2026-10-28_64090cde39de433c83812bed1b3c89ee_cobalt-strike_icedid_luca-stealer_njrat_stealc

General

Target
2026-10-28_64090cde39de433c83812bed1b3c89ee_cobalt-strike_icedid_luca-stealer_njrat_stealc
Size 463KB
Sample261030-drrsfaas7l
SHA256 1235a5f8edbc7ce350e40be6e8fc69bf0fd021ea6eb0fcbc10b6a4f80558d15a
MD5 64090cde39de433c83812bed1b3c89ee
SHA1 c3825e9bae1812fa9b2e210be0ac0b3d706173e8
SHA512 d38463ab24c13a162e816d846b8275e6a373bb2a6c99c2bea02ce7fcc753e3ab7b1afed9d68bad10dc8ec8b76d6a7a7a86f8449d40cea0e1aa66a4ddd908a8d7
SSDEEP 6144:AWnfyfHXKx941JNHZGEMXQ8juFEXNVGRzaDOgtSG+7NRtPV:eHXVHUq8uEXyzaD9AG+hP
TLSH
T12AA4F74BE6B651E4D0BAC0388662753BFDB1345A4374ABD79B808B531772BE4E93E700
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-28_64090cde39de433c83812bed1b3c89ee_cobalt-strike_icedid_luca-stealer_njrat_stealc

File Explorer

2026-10-28_64090cde39de433c83812bed1b3c89ee_cobalt-strike_icedid_luca-stealer_njrat_stealc

.exe 463KB

2026-10-28_64090cde39de433c83812bed1b3c89ee_cobalt-strike_icedid_luca-stealer_njrat_stealc

IMPHASH 48f475f35a8eefbe7477d1efc5eb1f0e
SHA256 1235a5f8edbc7ce350e40be6e8fc69bf0fd021ea6eb0fcbc10b6a4f80558d15a
MD5 64090cde39de433c83812bed1b3c89ee
SHA1 c3825e9bae1812fa9b2e210be0ac0b3d706173e8
SHA512 d38463ab24c13a162e816d846b8275e6a373bb2a6c99c2bea02ce7fcc753e3ab7b1afed9d68bad10dc8ec8b76d6a7a7a86f8449d40cea0e1aa66a4ddd908a8d7
SSDEEP 6144:AWnfyfHXKx941JNHZGEMXQ8juFEXNVGRzaDOgtSG+7NRtPV:eHXVHUq8uEXyzaD9AG+hP
TLSH
T12AA4F74BE6B651E4D0BAC0388662753BFDB1345A4374ABD79B808B531772BE4E93E700
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

