2026-10-20_60f36a3ecbcd2a62078a197b5e606515_cobalt-strike_icedid_luca-stealer_njrat_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-20_60f36a3ecbcd2a62078a197b5e606515_cobalt-strike_icedid_luca-stealer_njrat_stealc
Size 430KB
Sample261020-hhlbhsaf73
SHA256 1f82934ec46e4ac83a047e66266dba9e023134577253a6bdafd9f725345b8fd5
MD5 60f36a3ecbcd2a62078a197b5e606515
SHA1 08bbceb0a609da8f9d3f055a474f22312b46eeea
SHA512 f2d495d0bb503e27da45edd0adcce860b7cb02b99cdfa4e020492df2eddcc99999dcd7d5d48263f43942ee44411af847818b3fc354569a033e04b0413ccc2513
SSDEEP 6144:4+pXDkC6KkZNPtT246Y81Ppv3gpm/vDMGxkphORc2/dv41FBE:4VqIDi1PR6evQxhORcsdviFB
TLSH
T1F7945C26E79405F8E0B7C278CE574942E735784A0370EADF07D49AA25F275E09E3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-20_60f36a3ecbcd2a62078a197b5e606515_cobalt-strike_icedid_luca-stealer_njrat_stealc

File Explorer

2026-10-20_60f36a3ecbcd2a62078a197b5e606515_cobalt-strike_icedid_luca-stealer_njrat_stealc

.exe 430KB

2026-10-20_60f36a3ecbcd2a62078a197b5e606515_cobalt-strike_icedid_luca-stealer_njrat_stealc

IMPHASH e047cd6499b46dbde1461048513eb7a1
SHA256 1f82934ec46e4ac83a047e66266dba9e023134577253a6bdafd9f725345b8fd5
MD5 60f36a3ecbcd2a62078a197b5e606515
SHA1 08bbceb0a609da8f9d3f055a474f22312b46eeea
SHA512 f2d495d0bb503e27da45edd0adcce860b7cb02b99cdfa4e020492df2eddcc99999dcd7d5d48263f43942ee44411af847818b3fc354569a033e04b0413ccc2513
SSDEEP 6144:4+pXDkC6KkZNPtT246Y81Ppv3gpm/vDMGxkphORc2/dv41FBE:4VqIDi1PR6evQxhORcsdviFB
TLSH
T1F7945C26E79405F8E0B7C278CE574942E735784A0370EADF07D49AA25F275E09E3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

160164

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

libcrypto-3-x64

BIO_new BIO_ctrl OPENSSL_init_crypto BIO_s_mem X509V3_set_ctx X509V3_EXT_conf_nid RAND_bytes PEM_write_bio_PrivateKey PEM_read_bio_PrivateKey PEM_write_bio_X509 PEM_read_bio_X509 X509_add_ext X509_NAME_add_entry_by_txt X509_check_private_key X509_set_pubkey X509_getm_notAfter X509_get0_notAfter X509_getm_notBefore X509_get_subject_name X509_set_issuer_name X509_get_serialNumber X509_set_version X509_free X509_new X509_EXTENSION_free X509_gmtime_adj X509_digest X509_sign X509_verify EVP_PKEY_Q_keygen EVP_PKEY_free EVP_sha256 EVP_sha1 BN_to_ASN1_INTEGER ASN1_TIME_to_tm ASN1_TIME_diff ERR_error_string_n ERR_clear_error ERR_get_error BN_free BN_bin2bn BIO_new_mem_buf BIO_free_all

user32

SendMessageW DispatchMessageW DefWindowProcW SetProcessDPIAware IsDialogMessageW LoadImageW LoadCursorW EnumChildWindows InflateRect FillRect SetCursor AdjustWindowRect GetClientRect GetWindowTextLengthW GetWindowTextW SetWindowTextW InvalidateRect EndPaint GetMessageW BeginPaint ReleaseDC GetDC UpdateWindow DrawTextW GetSystemMetrics SetFocus GetDlgCtrlID GetDlgItem ShowWindow CreateWindowExW RegisterClassExW PostQuitMessage TranslateMessage

gdi32

SetBkColor CreatePen SetTextColor SetBkMode CreateFontW SelectObject Rectangle GetStockObject GetDeviceCaps DeleteObject CreateSolidBrush

comdlg32

ChooseFontW GetOpenFileNameW

shell32

ShellExecuteW SHGetPathFromIDListW SHBrowseForFolderW CommandLineToArgvW

comctl32

InitCommonControlsEx

ole32

CoTaskMemFree CoInitializeEx

iphlpapi

GetAdaptersAddresses

kernel32

ReadConsoleW SetFilePointerEx GetFileSizeEx ReadFile GetConsoleMode GetConsoleOutputCP FlushFileBuffers CloseHandle EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW VirtualProtect FlsFree FlsSetValue FlsGetValue FlsAlloc HeapAlloc HeapFree GetCommandLineA GetModuleHandleExW ExitProcess LoadLibraryExW GetProcAddress FreeLibrary TlsFree HeapReAlloc TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount SetLastError RtlUnwindEx RaiseException RtlPcToFileHeader TerminateProcess GetCurrentProcess IsProcessorFeaturePresent GetStartupInfoW SetUnhandledExceptionFilter UnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext InitializeSListHead GetSystemTimeAsFileTime GetCurrentThreadId GetCurrentProcessId QueryPerformanceCounter GetCPInfo FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle GetProcessHeap CreateFileW GetStringTypeW LCMapStringEx DecodePointer EncodePointer HeapSize SetEndOfFile DeleteCriticalSection InitializeCriticalSectionEx TlsSetValue GetFileType GetStdHandle GetCommandLineW RtlUnwind WriteFile GetModuleFileNameW LocalFree MultiByteToWideChar WideCharToMultiByte AttachConsole WriteConsoleW CreateDirectoryW GetLastError GetComputerNameExW GetComputerNameW CopyFileW GetEnvironmentVariableW GetFileAttributesW GetModuleHandleW MulDiv EnterCriticalSection LeaveCriticalSection

Name

.text

Size

297KB

Virtual Size

296KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

96KB

Virtual Size

96KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

13KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

13KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-20_60f36a3ecbcd2a62078a197b5e606515_cobalt-strike_icedid_luca-stealer_njrat_stealc

libcrypto-3-x64

user32

gdi32

comdlg32

shell32

comctl32

ole32

iphlpapi

kernel32

generic