2026-11-01_bf306df4c9d71c928fa38b0e2360ed03_cobalt-strike_icedid_luca-stealer_njrat_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-11-01_bf306df4c9d71c928fa38b0e2360ed03_cobalt-strike_icedid_luca-stealer_njrat_stealc
Size 987KB
Sample261102-ly97cseg23
SHA256 be8daf0d4227d352c31fecf04c7b9e1f1783206050978804331a7416298955bd
MD5 bf306df4c9d71c928fa38b0e2360ed03
SHA1 31ff0f2693b528d7b83781fe71895f91aa2f3564
SHA512 49585ec04352b96711c7b946dd5daa38c6d2924eeaf91cd714204f03c3ffaa46e6aa434f47747fd53e92f696e38abfcb0dc32a74c43452b99da3157288c39053
SSDEEP 24576:pwo25Qdxps+8HXXhDunkohvSbems3KMY6H:pw1Qs+83En5mT6
TLSH
T17825E052F2A445FEE07B9139C9869A1BFB723805076087CB23F806552FA77E45EBB311
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-11-01_bf306df4c9d71c928fa38b0e2360ed03_cobalt-strike_icedid_luca-stealer_njrat_stealc

File Explorer

2026-11-01_bf306df4c9d71c928fa38b0e2360ed03_cobalt-strike_icedid_luca-stealer_njrat_stealc

.exe 987KB

2026-11-01_bf306df4c9d71c928fa38b0e2360ed03_cobalt-strike_icedid_luca-stealer_njrat_stealc

IMPHASH 6c13a504194df114e365b86f8b3f2099
SHA256 be8daf0d4227d352c31fecf04c7b9e1f1783206050978804331a7416298955bd
MD5 bf306df4c9d71c928fa38b0e2360ed03
SHA1 31ff0f2693b528d7b83781fe71895f91aa2f3564
SHA512 49585ec04352b96711c7b946dd5daa38c6d2924eeaf91cd714204f03c3ffaa46e6aa434f47747fd53e92f696e38abfcb0dc32a74c43452b99da3157288c39053
SSDEEP 24576:pwo25Qdxps+8HXXhDunkohvSbems3KMY6H:pw1Qs+83En5mT6
TLSH
T17825E052F2A445FEE07B9139C9869A1BFB723805076087CB23F806552FA77E45EBB311
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

326880

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

d3d11

D3D11CreateDeviceAndSwapChain

kernel32

SetFilePointer WriteFile CloseHandle QueryPerformanceCounter HeapAlloc HeapFree GetProcessHeap WaitForSingleObject GetCurrentProcessId CreateProcessW GetModuleHandleW LoadResource LockResource SizeofResource FindResourceW GetDiskFreeSpaceExW GetCurrentProcess GlobalMemoryStatusEx FreeLibrary GetModuleHandleA GetProcAddress LoadLibraryA WideCharToMultiByte GlobalAlloc GlobalUnlock GlobalLock GlobalFree MultiByteToWideChar QueryPerformanceFrequency GetLocaleInfoA SetStdHandle SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW SetFileAttributesW GetCPInfo GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW FindClose GetFileSizeEx SetFilePointerEx ReadConsoleW GetConsoleMode GetConsoleOutputCP FlushFileBuffers GetTimeZoneInformation LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW VirtualProtect FlsFree FlsSetValue FlsGetValue FlsAlloc GetFileType ExitProcess ReadFile CreateFileW CreateDirectoryW ExpandEnvironmentStringsW GetModuleFileNameW GetStdHandle GetModuleHandleExW GetStringTypeW HeapSize HeapReAlloc WriteConsoleW SetEndOfFile GetCommandLineA WaitForSingleObjectEx Sleep GetCurrentThreadId GetExitCodeThread ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive SleepConditionVariableSRW InitializeCriticalSectionEx GetSystemTimeAsFileTime WakeAllConditionVariable InitializeSListHead RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent TerminateProcess RtlPcToFileHeader RaiseException RtlUnwindEx GetLastError SetLastError EncodePointer EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW CreateThread ExitThread FreeLibraryAndExitThread

user32

LoadCursorW ScreenToClient ClientToScreen GetCursorPos SetCursor SetCursorPos GetClientRect GetForegroundWindow IsWindowUnicode ReleaseCapture SetCapture GetCapture GetKeyState GetMessageExtraInfo TrackMouseEvent GetKeyboardLayout EmptyClipboard GetClipboardData SetClipboardData CloseClipboard OpenClipboard UpdateWindow GetSystemMetrics ShowWindow DestroyWindow CreateWindowExW RegisterClassExW UnregisterClassW PostQuitMessage DefWindowProcW PeekMessageW DispatchMessageW TranslateMessage

shell32

SHGetFolderPathW ShellExecuteA

imm32

ImmGetContext ImmReleaseContext ImmSetCompositionWindow ImmSetCandidateWindow

d3dcompiler_47

D3DCompile

Name

.text

Size

481KB

Virtual Size

480KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

135KB

Virtual Size

135KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

22KB

Virtual Size

22KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

339KB

Virtual Size

339KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-11-01_bf306df4c9d71c928fa38b0e2360ed03_cobalt-strike_icedid_luca-stealer_njrat_stealc

d3d11

kernel32

user32

shell32

imm32

d3dcompiler_47

generic