2026-10-22_9da76dc897f6cd70ad27121b4dcc0c3b_cobalt-strike_icedid_luca-stealer_njrat_poet-rat_stealc

General

Target
2026-10-22_9da76dc897f6cd70ad27121b4dcc0c3b_cobalt-strike_icedid_luca-stealer_njrat_poet-rat_stealc
Size 564KB
Sample261024-dfry3aft6s
SHA256 269bca22e9c2e6cb014c9d55ed7f4a2a9e34ebca6cfee920dd1d72a435a37f2e
MD5 9da76dc897f6cd70ad27121b4dcc0c3b
SHA1 28c7891aa0b5f0ce670b053c24c70f7c8ce9fe0f
SHA512 6c33b94609be01fe81390c3f7d11a945e3a826f43d36618767a0163ace1ca599faee022ed068b9b764ef315927741f39d237997df3bb58ede9403b6997e9c723
SSDEEP 6144:6ogtRgCKSfll5/jKl6glCwtyaSRdRAct6t+7idSmVkO/hUy5YgDL7Yo2CpejM9sr:dehflj/QLHnybAWGPk6ZvYo5+
TLSH
T14CC46C66A6A812F9E177C078CA474903F77278494370AAEF13D046A71F27AE49F3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-22_9da76dc897f6cd70ad27121b4dcc0c3b_cobalt-strike_icedid_luca-stealer_njrat_poet-rat_stealc

File Explorer

2026-10-22_9da76dc897f6cd70ad27121b4dcc0c3b_cobalt-strike_icedid_luca-stealer_njrat_poet-rat_stealc

.exe 564KB

2026-10-22_9da76dc897f6cd70ad27121b4dcc0c3b_cobalt-strike_icedid_luca-stealer_njrat_poet-rat_stealc

IMPHASH a0d073cb26ae14622878a8fdf1894e0f
SHA256 269bca22e9c2e6cb014c9d55ed7f4a2a9e34ebca6cfee920dd1d72a435a37f2e
MD5 9da76dc897f6cd70ad27121b4dcc0c3b
SHA1 28c7891aa0b5f0ce670b053c24c70f7c8ce9fe0f
SHA512 6c33b94609be01fe81390c3f7d11a945e3a826f43d36618767a0163ace1ca599faee022ed068b9b764ef315927741f39d237997df3bb58ede9403b6997e9c723
SSDEEP 6144:6ogtRgCKSfll5/jKl6glCwtyaSRdRAct6t+7idSmVkO/hUy5YgDL7Yo2CpejM9sr:dehflj/QLHnybAWGPk6ZvYo5+
TLSH
T14CC46C66A6A812F9E177C078CA474903F77278494370AAEF13D046A71F27AE49F3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

261276

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

LocalFree FormatMessageA GetLocaleInfoEx CreateFileW FindClose FindFirstFileW FindFirstFileExW FindNextFileW GetFileAttributesExW AreFileApisANSI CloseHandle GetLastError GetModuleHandleW GetProcAddress GetFileInformationByHandleEx MultiByteToWideChar WideCharToMultiByte EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer CompareStringEx GetCPInfo LCMapStringEx GetStringTypeW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW RtlPcToFileHeader RaiseException RtlUnwindEx SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW GetStdHandle WriteFile GetModuleFileNameW ExitProcess GetModuleHandleExW GetCommandLineA GetCommandLineW HeapAlloc HeapFree HeapReAlloc FlsAlloc FlsGetValue FlsSetValue FlsFree VirtualProtect CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetFileType FlushFileBuffers GetConsoleOutputCP GetConsoleMode ReadFile GetFileSizeEx SetFilePointerEx ReadConsoleW IsValidCodePage GetACP GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle GetProcessHeap HeapSize WriteConsoleW SetEndOfFile RtlUnwind

Name

.text

Size

401KB

Virtual Size

401KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

124KB

Virtual Size

124KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

12KB

Virtual Size

18KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

20KB

Virtual Size

20KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-22_9da76dc897f6cd70ad27121b4dcc0c3b_cobalt-strike_icedid_luca-stealer_njrat_poet-rat_stealc

kernel32

generic