2026-10-26_cd43647bb2cee1edba7c7eed9e75fa9c_cobalt-strike_icedid_luca-stealer_njrat_stealc

General

Target
2026-10-26_cd43647bb2cee1edba7c7eed9e75fa9c_cobalt-strike_icedid_luca-stealer_njrat_stealc
Size 223KB
Sample261027-hamjlsbz5m
SHA256 5af33d46fc48367aff3202380318ded8f71f4d1e4efd7df5be9ecdf4ad0b9b4a
MD5 cd43647bb2cee1edba7c7eed9e75fa9c
SHA1 f7fab77c121712e3c586594b29467b4dc281d033
SHA512 cc694d6d499e16339515ff9f6b23cfed1d8cd560886ecff2f680825908f4060e2aab4442059ee9c56d12885027a333661898897c739e2e0e438bd274d818fd0e
SSDEEP 6144:EdhAJ7ri9N7y+mazFUUyyIDpsWOsFJlCv:FrKW+mazFUzp1OsFL0
TLSH
T178248D16F3951CFAD567C539CA414902EF72BC8603A0DADF47A049A29F236E09F3E712
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-26_cd43647bb2cee1edba7c7eed9e75fa9c_cobalt-strike_icedid_luca-stealer_njrat_stealc

File Explorer

2026-10-26_cd43647bb2cee1edba7c7eed9e75fa9c_cobalt-strike_icedid_luca-stealer_njrat_stealc

.exe 223KB

2026-10-26_cd43647bb2cee1edba7c7eed9e75fa9c_cobalt-strike_icedid_luca-stealer_njrat_stealc

IMPHASH 430c0a79ef41512cfbcdb5589784ff02
SHA256 5af33d46fc48367aff3202380318ded8f71f4d1e4efd7df5be9ecdf4ad0b9b4a
MD5 cd43647bb2cee1edba7c7eed9e75fa9c
SHA1 f7fab77c121712e3c586594b29467b4dc281d033
SHA512 cc694d6d499e16339515ff9f6b23cfed1d8cd560886ecff2f680825908f4060e2aab4442059ee9c56d12885027a333661898897c739e2e0e438bd274d818fd0e
SSDEEP 6144:EdhAJ7ri9N7y+mazFUUyyIDpsWOsFJlCv:FrKW+mazFUzp1OsFL0
TLSH
T178248D16F3951CFAD567C539CA414902EF72BC8603A0DADF47A049A29F236E09F3E712
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

57672

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\JPSE5\Desktop\Retrac\out\x64\Release\loader.pdb

ntdll

RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext RtlUnwindEx RtlPcToFileHeader NtWriteVirtualMemory NtQueryInformationThread NtProtectVirtualMemory NtReadVirtualMemory NtAllocateVirtualMemory NtOpenProcess NtQueryInformationProcess NtOpenThread NtFreeVirtualMemory

kernel32

GetConsoleMode GetConsoleOutputCP FlushFileBuffers GetProcessHeap WriteConsoleW GetModuleFileNameW Sleep WideCharToMultiByte GetModuleHandleExW GetModuleHandleA GetTickCount64 LoadLibraryA GetProcAddress FlushInstructionCache ReadFile SetFilePointerEx CreateFileW CloseHandle SetLastError GetCurrentProcess GetLastError Thread32Next Thread32First CreateToolhelp32Snapshot Process32NextW Process32FirstW GetThreadTimes WaitForSingleObject SuspendThread ResumeThread GetThreadContext SetThreadContext GetStringTypeW HeapSize HeapReAlloc GetFileSizeEx SetStdHandle SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW MultiByteToWideChar UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW GetModuleHandleW RaiseException GetCPInfo EncodePointer EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW GetStdHandle WriteFile ExitProcess GetCommandLineA GetCommandLineW HeapAlloc HeapFree FlsAlloc FlsGetValue FlsSetValue FlsFree InitializeCriticalSectionEx VirtualProtect CompareStringW LCMapStringW GetFileType FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP

advapi32

AdjustTokenPrivileges OpenProcessToken LookupPrivilegeValueW

Name

.text

Size

144KB

Virtual Size

143KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

64KB

Virtual Size

63KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

8KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

488B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-26_cd43647bb2cee1edba7c7eed9e75fa9c_cobalt-strike_icedid_luca-stealer_njrat_stealc

ntdll

kernel32

advapi32

generic