2026-10-22_48f7c68324b056b19d6737463ed4b556_cobalt-strike_icedid_luca-stealer_njrat_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-22_48f7c68324b056b19d6737463ed4b556_cobalt-strike_icedid_luca-stealer_njrat_stealc
Size 723KB
Sample261024-rlqj3svvbv
SHA256 60e276e5846f310f0ecfaff708b43b0ebd06b9ddfbb02e824a35333ce9e82519
MD5 48f7c68324b056b19d6737463ed4b556
SHA1 12fc274eb98d5a63dc9061aa13407a98422a56c5
SHA512 6d4c25427264691d4b694ebd069210f6ccdd11da0be546b9218c39759ca361d8c4fda88c0d11118bedb38ed3fbe8afa7646b98b43713a401c0c5337de8c2cdf5
SSDEEP 12288:L5H8niDKC029Mi7CDnfQEQsaof0Qbs2PnBb9QxbDsbpmb4fbPbTFbib7A8b1bBbJ:L5cnorh2DnoEw
TLSH
T174F47C26AB5401F9C0B7C138CE978523FB72B85647719BDB23A446661F2B6E84F3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-22_48f7c68324b056b19d6737463ed4b556_cobalt-strike_icedid_luca-stealer_njrat_stealc

File Explorer

2026-10-22_48f7c68324b056b19d6737463ed4b556_cobalt-strike_icedid_luca-stealer_njrat_stealc

.exe 723KB

2026-10-22_48f7c68324b056b19d6737463ed4b556_cobalt-strike_icedid_luca-stealer_njrat_stealc

IMPHASH be77b8e837febfc093b9b73ac82f7dbc
SHA256 60e276e5846f310f0ecfaff708b43b0ebd06b9ddfbb02e824a35333ce9e82519
MD5 48f7c68324b056b19d6737463ed4b556
SHA1 12fc274eb98d5a63dc9061aa13407a98422a56c5
SHA512 6d4c25427264691d4b694ebd069210f6ccdd11da0be546b9218c39759ca361d8c4fda88c0d11118bedb38ed3fbe8afa7646b98b43713a401c0c5337de8c2cdf5
SSDEEP 12288:L5H8niDKC029Mi7CDnfQEQsaof0Qbs2PnBb9QxbDsbpmb4fbPbTFbib7A8b1bBbJ:L5cnorh2DnoEw
TLSH
T174F47C26AB5401F9C0B7C138CE978523FB72B85647719BDB23A446661F2B6E84F3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

295652

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\bxzxh\Desktop\MakarRat\MakarRat\x64\Release\MakarRat.pdb

kernel32

CreateFile2 UnmapViewOfFile MultiByteToWideChar FormatMessageW GetLastError OutputDebugStringW WaitForSingleObjectEx OpenSemaphoreW CloseHandle HeapAlloc CreateFileMappingFromApp GetProcAddress CreateMutexExW GetComputerNameW GetCurrentProcessId GetProcessHeap GetModuleHandleW WideCharToMultiByte CreateProcessA MapViewOfFileFromApp DebugBreak IsDebuggerPresent SetEndOfFile WriteConsoleW HeapSize ReleaseMutex FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP GetACP IsValidCodePage GetTimeZoneInformation ReadConsoleW CreateProcessW GetExitCodeProcess SetStdHandle HeapReAlloc EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW VirtualProtect FlsFree FlsSetValue GetCurrentThreadId WaitForSingleObject PeekNamedPipe CreatePipe GetModuleHandleExW ReleaseSemaphore HeapFree SetLastError CreateSemaphoreExW GetFileSizeEx GetModuleFileNameA SetEnvironmentVariableW ReadFile FlsGetValue FlsAlloc GetConsoleMode GetConsoleOutputCP FlushFileBuffers SetFilePointerEx WriteFile GetStdHandle GetModuleFileNameW FileTimeToSystemTime SystemTimeToTzSpecificLocalTime GetFileType GetDriveTypeW FreeLibraryAndExitThread ExitThread CreateThread ExitProcess LoadLibraryExW FreeLibrary TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount RtlUnwindEx InitializeSListHead GetStartupInfoW IsProcessorFeaturePresent TerminateProcess GetCurrentProcess SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext GetStringTypeW GetCPInfo CompareStringEx DecodePointer EncodePointer DeleteCriticalSection LeaveCriticalSection EnterCriticalSection WakeConditionVariable WakeAllConditionVariable SleepConditionVariableSRW RtlPcToFileHeader RaiseException LocalFree FormatMessageA GetLocaleInfoEx GetCurrentDirectoryW CreateDirectoryW CreateFileW FindClose FindFirstFileW FindFirstFileExW FindNextFileW GetFileAttributesExW GetFileInformationByHandle GetFullPathNameW AreFileApisANSI CopyFileW GetFileInformationByHandleEx QueryPerformanceCounter QueryPerformanceFrequency ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive Sleep GetExitCodeThread LCMapStringEx InitializeCriticalSectionEx GetSystemTimeAsFileTime RtlUnwind

user32

DispatchMessageW SendInput SetCursorPos ReleaseCapture PostQuitMessage DrawIconEx GetClientRect SetWindowsHookExW mouse_event LoadCursorW TranslateMessage UnhookWindowsHookEx BlockInput SetThreadDpiAwarenessContext GetMessageW RegisterClassW GetCursorInfo MessageBoxA ShowWindow GetWindowPlacement GetSystemMetrics CallNextHookEx SendMessageW GetIconInfo CreateWindowExW MessageBoxW GetDC DefWindowProcW

gdi32

CreateCompatibleBitmap SelectObject CreateCompatibleDC StretchBlt SetStretchBltMode DeleteObject BitBlt

advapi32

RegSetValueExA RegOpenKeyExA RegDeleteValueA RegCloseKey

shell32

ShellExecuteExA ShellExecuteA SHGetFolderPathA

ole32

CreateStreamOnHGlobal CoTaskMemFree

webview2loader

CreateCoreWebView2EnvironmentWithOptions

gdiplus

GdipDisposeImage GdiplusStartup GdiplusShutdown GdipGetImageEncoders GdipCloneImage GdipAlloc GdipCreateBitmapFromHBITMAP GdipSaveImageToStream GdipFree GdipGetImageEncodersSize

ws2_32

WSAPoll ntohs connect WSACleanup bind closesocket shutdown listen WSAAccept WSASocketW getaddrinfo WSAStartup getpeername getsockname send WSAGetLastError setsockopt getnameinfo ioctlsocket freeaddrinfo recv getsockopt socket

wininet

InternetCloseHandle HttpSendRequestA InternetConnectA HttpOpenRequestA InternetOpenA

Name

.text

Size

476KB

Virtual Size

476KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

158KB

Virtual Size

157KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

55KB

Virtual Size

61KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

22KB

Virtual Size

22KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-22_48f7c68324b056b19d6737463ed4b556_cobalt-strike_icedid_luca-stealer_njrat_stealc

kernel32

user32

gdi32

advapi32

shell32

ole32

webview2loader

gdiplus

ws2_32

wininet

generic