266332

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

EnumLanguageGroupLocalesW GetThreadIdealProcessorEx GetSystemDefaultUILanguage Wow64SetThreadContext CreateConsoleScreenBuffer SetSystemTime FlsGetValue CreateHardLinkW GetLocaleInfoW GetUILanguageInfo GetVolumeNameForVolumeMountPointW VerifyScripts WaitForThreadpoolWaitCallbacks CreateHardLinkTransactedW PowerClearRequest SetCurrentDirectoryW VirtualAllocEx ExitProcess GetNumberOfConsoleInputEvents GetProcessGroupAffinity SetDllDirectoryW WriteConsoleOutputW InitializeSynchronizationBarrier SetProcessPriorityBoost SetSystemTimeAdjustment GetBinaryTypeW CreateDirectoryTransactedW HeapFree ExpandEnvironmentStringsW SetConsoleMode GetProfileIntW GetUserDefaultLocaleName GetNamedPipeClientComputerNameW UnregisterApplicationRecoveryCallback IsBadCodePtr SetProcessMitigationPolicy GetPrivateProfileStringW Sleep LCMapStringEx SetThreadpoolThreadMaximum GetCommState InterlockedPushListSListEx LoadLibraryW GetActiveProcessorCount HeapAlloc AddSIDToBoundaryDescriptor SetFirmwareEnvironmentVariableW MoveFileExW GetOverlappedResultEx SetThreadpoolStackInformation GetVolumePathNamesForVolumeNameW ConvertFiberToThread InterlockedPushEntrySList SetThreadContext FindNextStreamW InterlockedPopEntrySList GetStartupInfoW CreateNamedPipeW GetVersionExW BuildCommDCBAndTimeoutsW CloseHandle GetCurrentProcessId GetProcessHeap CreateMailslotW GlobalUnlock EnterSynchronizationBarrier BackupWrite SetConsoleCtrlHandler GetLogicalDrives GetThreadPriorityBoost QueryInformationJobObject CloseThreadpool GetFileSizeEx SearchPathW IsBadWritePtr CompareStringW CreateTapePartition lstrlenW EnumCalendarInfoW UnregisterWait OutputDebugStringA GetProcessIdOfThread GetModuleFileNameW GetGeoInfoW GetProductInfo SetSystemFileCacheSize PeekNamedPipe GetConsoleScreenBufferInfoEx SetSearchPathMode UnmapViewOfFile GetLastError EnumSystemLocalesEx CloseThreadpoolTimer EnumDateFormatsExEx OpenSemaphoreW GetNativeSystemInfo IsDBCSLeadByte ClearCommError CloseThreadpoolIo UnlockFile SetThreadPriorityBoost SetThreadStackGuarantee SetDefaultCommConfigW DeleteVolumeMountPointW OpenMutexW SetTapePosition GetExitCodeProcess EnumResourceTypesExW RtlUnwind SetWaitableTimer GetLongPathNameW GetCurrentProcess DeleteTimerQueue RegisterWaitForSingleObject SetFileTime AddSecureMemoryCacheCallback WaitForMultipleObjects TryAcquireSRWLockShared EnumResourceNamesW CreateBoundaryDescriptorW EnumCalendarInfoExW GetCommMask GetFileAttributesTransactedW WaitForThreadpoolWorkCallbacks HeapWalk GetACP OpenProcess SwitchToFiber GetLogicalDriveStringsW TzSpecificLocalTimeToSystemTime GetFileAttributesExW GetThreadUILanguage TerminateThread GetSystemInfo Wow64SuspendThread SetVolumeMountPointW ReadDirectoryChangesW VirtualLock UnregisterApplicationRestart FindAtomW DisableThreadProfiling GetThreadTimes GetTempFileNameW GetThreadGroupAffinity ConvertThreadToFiber VirtualQuery OpenThread AreFileApisANSI ReadFile WriteProfileStringW QueryThreadpoolStackInformation GetOEMCP GetConsoleOutputCP GetStdHandle SetProcessShutdownParameters GetNumaProcessorNodeEx InitializeCriticalSectionEx UnregisterBadMemoryNotification DisconnectNamedPipe ApplicationRecoveryInProgress PowerCreateRequest BuildCommDCBW GetProcessPreferredUILanguages UpdateResourceW GetNamedPipeClientSessionId CreateFileMappingFromApp SetConsoleCP SetThreadExecutionState GetConsoleWindow DeleteTimerQueueTimer EnumSystemFirmwareTables lstrcmpW GetCurrentConsoleFont CreateFileW GetConsoleMode FlushFileBuffers HeapSize SetFilePointerEx SetStdHandle QueryPerformanceCounter QueryPerformanceFrequency WideCharToMultiByte GetSystemTimeAsFileTime GetModuleHandleW GetProcAddress EnterCriticalSection LeaveCriticalSection DeleteCriticalSection EncodePointer DecodePointer MultiByteToWideChar GetStringTypeW GetCPInfo IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent GetCurrentThreadId InitializeSListHead TerminateProcess RtlUnwindEx RtlPcToFileHeader RaiseException SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW GetModuleHandleExW WriteFile HeapReAlloc GetFileType FlsAlloc FlsSetValue FlsFree LCMapStringW FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW WriteConsoleW

ntdll

RtlLookupFunctionEntry RtlVirtualUnwind RtlCaptureContext

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-28_64090cde39de433c83812bed1b3c89ee_cobalt-strike_icedid_luca-stealer_njrat_stealc

kernel32

ntdll

generic