2026-10-23_6180fb640d0845c9a892a3a1df9505e4_cobalt-strike_icedid_luca-stealer_njrat_stealc

General

Target
2026-10-23_6180fb640d0845c9a892a3a1df9505e4_cobalt-strike_icedid_luca-stealer_njrat_stealc
Size 785KB
Sample261023-np8chsdv8p
SHA256 5c27985acc14b54f9b13c44575aca72f49627359dcb8539e62523703a53d426c
MD5 6180fb640d0845c9a892a3a1df9505e4
SHA1 97c9f40a9b117ad2cc9760de83a3dd95973f79db
SHA512 fd5ea83a2d74b850cf159fc3417376acf4b79c034c5df171f5c568b440e0587d20194d998efee9bee7fb68efe477ef30816045cbd42bdd6f21082b5c631e8178
SSDEEP 12288:CZZkibYTZSd/k/LaCjUrXduQ2w5rlUohT3higkfp:B+YVSpgD8tuQ2w5ruohT3higkfp
TLSH
T115056B65EE86B1D6E57566328993030B8B73B9559110DB5702C8093EFF03B782DBB3CA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-23_6180fb640d0845c9a892a3a1df9505e4_cobalt-strike_icedid_luca-stealer_njrat_stealc

File Explorer

2026-10-23_6180fb640d0845c9a892a3a1df9505e4_cobalt-strike_icedid_luca-stealer_njrat_stealc

.exe 785KB

2026-10-23_6180fb640d0845c9a892a3a1df9505e4_cobalt-strike_icedid_luca-stealer_njrat_stealc

IMPHASH 6f2e51b04c9deb4a13af4ea3695f3811
SHA256 5c27985acc14b54f9b13c44575aca72f49627359dcb8539e62523703a53d426c
MD5 6180fb640d0845c9a892a3a1df9505e4
SHA1 97c9f40a9b117ad2cc9760de83a3dd95973f79db
SHA512 fd5ea83a2d74b850cf159fc3417376acf4b79c034c5df171f5c568b440e0587d20194d998efee9bee7fb68efe477ef30816045cbd42bdd6f21082b5c631e8178
SSDEEP 12288:CZZkibYTZSd/k/LaCjUrXduQ2w5rlUohT3higkfp:B+YVSpgD8tuQ2w5ruohT3higkfp
TLSH
T115056B65EE86B1D6E57566328993030B8B73B9559110DB5702C8093EFF03B782DBB3CA
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

113644

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

GetLastError GetTickCount64 VirtualAlloc VirtualFree VirtualQuery FreeLibrary LoadLibraryA VirtualProtect GetCurrentProcess EnterCriticalSection LeaveCriticalSection DeleteCriticalSection GetConsoleMode FlsAlloc FlsGetValue FlsSetValue FlsFree GetCurrentThreadId InitializeCriticalSectionEx EncodePointer DecodePointer MultiByteToWideChar WideCharToMultiByte LCMapStringEx GetStringTypeW GetCPInfo RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW GetModuleHandleW SetEndOfFile RtlPcToFileHeader RaiseException RtlUnwindEx SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree GetProcAddress LoadLibraryExW GetStdHandle GetFileType GetModuleFileNameW GetModuleHandleExW WriteConsoleW SetStdHandle WriteFile ExitProcess GetCommandLineA GetCommandLineW HeapFree HeapAlloc CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW CloseHandle FlushFileBuffers GetConsoleOutputCP ReadFile GetFileSizeEx SetFilePointerEx ReadConsoleW OutputDebugStringW HeapReAlloc FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetProcessHeap CreateFileW HeapSize RtlUnwind

Name

.text

Size

262KB

Virtual Size

262KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

496KB

Virtual Size

496KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

9KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

11KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-23_6180fb640d0845c9a892a3a1df9505e4_cobalt-strike_icedid_luca-stealer_njrat_stealc

kernel32

generic