2026-10-31_8dd9aa55db90f6877bbdecf5fd4116cb_cobalt-strike_icedid_luca-stealer_njrat_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-31_8dd9aa55db90f6877bbdecf5fd4116cb_cobalt-strike_icedid_luca-stealer_njrat_stealc
Size 371KB
Sample261101-21zfmsde76
SHA256 4218bd9a82d3b029519363725ce816bbce4ca77c3b98d21998205b27632edc6b
MD5 8dd9aa55db90f6877bbdecf5fd4116cb
SHA1 b968e0981042ecf71e733670a160ee4182a69028
SHA512 d5fc57031cb4b9c5bb8127ca3eaebeebc7ed13844402df581b9865c051f0898fbe5f2e427098d1d516158467a032b70e1ccd03204159926f81aabb85d54237a6
SSDEEP 6144:Ojxgk8itnRS26amCKhwRvm7DzuWIREuf8uwSJuHxSPTNXYDwmrzkM:Ex7BuPSWEkuwSjVYDdo
TLSH
T13E847C15E7E510F9E5B7D138CD928902EB727C1A47A0EBDF13A089962F27AD04E3D712
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-31_8dd9aa55db90f6877bbdecf5fd4116cb_cobalt-strike_icedid_luca-stealer_njrat_stealc

File Explorer

2026-10-31_8dd9aa55db90f6877bbdecf5fd4116cb_cobalt-strike_icedid_luca-stealer_njrat_stealc

.exe 371KB

2026-10-31_8dd9aa55db90f6877bbdecf5fd4116cb_cobalt-strike_icedid_luca-stealer_njrat_stealc

IMPHASH 5a6dcb7b2970ab752568a1ff0e711d2b
SHA256 4218bd9a82d3b029519363725ce816bbce4ca77c3b98d21998205b27632edc6b
MD5 8dd9aa55db90f6877bbdecf5fd4116cb
SHA1 b968e0981042ecf71e733670a160ee4182a69028
SHA512 d5fc57031cb4b9c5bb8127ca3eaebeebc7ed13844402df581b9865c051f0898fbe5f2e427098d1d516158467a032b70e1ccd03204159926f81aabb85d54237a6
SSDEEP 6144:Ojxgk8itnRS26amCKhwRvm7DzuWIREuf8uwSJuHxSPTNXYDwmrzkM:Ex7BuPSWEkuwSjVYDdo
TLSH
T13E847C15E7E510F9E5B7D138CD928902EB727C1A47A0EBDF13A089962F27AD04E3D712
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

70932

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\a\Warframe.dll.v2\Warframe.dll.v2\v2\build\Release\OwHelperLoader.pdb

kernel32

FindNextFileW GetCurrentProcess GetStdHandle WriteFile SetConsoleMode TerminateProcess GetModuleFileNameW SetEnvironmentVariableW GetTempPathW FindClose WaitForSingleObject CreateFileW GetFileAttributesW SuspendThread ResumeThread UnmapViewOfFile OpenProcess CreateToolhelp32Snapshot MultiByteToWideChar Sleep GetConsoleMode GetTickCount64 GetLastError Process32NextW DeleteFileW WriteProcessMemory CloseHandle VirtualProtectEx GetThreadContext GetProcAddress SetFilePointerEx VirtualAllocEx ExitProcess ReadProcessMemory GetCurrentProcessId CreateProcessW GetModuleHandleW WideCharToMultiByte QueryFullProcessImageNameW VirtualFreeEx CreateFileMappingW MapViewOfFile SetThreadContext QueryPerformanceCounter FlushFileBuffers GetExitCodeProcess SetEndOfFile WriteConsoleW HeapSize GetProcessHeap SetStdHandle FindFirstFileW ReadFile Process32FirstW CreateDirectoryW FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP GetACP IsValidCodePage HeapReAlloc ReadConsoleW GetConsoleOutputCP EnumSystemLocalesW GetUserDefaultLCID IsValidLocale LocalFree FormatMessageA GetLocaleInfoEx FindFirstFileExW GetFileAttributesExW GetFileInformationByHandle GetFullPathNameW SetFileInformationByHandle AreFileApisANSI CopyFileW MoveFileExW GetFileInformationByHandleEx EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer LCMapStringEx GetStringTypeW GetCPInfo GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent RtlUnwindEx RtlPcToFileHeader RaiseException SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW GetModuleHandleExW GetCommandLineA GetCommandLineW GetFileSizeEx GetFileType HeapAlloc HeapFree FlsAlloc FlsGetValue FlsSetValue FlsFree VirtualProtect CompareStringW LCMapStringW GetLocaleInfoW RtlUnwind

user32

MessageBoxW GetWindowThreadProcessId FindWindowW

advapi32

AdjustTokenPrivileges OpenProcessToken LookupPrivilegeValueW

wininet

InternetOpenUrlW InternetOpenW HttpQueryInfoW InternetReadFile InternetCloseHandle

dbghelp

SymGetModuleInfoW64 SymCleanup SymUnloadModule64 SymFromName SymInitializeW SymLoadModuleExW SymSetOptions

Name

.text

Size

213KB

Virtual Size

213KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

93KB

Virtual Size

93KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

11KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

44KB

Virtual Size

43KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-31_8dd9aa55db90f6877bbdecf5fd4116cb_cobalt-strike_icedid_luca-stealer_njrat_stealc

kernel32

user32

advapi32

wininet

dbghelp

generic