2026-10-31_e37e475961fd5cc18904ac8e17b3bb7f_cobalt-strike_icedid_luca-stealer_mespinoza_njrat_ryuk_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-31_e37e475961fd5cc18904ac8e17b3bb7f_cobalt-strike_icedid_luca-stealer_mespinoza_njrat_ryuk_stealc
Size 266KB
Sample261101-xtds5sdb24
SHA256 42318acca41b61893a7737ef6dbe9d65f342bd42c5d496d5356291250bb5087a
MD5 e37e475961fd5cc18904ac8e17b3bb7f
SHA1 1b58297d2eeb842a0f865073756debf275be2c46
SHA512 879e0621def981b2bb8c4cfc3ff1b3218adfbeb3d02eb1eec9a6660d0226da899bba1993bdecb4552f014e4807ec14174f77ebfc312a6004faa5203165cadc7e
SSDEEP 3072:2IN+2LQJB0zBekFT6bK5Z4A55CRlheNvKrxHOY7D3ytdIaRIi7/0+/ipzBFdoD:/sMekd6bK/405tCOY7WagI3d
TLSH
T1D8446C1577A51CFAED67813DC9124906EB72BC474BA0E6CF13904BA61F23AE05E3E721
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-31_e37e475961fd5cc18904ac8e17b3bb7f_cobalt-strike_icedid_luca-stealer_mespinoza_njrat_ryuk_stealc

File Explorer

2026-10-31_e37e475961fd5cc18904ac8e17b3bb7f_cobalt-strike_icedid_luca-stealer_mespinoza_njrat_ryuk_stealc

.exe 266KB

2026-10-31_e37e475961fd5cc18904ac8e17b3bb7f_cobalt-strike_icedid_luca-stealer_mespinoza_njrat_ryuk_stealc

IMPHASH 512349beb6f1fea130684bcd4ecc1aa6
SHA256 42318acca41b61893a7737ef6dbe9d65f342bd42c5d496d5356291250bb5087a
MD5 e37e475961fd5cc18904ac8e17b3bb7f
SHA1 1b58297d2eeb842a0f865073756debf275be2c46
SHA512 879e0621def981b2bb8c4cfc3ff1b3218adfbeb3d02eb1eec9a6660d0226da899bba1993bdecb4552f014e4807ec14174f77ebfc312a6004faa5203165cadc7e
SSDEEP 3072:2IN+2LQJB0zBekFT6bK5Z4A55CRlheNvKrxHOY7D3ytdIaRIi7/0+/ipzBFdoD:/sMekd6bK/405tCOY7WagI3d
TLSH
T1D8446C1577A51CFAED67813DC9124906EB72BC474BA0E6CF13904BA61F23AE05E3E721
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

41824

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

AcquireSRWLockExclusive CloseHandle CompareStringW CreateFileW CreateProcessA DecodePointer DeleteCriticalSection EncodePointer EnterCriticalSection EnumSystemLocalesW ExitProcess FindClose FindFirstFileExW FindNextFileW FlsAlloc FlsFree FlsGetValue FlsSetValue FlushFileBuffers FreeEnvironmentStringsW FreeLibrary GetACP GetCPInfo GetCommandLineA GetCommandLineW GetConsoleMode GetConsoleOutputCP GetCurrentProcess GetCurrentProcessId GetCurrentThreadId GetEnvironmentStringsW GetFileSizeEx GetFileType GetLastError GetLocaleInfoW GetModuleFileNameW GetModuleHandleExW GetModuleHandleW GetOEMCP GetProcAddress GetProcessHeap GetStartupInfoW GetStdHandle GetStringTypeW GetSystemTimeAsFileTime GetUserDefaultLCID HeapAlloc HeapFree HeapReAlloc HeapSize InitializeCriticalSectionAndSpinCount InitializeCriticalSectionEx InitializeSListHead IsDebuggerPresent IsProcessorFeaturePresent IsValidCodePage IsValidLocale LCMapStringEx LCMapStringW LeaveCriticalSection LoadLibraryExW MultiByteToWideChar OpenProcess QueryPerformanceCounter RaiseException ReadConsoleW ReadFile ReleaseSRWLockExclusive RtlCaptureContext RtlLookupFunctionEntry RtlPcToFileHeader RtlUnwind RtlUnwindEx RtlVirtualUnwind SetEnvironmentVariableW SetFilePointerEx SetLastError SetStdHandle SetUnhandledExceptionFilter Sleep SleepConditionVariableSRW TerminateProcess TlsAlloc TlsFree TlsGetValue TlsSetValue UnhandledExceptionFilter VirtualProtect WakeAllConditionVariable WideCharToMultiByte WriteConsoleW WriteFile

Name

.text

Size

171KB

Virtual Size

171KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

74KB

Virtual Size

73KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

9KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.retplne

Size

512B

Virtual Size

200B

Characteristics

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_RDATA

Size

512B

Virtual Size

500B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_sysc

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

424B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-31_e37e475961fd5cc18904ac8e17b3bb7f_cobalt-strike_icedid_luca-stealer_mespinoza_njrat_ryuk_stealc

kernel32

generic