2026-10-26_5238cc80ede64278045581546bf08b34_cobalt-strike_icedid_luca-stealer_njrat_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-26_5238cc80ede64278045581546bf08b34_cobalt-strike_icedid_luca-stealer_njrat_stealc
Size 551KB
Sample261027-v2thfstt9j
SHA256 ea1fe386d62420f945e4e7f877d58e68c7a3a15560ddd155b0874e8774df9c80
MD5 5238cc80ede64278045581546bf08b34
SHA1 6daf249029161a2b0446452edd7871647b9b42f0
SHA512 3f0d4503e091cfa4f7fabd7837917180b4d26eab988bd3ce0284cebbc8eb251af0cfcfd0e6a037ad78206279e0c9bdbb5745a2d76d82b1da09856a47835e2a1e
SSDEEP 6144:AAeU0cmAB/robZSGsPAseOIgfgzv2gNbp7MgPItzVGBVPAftzwXoEQ2:DeYr8gogg98VEPAfEpQ2
TLSH
T175C47D6AA2A843F9F1A7D178C5464503FBB1B85A136096CF03F04AA62F276E15F7F311
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

2026-10-26_5238cc80ede64278045581546bf08b34_cobalt-strike_icedid_luca-stealer_njrat_stealc

.exe 551KB

2026-10-26_5238cc80ede64278045581546bf08b34_cobalt-strike_icedid_luca-stealer_njrat_stealc

IMPHASH 3156d9a3c8d3606b9f807d1355aaa8ef
SHA256 ea1fe386d62420f945e4e7f877d58e68c7a3a15560ddd155b0874e8774df9c80
MD5 5238cc80ede64278045581546bf08b34
SHA1 6daf249029161a2b0446452edd7871647b9b42f0
SHA512 3f0d4503e091cfa4f7fabd7837917180b4d26eab988bd3ce0284cebbc8eb251af0cfcfd0e6a037ad78206279e0c9bdbb5745a2d76d82b1da09856a47835e2a1e
SSDEEP 6144:AAeU0cmAB/robZSGsPAseOIgfgzv2gNbp7MgPItzVGBVPAftzwXoEQ2:DeYr8gogg98VEPAfEpQ2
TLSH
T175C47D6AA2A843F9F1A7D178C5464503FBB1B85A136096CF03F04AA62F276E15F7F311
MD5 SHA1 SHA512 SSDEEP TLSH

Digest

12:ae:42:72:e8:1f:96:10:83:19:0c:d6:f7:65:86:8e:d6:87:61:7d:ba:54:37:6a:cb:29:e6:20:80:32:03:e6

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Arthur Lepp,O=Arthur Lepp,ST=Nordrhein-Westfalen,C=DE

Chains

Sep 16, 2026

CN=Arthur Lepp,O=Arthur Lepp,ST=Nordrhein-Westfalen,C=DE

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

CN=Arthur Lepp,O=Arthur Lepp,ST=Nordrhein-Westfalen,C=DE

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Serial Number

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 25, 2021 - Dec 31, 2028

Subject

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Serial Number

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Mar 21, 2036

Subject

CN=Arthur Lepp,O=Arthur Lepp,ST=Nordrhein-Westfalen,C=DE

Serial Number

18:7f:10:c6:84:cd:51:42:b4:fe:74:8a:bd:e4:d3:1d

Issuer

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Oct 9, 2025 - Oct 9, 2028

Subject

CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

Serial Number

36:c2:b0:bd:7c:1b:3a:e7:a3:b3:dd:36:cb:c9:75:68

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Jan 18, 2038

Subject

CN=Sectigo Public Time Stamping CA R41,O=Sectigo Limited,C=GB

Serial Number

90:ac:08:72:20:fd:c5:a7:c4:6b:5c:c7:0d:f7:3d:06

Issuer

CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 25, 2026 - Mar 24, 2041

Subject

CN=Sectigo Public Time Stamping Signer R37,O=Sectigo Limited,ST=Greater London,C=GB

Serial Number

e7:4e:f2:55:b0:50:4f:fa:db:a6:df:f7:fc:8b:a3:15

Issuer

CN=Sectigo Public Time Stamping CA R41,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 25, 2026 - Jun 24, 2037

Minor OS version

Major OS version

Entry point

225796

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\dev\UniteFx\x64\Release\SoundpadService.pdb

kernel32

CreateEventW GetLastError ResetEvent WaitForSingleObject SetEvent UnmapViewOfFile Sleep WriteConsoleW SetEndOfFile HeapSize SetStdHandle CreateEventExW FindNextFileW GetCurrentProcess CreateMutexW InitializeCriticalSectionEx FindClose CreateFileW GetFileAttributesW ReleaseMutex OpenFileMappingW OpenProcess CreateToolhelp32Snapshot FormatMessageW GetFileAttributesExW Process32NextW DeleteFileW Process32FirstW CloseHandle GetProcAddress LocalFree MoveFileExW GetModuleHandleW QueryFullProcessImageNameW CreateFileMappingW MapViewOfFile CreateDirectoryW GetCurrentThreadId GetLocalTime GetCurrentProcessId HeapFree ExpandEnvironmentStringsW HeapAlloc GetProcessHeap WaitForSingleObjectEx GetExitCodeThread MultiByteToWideChar GetStringTypeW WideCharToMultiByte QueryPerformanceCounter QueryPerformanceFrequency ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW EnterCriticalSection LeaveCriticalSection DeleteCriticalSection EncodePointer DecodePointer LCMapStringEx GetSystemTimeAsFileTime GetLocaleInfoEx CompareStringEx GetCPInfo RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW InitializeSListHead RtlUnwindEx RtlPcToFileHeader RaiseException SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW CreateThread ExitThread FreeLibraryAndExitThread GetModuleHandleExW ExitProcess GetModuleFileNameW GetStdHandle WriteFile FlsAlloc FlsGetValue FlsSetValue FlsFree VirtualProtect GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetFileType ReadFile GetConsoleMode ReadConsoleW GetConsoleOutputCP GetFileSizeEx SetFilePointerEx FlushFileBuffers HeapReAlloc GetTimeZoneInformation FindFirstFileExW IsValidCodePage GetACP GetOEMCP GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW RtlUnwind

user32

GetShellWindow GetDesktopWindow GetWindowThreadProcessId MapVirtualKeyW GetMessageW GetForegroundWindow SendMessageW GetMonitorInfoW GetRawInputData GetAsyncKeyState RegisterRawInputDevices UnhookWindowsHookEx SetWindowsHookExW PostMessageW TranslateMessage MonitorFromWindow GetWindowInfo RegisterClassW CallNextHookEx DispatchMessageW PostQuitMessage DefWindowProcW CreateWindowExW SendInput

gdi32

GetStockObject

advapi32

SetEntriesInAclW InitializeSecurityDescriptor FreeSid GetNamedSecurityInfoW AllocateAndInitializeSid RegCloseKey SetSecurityDescriptorDacl RegOpenKeyExW RegQueryValueExW SetNamedSecurityInfoW

shell32

SHCreateDirectoryExW SHGetSpecialFolderPathW

Name

.text

Size

401KB

Virtual Size

401KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

105KB

Virtual Size

105KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

8KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

18KB

Virtual Size

17KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-26_5238cc80ede64278045581546bf08b34_cobalt-strike_icedid_luca-stealer_njrat_stealc

kernel32

user32

gdi32

advapi32

shell32

generic