2026-10-21_93fcab3b427df271b4ec4393e5bf4418_cobalt-strike_coinminer_icedid_luca-stealer_njrat_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-21_93fcab3b427df271b4ec4393e5bf4418_cobalt-strike_coinminer_icedid_luca-stealer_njrat_stealc
Size 718KB
Sample261022-vhdb5ady2s
SHA256 4c985c1170b653cdc581bcbdcc1b7fdf9dfb230786d5d6e5b1afa770b2eceec1
MD5 93fcab3b427df271b4ec4393e5bf4418
SHA1 7896c97efde069196af04c61efd2ef72d92ade5b
SHA512 0aecfed21b75f570d81cf79801f3d957ef5fc916aa8dc0b8e072407ed8e0aa30259df13ab4aa639e4dd7ac52527f0225cd70358de1ba881c2b23b6a761875de6
SSDEEP 12288:fESyMEeFSDOAWK7mYHCW5Orsb3RpqniT+jMz:sMEVOAL7mYiAe6+iT+c
TLSH
T186F48D65AB6004E5D4BBC17DCB431942F2F2B84683A1E9DF0FF04A991F177E44A7A722
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-21_93fcab3b427df271b4ec4393e5bf4418_cobalt-strike_coinminer_icedid_luca-stealer_njrat_stealc

File Explorer

2026-10-21_93fcab3b427df271b4ec4393e5bf4418_cobalt-strike_coinminer_icedid_luca-stealer_njrat_stealc

.exe 718KB

2026-10-21_93fcab3b427df271b4ec4393e5bf4418_cobalt-strike_coinminer_icedid_luca-stealer_njrat_stealc

IMPHASH 58502575bbf6838d669c4e6eab97012e
SHA256 4c985c1170b653cdc581bcbdcc1b7fdf9dfb230786d5d6e5b1afa770b2eceec1
MD5 93fcab3b427df271b4ec4393e5bf4418
SHA1 7896c97efde069196af04c61efd2ef72d92ade5b
SHA512 0aecfed21b75f570d81cf79801f3d957ef5fc916aa8dc0b8e072407ed8e0aa30259df13ab4aa639e4dd7ac52527f0225cd70358de1ba881c2b23b6a761875de6
SSDEEP 12288:fESyMEeFSDOAWK7mYHCW5Orsb3RpqniT+jMz:sMEVOAL7mYiAe6+iT+c
TLSH
T186F48D65AB6004E5D4BBC17DCB431942F2F2B84683A1E9DF0FF04A991F177E44A7A722
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

261364

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

ws2_32

connect freeaddrinfo getaddrinfo WSAGetLastError WSACleanup WSAStartup socket shutdown send select recv getsockopt ioctlsocket closesocket

kernel32

GetProcessHeap SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW CloseHandle GetLastError ReleaseMutex WaitForSingleObject CreateMutexW OpenMutexW Sleep GetProcessTimes GetCurrentProcess GetCurrentProcessId GetExitCodeProcess GetCurrentThread CreateProcessW GetThreadTimes OpenProcess GetLocalTime GetTickCount64 GetSystemDirectoryW SetStdHandle VirtualFree VirtualQuery CreateFileMappingW MapViewOfFile UnmapViewOfFile IsProcessInJob CreateJobObjectW AssignProcessToJobObject SetInformationJobObject QueryInformationJobObject FreeLibrary GetModuleFileNameW GetModuleHandleW GetProcAddress LoadLibraryExW LocalFree GetComputerNameA GetActiveProcessorCount AllocConsole FreeConsole AttachConsole SetConsoleCtrlHandler GetConsoleWindow CreateToolhelp32Snapshot Process32FirstW Process32NextW VirtualProtect GetLargePageMinimum FindClose CreateFileW SetEndOfFile WriteConsoleW VirtualAlloc RtlPcToFileHeader RaiseException QueryPerformanceCounter QueryPerformanceFrequency WaitForSingleObjectEx GetCurrentThreadId GetExitCodeThread GetNativeSystemInfo ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive SleepConditionVariableSRW WakeAllConditionVariable WideCharToMultiByte EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection RtlUnwind GetSystemTimeAsFileTime EncodePointer DecodePointer MultiByteToWideChar LCMapStringEx GetStringTypeW GetCPInfo RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent TerminateProcess InitializeSListHead RtlUnwindEx SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree CreateThread ExitThread FreeLibraryAndExitThread GetModuleHandleExW ExitProcess GetStdHandle WriteFile GetCommandLineA GetCommandLineW HeapAlloc HeapFree FlsAlloc FlsGetValue FlsSetValue FlsFree CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetFileType FlushFileBuffers GetConsoleOutputCP GetConsoleMode ReadFile GetFileSizeEx SetFilePointerEx ReadConsoleW HeapReAlloc HeapSize HeapQueryInformation

advapi32

AdjustTokenPrivileges OpenProcessToken ConvertStringSecurityDescriptorToSecurityDescriptorW LookupPrivilegeValueA

Name

.text

Size

414KB

Virtual Size

414KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

265KB

Virtual Size

265KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

12KB

Virtual Size

19KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

18KB

Virtual Size

18KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RANDOMX

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-21_93fcab3b427df271b4ec4393e5bf4418_cobalt-strike_coinminer_icedid_luca-stealer_njrat_stealc

ws2_32

kernel32

advapi32

generic