimer EnumSystemFirmwareTables lstrcmpW lstrlenW CreateFileW GetConsoleMode FlushFileBuffers HeapSize SetFilePointerEx QueryPerformanceCounter QueryPerformanceFrequency WideCharToMultiByte GetSystemTimeAsFileTime GetProcAddress EnterCriticalSection LeaveCriticalSection DeleteCriticalSection EncodePointer DecodePointer MultiByteToWideChar GetStringTypeW GetCPInfo IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent GetCurrentThreadId InitializeSListHead TerminateProcess RtlUnwindEx RtlPcToFileHeader RaiseException SetLastError TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW GetModuleHandleExW GetModuleFileNameW WriteFile HeapReAlloc HeapFree GetFileType FlsAlloc FlsSetValue FlsFree LCMapStringW FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetCommandLineA GetCommandLineW GetEnvironmentStringsW SetStdHandle WriteConsoleW

ntdll

RtlLookupFunctionEntry RtlVirtualUnwind

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-02_43858df451962bc85110894fe05669d4_cobalt-strike_icedid_luca-stealer_njrat_stealc

kernel32

ntdll

generic