2026-10-22_4b7a2f59ea4df0b604fb7bd563a9174b_cobalt-strike_icedid_luca-stealer_njrat_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-22_4b7a2f59ea4df0b604fb7bd563a9174b_cobalt-strike_icedid_luca-stealer_njrat_stealc
Size 558KB
Sample261024-rb89favtgw
SHA256 76cf975b0d77f49e98817974cd1f80a2d69ca4bde9afa9da9818970c7ed3372e
MD5 4b7a2f59ea4df0b604fb7bd563a9174b
SHA1 d5e4a5c22de686489b12406e5b66392569579017
SHA512 793316ede1f67684393055e6e76ba2bddd01f2e1dbe40dcfd31667c6c587d428f6ae06d5fd6f99bba6a85923e6a3eb9cf2a99e32d2cebfdc3c9fd58e6c79e7a8
SSDEEP 6144:KMAFOxz8aGpFqOEDyu5qeo+VAqOGcr+vx13htNU5ciKOqN32jZo+NzCucxiltMoX:1zcQX/POGcr+37NbiMotNz0itMz
TLSH
T13EC46D16E7A100F9E167C178CAA75602EB32BC451760EBDF03D499651F63BE09E3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-22_4b7a2f59ea4df0b604fb7bd563a9174b_cobalt-strike_icedid_luca-stealer_njrat_stealc

File Explorer

2026-10-22_4b7a2f59ea4df0b604fb7bd563a9174b_cobalt-strike_icedid_luca-stealer_njrat_stealc

.exe 558KB

2026-10-22_4b7a2f59ea4df0b604fb7bd563a9174b_cobalt-strike_icedid_luca-stealer_njrat_stealc

IMPHASH ae246b141c63000b72c82680466b32b2
SHA256 76cf975b0d77f49e98817974cd1f80a2d69ca4bde9afa9da9818970c7ed3372e
MD5 4b7a2f59ea4df0b604fb7bd563a9174b
SHA1 d5e4a5c22de686489b12406e5b66392569579017
SHA512 793316ede1f67684393055e6e76ba2bddd01f2e1dbe40dcfd31667c6c587d428f6ae06d5fd6f99bba6a85923e6a3eb9cf2a99e32d2cebfdc3c9fd58e6c79e7a8
SSDEEP 6144:KMAFOxz8aGpFqOEDyu5qeo+VAqOGcr+vx13htNU5ciKOqN32jZo+NzCucxiltMoX:1zcQX/POGcr+37NbiMotNz0itMz
TLSH
T13EC46D16E7A100F9E167C178CAA75602EB32BC451760EBDF03D499651F63BE09E3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

146536

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

d2d1

ord1

dwrite

DWriteCreateFactory

comctl32

InitCommonControlsEx

winhttp

WinHttpQueryDataAvailable WinHttpConnect WinHttpSetTimeouts WinHttpSendRequest WinHttpCloseHandle WinHttpSetOption WinHttpReceiveResponse WinHttpOpen WinHttpAddRequestHeaders WinHttpReadData WinHttpOpenRequest

shell32

Shell_NotifyIconA SHGetFolderPathA

user32

TranslateMessage MessageBoxA DispatchMessageW IsWindowVisible CreatePopupMenu TrackPopupMenu SetTimer DestroyMenu LoadIconA AppendMenuA UpdateLayeredWindow SetForegroundWindow GetWindowRect LoadCursorA GetDC SetWindowPos ShowWindow GetWindowTextA SetWindowTextA DefWindowProcA CreateWindowExA SendMessageA SetCapture GetWindowLongPtrA PostQuitMessage GetDesktopWindow SetWindowLongPtrA RegisterClassExA UpdateWindow ReleaseCapture InvalidateRect ReleaseDC GetCursorPos BeginPaint EndPaint GetAsyncKeyState PostMessageW GetMessageW wsprintfA

gdi32

BitBlt CreateFontA SelectObject CreateDIBSection CreateCompatibleDC DeleteDC SetTextColor SetBkColor DeleteObject CreateSolidBrush

ole32

CoInitialize CoUninitialize

advapi32

GetUserNameA

winmm

timeBeginPeriod

kernel32

GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW FindClose HeapReAlloc ReadConsoleW ReadFile EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW VirtualProtect GetCommandLineA SetEndOfFile FlsSetValue FlsGetValue FlsAlloc GetFileAttributesExW CreateProcessW GetExitCodeProcess WaitForSingleObject HeapFree GetConsoleMode GetConsoleOutputCP FlushFileBuffers HeapAlloc GetFileType SetFilePointerEx GetFileSizeEx GetStdHandle GetModuleFileNameW ExitProcess GetModuleHandleExW FreeLibraryAndExitThread GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetProcessHeap SetStdHandle CreateFileW HeapSize WriteConsoleW ExitThread CreateThread LoadLibraryExW FlsFree FreeLibrary TlsFree CreateMutexA ReleaseMutex GetLastError CloseHandle SetUnhandledExceptionFilter SizeofResource WriteFile GetModuleHandleA CopyFileA GetFileAttributesA CreateFileA SetDllDirectoryA LoadLibraryA LockResource LoadResource FindResourceW Beep GetProcAddress CreateDirectoryA GetVolumeInformationA GetComputerNameA TlsSetValue WideCharToMultiByte QueryPerformanceCounter QueryPerformanceFrequency ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive GetCurrentThreadId SleepConditionVariableSRW Sleep WaitForSingleObjectEx GetExitCodeThread RtlUnwind EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer MultiByteToWideChar LCMapStringEx GetSystemTimeAsFileTime GetModuleHandleW WakeAllConditionVariable GetStringTypeW GetCPInfo RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW GetCurrentProcessId InitializeSListHead RtlUnwindEx RtlPcToFileHeader RaiseException SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue

Name

.text

Size

297KB

Virtual Size

296KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

96KB

Virtual Size

96KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

7KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

13KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

139KB

Virtual Size

139KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-22_4b7a2f59ea4df0b604fb7bd563a9174b_cobalt-strike_icedid_luca-stealer_njrat_stealc

d2d1

dwrite

comctl32

winhttp

shell32

user32

gdi32

ole32

advapi32

winmm

kernel32

generic