2026-10-26_ea0bf8365f84c970a21119f66dffbeeb_cobalt-strike_icedid_luca-stealer_njrat_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-26_ea0bf8365f84c970a21119f66dffbeeb_cobalt-strike_icedid_luca-stealer_njrat_stealc
Size 219KB
Sample261027-d2w5xa1tht
SHA256 bc0dd84c203233f93af9d727773796d226ebfab8e241f9fa556104f387f4848d
MD5 ea0bf8365f84c970a21119f66dffbeeb
SHA1 7eeea26726ff1faa259903ee5c320d3f583b0831
SHA512 6bdef8a51a2e397aee24dd8eff01092fb6867eb78fceb1381496fda70293131070e18cf6354caac429f8f77832b23284a33806609986b8b66df0c2f69473cd37
SSDEEP 3072:q64MsiLo8fUOIfwISX6IVD4BxZ/+KzXn5P6j/HQzXqQP1oWN:q64oLFfU5wpcBPbJSj/mN
TLSH
T1C0248E15F7950CFEE4A7C179C9424941EB737C4647A1EADF07A00AA29F236E09E3E712
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-26_ea0bf8365f84c970a21119f66dffbeeb_cobalt-strike_icedid_luca-stealer_njrat_stealc

File Explorer

2026-10-26_ea0bf8365f84c970a21119f66dffbeeb_cobalt-strike_icedid_luca-stealer_njrat_stealc

.exe 219KB

2026-10-26_ea0bf8365f84c970a21119f66dffbeeb_cobalt-strike_icedid_luca-stealer_njrat_stealc

IMPHASH 947d84ee8ef51923245099598dbc64ed
SHA256 bc0dd84c203233f93af9d727773796d226ebfab8e241f9fa556104f387f4848d
MD5 ea0bf8365f84c970a21119f66dffbeeb
SHA1 7eeea26726ff1faa259903ee5c320d3f583b0831
SHA512 6bdef8a51a2e397aee24dd8eff01092fb6867eb78fceb1381496fda70293131070e18cf6354caac429f8f77832b23284a33806609986b8b66df0c2f69473cd37
SSDEEP 3072:q64MsiLo8fUOIfwISX6IVD4BxZ/+KzXn5P6j/HQzXqQP1oWN:q64oLFfU5wpcBPbJSj/mN
TLSH
T1C0248E15F7950CFEE4A7C179C9424941EB737C4647A1EADF07A00AA29F236E09E3E712
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

48340

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

user32

TranslateMessage DispatchMessageA SendMessageA PostMessageA DefWindowProcA PostQuitMessage RegisterClassExA IsDialogMessageA LoadIconA LoadCursorA FillRect GetSysColorBrush GetSysColor MessageBoxA GetClientRect GetWindowTextLengthA GetWindowTextA SetWindowTextA InvalidateRect ReleaseDC GetDC UpdateWindow MoveWindow ShowWindow DestroyWindow CreateWindowExA GetMessageA

gdi32

SetBkMode SetBkColor GetDeviceCaps CreateSolidBrush CreateFontA SetTextColor

comdlg32

GetOpenFileNameA

wininet

InternetOpenUrlA InternetReadFile HttpQueryInfoA InternetCloseHandle InternetOpenA

kernel32

SetStdHandle GetProcessHeap LCMapStringW GetStringTypeW VirtualProtect InitializeCriticalSectionEx FlsFree FlsSetValue FlsGetValue FlsAlloc CreateFileW FlushFileBuffers ReadConsoleW HeapSize HeapReAlloc WriteConsoleW SetEndOfFile RtlLookupFunctionEntry FreeEnvironmentStringsW GetEnvironmentStringsW WideCharToMultiByte MultiByteToWideChar CreateFileA GetFileAttributesA GetFileSizeEx ReadFile WriteFile CloseHandle SetUnhandledExceptionFilter GetLastError PeekNamedPipe InitializeCriticalSection EnterCriticalSection LeaveCriticalSection WaitForSingleObject Sleep GetExitCodeProcess CreateThread CreateRemoteThread OpenThread SuspendThread ResumeThread GetThreadContext SetThreadContext OpenProcess GetLocalTime GetTickCount VirtualAllocEx ReadProcessMemory WriteProcessMemory GetModuleFileNameA GetModuleHandleA GetProcAddress LoadLibraryA MulDiv CreateToolhelp32Snapshot Process32First Process32Next Thread32First Thread32Next Module32First Module32Next RtlCaptureContext RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent GetModuleHandleW GetCurrentProcess TerminateProcess QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead GetCommandLineW RtlPcToFileHeader RaiseException RtlUnwindEx SetLastError EncodePointer DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW ExitProcess GetModuleHandleExW GetModuleFileNameW GetStdHandle HeapFree GetConsoleOutputCP GetConsoleMode SetFilePointerEx HeapAlloc GetFileType FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA

Name

.text

Size

142KB

Virtual Size

142KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

63KB

Virtual Size

62KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

7KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-26_ea0bf8365f84c970a21119f66dffbeeb_cobalt-strike_icedid_luca-stealer_njrat_stealc

user32

gdi32

comdlg32

wininet

kernel32

generic