2026-10-28_9f04f09484fbeea1370b420426c93970_cobalt-strike_icedid_luca-stealer_njrat_stealc

General

Target
2026-10-28_9f04f09484fbeea1370b420426c93970_cobalt-strike_icedid_luca-stealer_njrat_stealc
Size 318KB
Sample261029-2cv4batx4n
SHA256 f3c4594099ed2652f8bf343592a848bc091a9b03304ece49a3f1d41f7455c2a4
MD5 9f04f09484fbeea1370b420426c93970
SHA1 1e1ca3156f911f5d399acba4bba29c530736d4ac
SHA512 5e75a3ce58f743f4c41297f1d3b8490c26452eaa4fb685fe35ffc570534a3f78820cac8530bc9317d262836c27a6b932c5d3267b4c7cd972e6921e6f74ece183
SSDEEP 6144:X847fON5pxFgIZK41Uwk+TwZutsxewVOABwVzh:X8oIfRVdTPtscw61
TLSH
T112648D15F7A510F9E56B817CCD924942EB72BC4647A0E6CF23A04A962F277E08E3F711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-28_9f04f09484fbeea1370b420426c93970_cobalt-strike_icedid_luca-stealer_njrat_stealc

File Explorer

2026-10-28_9f04f09484fbeea1370b420426c93970_cobalt-strike_icedid_luca-stealer_njrat_stealc

.exe 318KB

2026-10-28_9f04f09484fbeea1370b420426c93970_cobalt-strike_icedid_luca-stealer_njrat_stealc

IMPHASH fb647ef6a5ee8bcead31f8dc496ef138
SHA256 f3c4594099ed2652f8bf343592a848bc091a9b03304ece49a3f1d41f7455c2a4
MD5 9f04f09484fbeea1370b420426c93970
SHA1 1e1ca3156f911f5d399acba4bba29c530736d4ac
SHA512 5e75a3ce58f743f4c41297f1d3b8490c26452eaa4fb685fe35ffc570534a3f78820cac8530bc9317d262836c27a6b932c5d3267b4c7cd972e6921e6f74ece183
SSDEEP 6144:X847fON5pxFgIZK41Uwk+TwZutsxewVOABwVzh:X8oIfRVdTPtscw61
TLSH
T112648D15F7A510F9E56B817CCD924942EB72BC4647A0E6CF23A04A962F277E08E3F711
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

67244

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

Sleep CreateThread CreateEventA WideCharToMultiByte WriteConsoleW WaitForSingleObject SetEvent GetLastError GetTickCount64 CloseHandle QueryPerformanceCounter QueryPerformanceFrequency GetCurrentThreadId EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection GetSystemTimeAsFileTime GetModuleHandleW GetProcAddress EncodePointer DecodePointer MultiByteToWideChar LCMapStringEx GetStringTypeW GetCPInfo RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent GetCurrentProcessId InitializeSListHead IsDebuggerPresent GetStartupInfoW RtlPcToFileHeader RaiseException RtlUnwindEx SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW GetStdHandle WriteFile GetModuleFileNameW ExitProcess GetModuleHandleExW GetCommandLineA GetCommandLineW HeapFree HeapAlloc GetFileType FlsAlloc FlsGetValue FlsSetValue FlsFree VirtualProtect GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetTimeZoneInformation FlushFileBuffers GetConsoleOutputCP GetConsoleMode ReadFile GetFileSizeEx SetFilePointerEx ReadConsoleW HeapReAlloc FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle GetProcessHeap HeapSize CreateFileW RtlUnwind

advapi32

RegCreateKeyExW RegCloseKey GetUserNameW RegSetValueExW

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-28_9f04f09484fbeea1370b420426c93970_cobalt-strike_icedid_luca-stealer_njrat_stealc

kernel32

advapi32

generic