2026-10-18_5b77c68cb9fc434c959eca89b77396a4_cobalt-strike_icedid_luca-stealer_njrat_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-18_5b77c68cb9fc434c959eca89b77396a4_cobalt-strike_icedid_luca-stealer_njrat_stealc
Size 383KB
Sample261018-res2max18k
SHA256 eea4d29e6eef61449c411f952d266933fca576ccee15c839fc061fe2393e78d9
MD5 5b77c68cb9fc434c959eca89b77396a4
SHA1 329e32836a1508e2fc6d139242f574c02495754b
SHA512 2555270c503be88f4458fe62836ca837e725fbfa38b3561c80d088293f9d405f9a7ddb6b738fa511a8e704eef309727ee9396ed4cfdfd66859e55346c20f110c
SSDEEP 6144:fyjZfZfB3C/LFiLpknbPEcLXvn3nrDAm5bIZtn6DjL4:m8RiL8/b3P5bOn6
TLSH
T112847D26FB9440F9E1B7D179CD628902DB727C8D07A1A6DF13D84A661F236D08E3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-18_5b77c68cb9fc434c959eca89b77396a4_cobalt-strike_icedid_luca-stealer_njrat_stealc

File Explorer

2026-10-18_5b77c68cb9fc434c959eca89b77396a4_cobalt-strike_icedid_luca-stealer_njrat_stealc

.exe 383KB

2026-10-18_5b77c68cb9fc434c959eca89b77396a4_cobalt-strike_icedid_luca-stealer_njrat_stealc

IMPHASH 349da38ac78ab0cedb3a535a526adeb7
SHA256 eea4d29e6eef61449c411f952d266933fca576ccee15c839fc061fe2393e78d9
MD5 5b77c68cb9fc434c959eca89b77396a4
SHA1 329e32836a1508e2fc6d139242f574c02495754b
SHA512 2555270c503be88f4458fe62836ca837e725fbfa38b3561c80d088293f9d405f9a7ddb6b738fa511a8e704eef309727ee9396ed4cfdfd66859e55346c20f110c
SSDEEP 6144:fyjZfZfB3C/LFiLpknbPEcLXvn3nrDAm5bIZtn6DjL4:m8RiL8/b3P5bOn6
TLSH
T112847D26FB9440F9E1B7D179CD628902DB727C8D07A1A6DF13D84A661F236D08E3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

119492

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

comctl32

ord410 ord412 ord413 ImageList_Destroy ImageList_Create InitCommonControlsEx

shell32

CommandLineToArgvW ShellExecuteW ShellExecuteExW SHGetFileInfoW SHOpenFolderAndSelectItems SHParseDisplayName

ole32

CoTaskMemFree CoInitializeEx CoUninitialize

comdlg32

GetSaveFileNameW

user32

ScreenToClient TrackMouseEvent GetMessageW TranslateMessage DispatchMessageW SendMessageW PostMessageW DefWindowProcW PostQuitMessage RegisterClassW CreateWindowExW ShowWindow MoveWindow SetWindowPos IsZoomed GetDlgItem OpenClipboard CloseClipboard SetClipboardData EmptyClipboard SetFocus GetKeyState SetTimer KillTimer EnableWindow CreatePopupMenu DestroyMenu ChangeWindowMessageFilterEx SetWindowLongPtrW GetWindowLongPtrW MsgWaitForMultipleObjectsEx DestroyWindow PeekMessageW SetProcessDpiAwarenessContext GetDpiForSystem GetDpiForWindow GetMonitorInfoW MonitorFromWindow IsDialogMessageW LoadIconW LoadCursorW FindWindowW PtInRect InflateRect AppendMenuW FillRect GetCursorPos GetWindowRect GetClientRect GetWindowTextLengthW GetWindowTextW SetWindowTextW InvalidateRect EndPaint BeginPaint SetForegroundWindow DrawTextW TrackPopupMenu

gdi32

SetBkColor SelectObject DeleteObject SetBkMode CreateSolidBrush CreateFontW CreateCompatibleDC SetTextColor DeleteDC CreateCompatibleBitmap BitBlt

gdiplus

GdiplusShutdown GdipCreatePath GdipDeletePath GdipClosePathFigure GdipAddPathArc GdipAddPathString GdipTransformPath GdipGetPathWorldBounds GdipCreateMatrix GdipDeleteMatrix GdiplusStartup GdipScaleMatrix GdipDeleteBrush GdipCreateLineBrushI GdipCreatePen1 GdipDeletePen GdipCreateFromHDC GdipDeleteGraphics GdipSetSmoothingMode GdipDrawBezier GdipTranslateMatrix GdipStringFormatGetGenericTypographic GdipDeleteFontFamily GdipFillPath GdipCreateFontFamilyFromName GdipCreateSolidFill

dwmapi

DwmSetWindowAttribute

uxtheme

SetWindowTheme

advapi32

RegGetValueW

kernel32

FindNextFileW FindFirstFileExW FindClose HeapReAlloc ReadConsoleW SetFilePointerEx GetFileSizeEx ReadFile GetConsoleMode GetConsoleOutputCP FlushFileBuffers EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW VirtualProtect FlsFree FlsSetValue FlsGetValue IsValidCodePage GetFileType HeapFree HeapAlloc WriteFile GetStdHandle ExitProcess GetModuleHandleExW FreeLibraryAndExitThread ExitThread CreateThread TlsFree SetEndOfFile TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount SetLastError RtlUnwindEx RaiseException RtlPcToFileHeader InitializeSListHead GetCurrentProcessId TerminateProcess GetCurrentProcess IsProcessorFeaturePresent GetStartupInfoW GetACP GetOEMCP GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW GetProcessHeap SetStdHandle CreateFileW HeapSize FlsAlloc SetUnhandledExceptionFilter UnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext GetCPInfo GetStringTypeW GetSystemTimeAsFileTime LCMapStringEx MultiByteToWideChar DecodePointer EncodePointer QueryPerformanceCounter WriteConsoleW TlsSetValue GetCommandLineW FileTimeToLocalFileTime CloseHandle GetLastError CreateMutexW GetModuleHandleW GlobalAlloc GlobalUnlock GlobalLock GlobalFree LocalFree MulDiv FileTimeToSystemTime WideCharToMultiByte GetEnvironmentVariableW GetFileAttributesW Sleep CreateProcessW OpenProcess GetTickCount64 FreeLibrary GetModuleFileNameW GetProcAddress LoadLibraryExW QueryFullProcessImageNameW CreateToolhelp32Snapshot Process32FirstW Process32NextW DeleteCriticalSection WaitForSingleObjectEx GetCurrentThreadId GetExitCodeThread ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive WakeConditionVariable WakeAllConditionVariable SleepConditionVariableSRW EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx RtlUnwind

Name

.text

Size

261KB

Virtual Size

260KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

97KB

Virtual Size

97KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

6KB

Virtual Size

14KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

13KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1024B

Virtual Size

832B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-18_5b77c68cb9fc434c959eca89b77396a4_cobalt-strike_icedid_luca-stealer_njrat_stealc

comctl32

shell32

ole32

comdlg32

user32

gdi32

gdiplus

dwmapi

uxtheme

advapi32

kernel32

generic