2026-10-31_a6f63d4beb3deabd7293f967003b51c6_cobalt-strike_icedid_luca-stealer_njrat_stealc

General

Target
2026-10-31_a6f63d4beb3deabd7293f967003b51c6_cobalt-strike_icedid_luca-stealer_njrat_stealc
Size 501KB
Sample261101-1q8e5add52
SHA256 fb8b0c8755439be1f062f1403d2bdb152cd0e3ad9f0b11282213819268f9328f
MD5 a6f63d4beb3deabd7293f967003b51c6
SHA1 353ce12d609078b509c33cebe4c0f1fd97390f72
SHA512 3fea032547b6b4aa98bbae00d15d20e165599f138d76995464c454991febaf802f3ba25cc2a7a2fc08765f7b8bb6d3976e083d75950a75700a61990816048e3e
SSDEEP 12288:iSSygHZ0lR0xN31MRVXph0lhSMXl+lfc:R05K0xNl2VZh0lhSMXl
TLSH
T15CB4BE96B3A543F8E1ABC178CD524A45EB727C850791A7CF03904AB66F236D24E3F712
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-31_a6f63d4beb3deabd7293f967003b51c6_cobalt-strike_icedid_luca-stealer_njrat_stealc

File Explorer

2026-10-31_a6f63d4beb3deabd7293f967003b51c6_cobalt-strike_icedid_luca-stealer_njrat_stealc

.exe 501KB

2026-10-31_a6f63d4beb3deabd7293f967003b51c6_cobalt-strike_icedid_luca-stealer_njrat_stealc

IMPHASH 2f6d51d9d9954d0e82140f47d8b89629
SHA256 fb8b0c8755439be1f062f1403d2bdb152cd0e3ad9f0b11282213819268f9328f
MD5 a6f63d4beb3deabd7293f967003b51c6
SHA1 353ce12d609078b509c33cebe4c0f1fd97390f72
SHA512 3fea032547b6b4aa98bbae00d15d20e165599f138d76995464c454991febaf802f3ba25cc2a7a2fc08765f7b8bb6d3976e083d75950a75700a61990816048e3e
SSDEEP 12288:iSSygHZ0lR0xN31MRVXph0lhSMXl+lfc:R05K0xNl2VZh0lhSMXl
TLSH
T15CB4BE96B3A543F8E1ABC178CD524A45EB727C850791A7CF03904AB66F236D24E3F712
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

131148

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

user32

IsWindowVisible SetProcessDPIAware IsDialogMessageW LoadCursorW GetWindowTextLengthW GetWindowTextW SetWindowTextW EnableWindow ShowWindow DestroyWindow CreateWindowExW RegisterClassW PostQuitMessage DefWindowProcW SendMessageW DispatchMessageW TranslateMessage GetMessageW UnhookWindowsHookEx SetWindowsHookExW GetWindow GetWindowThreadProcessId EnumWindows PostMessageW

kernel32

HeapSize SetStdHandle GetProcessHeap SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP GetACP IsValidCodePage HeapReAlloc ReadConsoleW SetFilePointerEx GetFileSizeEx GetConsoleMode GetConsoleOutputCP FlushFileBuffers EnumSystemLocalesW WriteConsoleW IsValidLocale GetLocaleInfoW CreateFileW ReadFile WriteFile CloseHandle GetLastError Sleep FreeLibrary GetModuleFileNameW GetProcAddress LoadLibraryExW GetCurrentProcessId OpenProcess GetModuleHandleW QueryFullProcessImageNameW MultiByteToWideChar WideCharToMultiByte FreeConsole LCMapStringW GetUserDefaultLCID LocalFree FormatMessageA GetLocaleInfoEx FindClose FindFirstFileW FindFirstFileExW FindNextFileW GetFileAttributesExW GetFullPathNameW AreFileApisANSI GetFileInformationByHandleEx GetCurrentThreadId GetStringTypeW EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer QueryPerformanceCounter ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive RtlUnwind WakeAllConditionVariable LCMapStringEx GetSystemTimeAsFileTime GetCPInfo RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW InitializeSListHead RtlPcToFileHeader RaiseException RtlUnwindEx SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree CreateThread ExitThread FreeLibraryAndExitThread GetModuleHandleExW ExitProcess GetStdHandle GetCommandLineA GetCommandLineW HeapAlloc HeapFree GetFileType FlsAlloc FlsGetValue FlsSetValue FlsFree VirtualProtect CompareStringW

gdi32

GetStockObject

Name

.text

Size

259KB

Virtual Size

259KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

216KB

Virtual Size

216KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

6KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

14KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-31_a6f63d4beb3deabd7293f967003b51c6_cobalt-strike_icedid_luca-stealer_njrat_stealc

user32

kernel32

gdi32

generic