2026-11-02_cb27146f6667c8b99941100393f14dc1_cobalt-strike_icedid_luca-stealer_njrat_stealc

General

Target
2026-11-02_cb27146f6667c8b99941100393f14dc1_cobalt-strike_icedid_luca-stealer_njrat_stealc
Size 677KB
Sample261102-2k73vafy2l
SHA256 ab1b4fdd8b81fb0ff54d24e5f70e96a6113861db999d39a2e221eaf5f7457e33
MD5 cb27146f6667c8b99941100393f14dc1
SHA1 9a8d5119ff64140d738b01e38711052b1136c3d1
SHA512 bff479aa0eff8b6d74d18f62eb2941c400f86aa47fe7f4f41be01d45d684c9a698115e7fdea6a561ba4cd773d2e690124aec4a8dadc386c1dd90df7a91bd5b1b
SSDEEP 12288:GX2syZG85oIwXxq60nx+Vz9a68w9E7Zm8PPD5:M2syV5YXxUx+VYzgE9m6
TLSH
T1C7E4BF35A7A415F8E1A7C23BCE5A9942E7B27C0947705ADF079006A11E276D8CF3EB13
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-11-02_cb27146f6667c8b99941100393f14dc1_cobalt-strike_icedid_luca-stealer_njrat_stealc

File Explorer

2026-11-02_cb27146f6667c8b99941100393f14dc1_cobalt-strike_icedid_luca-stealer_njrat_stealc

.exe 677KB

2026-11-02_cb27146f6667c8b99941100393f14dc1_cobalt-strike_icedid_luca-stealer_njrat_stealc

IMPHASH 9a349cde3e357c1f881e64dfea4a91f0
SHA256 ab1b4fdd8b81fb0ff54d24e5f70e96a6113861db999d39a2e221eaf5f7457e33
MD5 cb27146f6667c8b99941100393f14dc1
SHA1 9a8d5119ff64140d738b01e38711052b1136c3d1
SHA512 bff479aa0eff8b6d74d18f62eb2941c400f86aa47fe7f4f41be01d45d684c9a698115e7fdea6a561ba4cd773d2e690124aec4a8dadc386c1dd90df7a91bd5b1b
SSDEEP 12288:GX2syZG85oIwXxq60nx+Vz9a68w9E7Zm8PPD5:M2syV5YXxUx+VYzgE9m6
TLSH
T1C7E4BF35A7A415F8E1A7C23BCE5A9942E7B27C0947705ADF079006A11E276D8CF3EB13
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

155340

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer MultiByteToWideChar WideCharToMultiByte LCMapStringEx GetStringTypeW GetCPInfo ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent GetModuleHandleW GetCurrentProcess TerminateProcess QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead SetEndOfFile RtlPcToFileHeader RaiseException RtlUnwindEx GetLastError SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary GetProcAddress LoadLibraryExW ExitProcess GetModuleHandleExW GetModuleFileNameW GetStdHandle WriteFile GetCommandLineA GetCommandLineW HeapFree HeapAlloc FlsAlloc FlsGetValue FlsSetValue FlsFree VirtualProtect CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetFileType CloseHandle FlushFileBuffers GetConsoleOutputCP GetConsoleMode ReadFile GetFileSizeEx SetFilePointerEx ReadConsoleW HeapReAlloc FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetProcessHeap SetStdHandle CreateFileW HeapSize WriteConsoleW RtlUnwind

Name

.text

Size

298KB

Virtual Size

297KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

355KB

Virtual Size

354KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

14KB

Virtual Size

14KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-11-02_cb27146f6667c8b99941100393f14dc1_cobalt-strike_icedid_luca-stealer_njrat_stealc

kernel32

generic