2026-11-03_6c98c51368ed687c3791a1e645a20b61_cobalt-strike_icedid_luca-stealer_njrat_stealc

General

Target
2026-11-03_6c98c51368ed687c3791a1e645a20b61_cobalt-strike_icedid_luca-stealer_njrat_stealc
Size 787KB
Sample261104-wcs13abz2s
SHA256 517b7fff31a608d2e3569ed4debace2110954a50ea904f158dd8ea20e83fe73e
MD5 6c98c51368ed687c3791a1e645a20b61
SHA1 807165ccb0f98d58c9f42ac40191b2a0933ff350
SHA512 b7c959c1157af6d712cbc14731e97519e9d26648dfd4c83d76ba8a0cefaa832dd514b107acee06c20b718d4c1a9b7128a1e4a25d0a886a1e4a5ea1ff6b591f86
SSDEEP 12288:jfhsMyw9hH1XAcIlulnmHaD41tD+ph0lhSMXl+Fbrj57EJ:jeMyw9hVp7nmHj7D0h0lhSMXlg0
TLSH
T1AC058E166BE841FCE0B6D2758DA65901FB727C090770AADF03D0956A5F63AE08E3E713
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-11-03_6c98c51368ed687c3791a1e645a20b61_cobalt-strike_icedid_luca-stealer_njrat_stealc

File Explorer

2026-11-03_6c98c51368ed687c3791a1e645a20b61_cobalt-strike_icedid_luca-stealer_njrat_stealc

.exe 787KB

2026-11-03_6c98c51368ed687c3791a1e645a20b61_cobalt-strike_icedid_luca-stealer_njrat_stealc

IMPHASH 7ec4ee86576b7dd6b6f337a4db89a206
SHA256 517b7fff31a608d2e3569ed4debace2110954a50ea904f158dd8ea20e83fe73e
MD5 6c98c51368ed687c3791a1e645a20b61
SHA1 807165ccb0f98d58c9f42ac40191b2a0933ff350
SHA512 b7c959c1157af6d712cbc14731e97519e9d26648dfd4c83d76ba8a0cefaa832dd514b107acee06c20b718d4c1a9b7128a1e4a25d0a886a1e4a5ea1ff6b591f86
SSDEEP 12288:jfhsMyw9hH1XAcIlulnmHaD41tD+ph0lhSMXl+Fbrj57EJ:jeMyw9hVp7nmHj7D0h0lhSMXlg0
TLSH
T1AC058E166BE841FCE0B6D2758DA65901FB727C090770AADF03D0956A5F63AE08E3E713
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

314512

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

advapi32

GetTokenInformation RegGetValueW ConvertSidToStringSidW GetSidSubAuthority GetSidSubAuthorityCount OpenProcessToken

ntdll

RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext RtlPcToFileHeader RtlUnwindEx NtQueryInformationProcess

kernel32

HeapSize CompareStringOrdinal GetFileAttributesW CreateFileW CloseHandle GetLastError CreateMutexW OpenMutexW GetProcessTimes GetCurrentProcessId ProcessIdToSessionId OpenProcess GetSystemTimeAsFileTime GetTickCount64 CreateToolhelp32Snapshot Process32FirstW Process32NextW CompareFileTime GetCurrentProcess QueryFullProcessImageNameW MultiByteToWideChar WideCharToMultiByte IsValidCodePage GetACP GetOEMCP LCMapStringEx SetEvent WaitForSingleObject CreateEventW ExitProcess SetConsoleCtrlHandler WriteFile GetStdHandle GetConsoleMode SetConsoleMode WriteConsoleW GetConsoleOutputCP CreateDirectoryW DeleteFileW SetFileAttributesW SetLastError LoadResource LockResource SizeofResource FindResourceW MoveFileExW GetUserDefaultUILanguage GetEnvironmentVariableW GetFileSizeEx GetFullPathNameW GetLongPathNameW ReadFile GetModuleFileNameW LocalFree FormatMessageW SetNamedPipeHandleState WaitNamedPipeW GetOverlappedResult CancelIoEx ResetEvent GetNamedPipeServerProcessId GetExitCodeProcess CreateProcessW GetSystemDirectoryW RaiseException GetSystemInfo VirtualProtect VirtualQuery FreeLibrary GetModuleHandleW GetProcAddress LoadLibraryExA FlushFileBuffers SetStdHandle GetProcessHeap SetEnvironmentVariableW FreeEnvironmentStringsW ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive GetCurrentThreadId EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer QueryPerformanceCounter GetStringTypeW GetCPInfo WakeAllConditionVariable SleepConditionVariableSRW UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW InitializeSListHead InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW GetModuleHandleExW GetCommandLineA GetCommandLineW HeapAlloc HeapFree GetFileType FlsAlloc FlsGetValue FlsSetValue FlsFree CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW SetFilePointerEx HeapReAlloc FindClose FindFirstFileExW FindNextFileW GetEnvironmentStringsW

Name

.text

Size

447KB

Virtual Size

446KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

278KB

Virtual Size

277KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

9KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

18KB

Virtual Size

17KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

30KB

Virtual Size

29KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-11-03_6c98c51368ed687c3791a1e645a20b61_cobalt-strike_icedid_luca-stealer_njrat_stealc

advapi32

ntdll

kernel32

generic