2026-10-22_03e92d7a038c0020d6faf6af0e4b2444_cobalt-strike_icedid_luca-stealer_njrat_stealc

General

Target
2026-10-22_03e92d7a038c0020d6faf6af0e4b2444_cobalt-strike_icedid_luca-stealer_njrat_stealc
Size 327KB
Sample261024-2y3qaacy51
SHA256 cd8101903a08036137e307edb6a476f28bd2ba9b89994d762e76a436cb059b8c
MD5 03e92d7a038c0020d6faf6af0e4b2444
SHA1 77c65f4881af57e9e0f2ae470dd25197d38d93e1
SHA512 21c2c84ec324a93885ec2564100b65ba5452e23ccd6a20e60c4464feb08891e765688311b0388fa016ca605e4c2294226f046c7c0b7a0a59c112ce80ed46d1e3
SSDEEP 6144:8JVpH384f87TOr6w/T8VaLYsIaq6KDdg2LdE:OVpszTKprxpIrDg
TLSH
T1F8649E19F3A510F9E577C538CD424546EA727C464BA0EADF23A00A973F276E09E3E712
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-22_03e92d7a038c0020d6faf6af0e4b2444_cobalt-strike_icedid_luca-stealer_njrat_stealc

File Explorer

2026-10-22_03e92d7a038c0020d6faf6af0e4b2444_cobalt-strike_icedid_luca-stealer_njrat_stealc

.exe 327KB

2026-10-22_03e92d7a038c0020d6faf6af0e4b2444_cobalt-strike_icedid_luca-stealer_njrat_stealc

IMPHASH e8a685ae6f3ab6f2278495c8255ed398
SHA256 cd8101903a08036137e307edb6a476f28bd2ba9b89994d762e76a436cb059b8c
MD5 03e92d7a038c0020d6faf6af0e4b2444
SHA1 77c65f4881af57e9e0f2ae470dd25197d38d93e1
SHA512 21c2c84ec324a93885ec2564100b65ba5452e23ccd6a20e60c4464feb08891e765688311b0388fa016ca605e4c2294226f046c7c0b7a0a59c112ce80ed46d1e3
SSDEEP 6144:8JVpH384f87TOr6w/T8VaLYsIaq6KDdg2LdE:OVpszTKprxpIrDg
TLSH
T1F8649E19F3A510F9E577C538CD424546EA727C464BA0EADF23A00A973F276E09E3E712
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

69740

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

GetEnvironmentVariableA CreateDirectoryA GetFileAttributesA SetUnhandledExceptionFilter GetLastError GetEnvironmentVariableW CreateFileW WriteFile CloseHandle Sleep GetCurrentProcess GetCurrentProcessId GetCurrentThreadId OpenThread SuspendThread ResumeThread GetThreadContext FlushInstructionCache GetWindowsDirectoryW VirtualAlloc VirtualProtect VirtualFree VirtualQuery CreateToolhelp32Snapshot Thread32First Thread32Next WideCharToMultiByte EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer MultiByteToWideChar LCMapStringEx GetStringTypeW GetCPInfo ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent GetModuleHandleW TerminateProcess QueryPerformanceCounter GetSystemTimeAsFileTime InitializeSListHead WriteConsoleW RtlPcToFileHeader RaiseException RtlUnwindEx SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary GetProcAddress LoadLibraryExW ReadFile ExitProcess GetModuleHandleExW GetModuleFileNameW GetStdHandle GetCommandLineA GetCommandLineW HeapAlloc HeapFree FlsAlloc FlsGetValue FlsSetValue FlsFree CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetFileType FlushFileBuffers GetConsoleOutputCP GetConsoleMode GetFileSizeEx SetFilePointerEx ReadConsoleW HeapReAlloc FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetProcessHeap SetStdHandle HeapSize SetEndOfFile RtlUnwind

Name

.text

Size

222KB

Virtual Size

221KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

84KB

Virtual Size

83KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

11KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-22_03e92d7a038c0020d6faf6af0e4b2444_cobalt-strike_icedid_luca-stealer_njrat_stealc

kernel32

generic