2026-10-31_9eae7f4d6bf302bb03bfaa09116935d6_cobalt-strike_icedid_luca-stealer_njrat_stealc

General

Target
2026-10-31_9eae7f4d6bf302bb03bfaa09116935d6_cobalt-strike_icedid_luca-stealer_njrat_stealc
Size 385KB
Sample261101-16bfbsdw31
SHA256 6b184e5cf6df12438298edcd00f68a849b251cb453241acae77b4566c3d57afa
MD5 9eae7f4d6bf302bb03bfaa09116935d6
SHA1 0d1aeb0398ba7b679c3836ecd034a25c18b260f4
SHA512 854d07fc8c66af61b2047677dac690ae0910148d0d0556ae197dceda72a257580d1197d43d1bb7b99c6c36fd57cd4fa5b56a0df5e1468cd063dab2768e63d120
SSDEEP 6144:CZE59G3WB0kzbveoRdUo47Pwbz9q76tOqtoAYJ5WlXqHYeG8RX:oWd3lEoQPwbza+jtdYJUtqHYeV
TLSH
T1A4847C5AE7A414F9E1B7D538C9724506EAB17C9907B0D6CF23A40A9A0F337E09E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-31_9eae7f4d6bf302bb03bfaa09116935d6_cobalt-strike_icedid_luca-stealer_njrat_stealc

File Explorer

2026-10-31_9eae7f4d6bf302bb03bfaa09116935d6_cobalt-strike_icedid_luca-stealer_njrat_stealc

.exe 385KB

2026-10-31_9eae7f4d6bf302bb03bfaa09116935d6_cobalt-strike_icedid_luca-stealer_njrat_stealc

IMPHASH 1638d5bb5ad9fe96cce820d934bfba0d
SHA256 6b184e5cf6df12438298edcd00f68a849b251cb453241acae77b4566c3d57afa
MD5 9eae7f4d6bf302bb03bfaa09116935d6
SHA1 0d1aeb0398ba7b679c3836ecd034a25c18b260f4
SHA512 854d07fc8c66af61b2047677dac690ae0910148d0d0556ae197dceda72a257580d1197d43d1bb7b99c6c36fd57cd4fa5b56a0df5e1468cd063dab2768e63d120
SSDEEP 6144:CZE59G3WB0kzbveoRdUo47Pwbz9q76tOqtoAYJ5WlXqHYeG8RX:oWd3lEoQPwbza+jtdYJUtqHYeV
TLSH
T1A4847C5AE7A414F9E1B7D538C9724506EAB17C9907B0D6CF23A40A9A0F337E09E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

93324

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\gmk\docs\dev\dev\inactive_click\kdmapper\x64\Release\kdmapper_Release.pdb

kernel32

CloseHandle GetProcAddress GetCurrentProcessId CreateToolhelp32Snapshot Process32NextW Process32FirstW GetModuleHandleA GetModuleFileNameW GetTempPathW SetEndOfFile WriteConsoleW HeapSize SetStdHandle GetCurrentThreadId CreateFileW VirtualAlloc DeviceIoControl SetUnhandledExceptionFilter VirtualFree GetProcessHeap SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP MultiByteToWideChar FormatMessageA GetStringTypeW WideCharToMultiByte LocalFree GetLocaleInfoEx FindClose FindFirstFileW FindFirstFileExW FindNextFileW GetFileAttributesExW AreFileApisANSI GetLastError GetModuleHandleW GetFileInformationByHandleEx EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer LCMapStringEx GetCPInfo ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW QueryPerformanceCounter GetSystemTimeAsFileTime InitializeSListHead RtlUnwindEx RtlPcToFileHeader RaiseException SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW DeleteFileW ExitProcess GetModuleHandleExW GetStdHandle WriteFile GetCommandLineA GetCommandLineW GetFileSizeEx SetFilePointerEx GetFileType HeapAlloc FlushFileBuffers GetConsoleOutputCP GetConsoleMode HeapFree FlsAlloc FlsGetValue FlsSetValue FlsFree VirtualProtect CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW ReadFile ReadConsoleW HeapReAlloc IsValidCodePage GetACP RtlUnwind

user32

GetWindowThreadProcessId GetShellWindow

advapi32

RegCloseKey RegDeleteTreeW RegCreateKeyW RegOpenKeyW RegSetKeyValueW

ntdll

RtlInitUnicodeString NtQuerySystemInformation NtUnloadDriver RtlAdjustPrivilege NtLoadDriver

Name

.text

Size

228KB

Virtual Size

228KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

132KB

Virtual Size

132KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

6KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

13KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

488B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-31_9eae7f4d6bf302bb03bfaa09116935d6_cobalt-strike_icedid_luca-stealer_njrat_stealc

kernel32

user32

advapi32

ntdll

generic