2026-11-03_6c11d07dc4df49af2520cc7665dce684_cobalt-strike_icedid_luca-stealer_njrat_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-11-03_6c11d07dc4df49af2520cc7665dce684_cobalt-strike_icedid_luca-stealer_njrat_stealc
Size 314KB
Sample261104-wefhrattax
SHA256 2326810c60072661ec325b676bcbca6fd93ebe3bb50e49c0eeda3ece4c06655a
MD5 6c11d07dc4df49af2520cc7665dce684
SHA1 8586ff6b4660bd5e76590497cc6b55d5841fd3f2
SHA512 9b5b91efc6d8529cc97f7de9ae778898debe0ceac2c7cfb07438bc95d92d0676f5c1f5e1c8698b49cc90ba3ddd0be5d882893d2a8e5d856e68c3dd2032c62eaa
SSDEEP 6144:7JCZzpxb3To6oBgeLNen6DnjM2oNy14S6H3EJ:FKtZDEFnjuNRfXEJ
TLSH
T1AD648E19B39554F9E877C17DCE424902EB7278464771DADF07A04A962F27AE08F3EB02
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-11-03_6c11d07dc4df49af2520cc7665dce684_cobalt-strike_icedid_luca-stealer_njrat_stealc

File Explorer

2026-11-03_6c11d07dc4df49af2520cc7665dce684_cobalt-strike_icedid_luca-stealer_njrat_stealc

.exe 314KB

2026-11-03_6c11d07dc4df49af2520cc7665dce684_cobalt-strike_icedid_luca-stealer_njrat_stealc

IMPHASH ae5d5d1247171885159aad97723ae4af
SHA256 2326810c60072661ec325b676bcbca6fd93ebe3bb50e49c0eeda3ece4c06655a
MD5 6c11d07dc4df49af2520cc7665dce684
SHA1 8586ff6b4660bd5e76590497cc6b55d5841fd3f2
SHA512 9b5b91efc6d8529cc97f7de9ae778898debe0ceac2c7cfb07438bc95d92d0676f5c1f5e1c8698b49cc90ba3ddd0be5d882893d2a8e5d856e68c3dd2032c62eaa
SSDEEP 6144:7JCZzpxb3To6oBgeLNen6DnjM2oNy14S6H3EJ:FKtZDEFnjuNRfXEJ
TLSH
T1AD648E19B39554F9E877C17DCE424902EB7278464771DADF07A04A962F27AE08F3EB02
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

93140

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

shell32

CommandLineToArgvW

advapi32

GetLengthSid LookupAccountSidW CreateProcessAsUserW OpenProcessToken AddAccessAllowedAce CreateRestrictedToken CreateWellKnownSid EqualSid InitializeAcl GetSidSubAuthority GetSidSubAuthorityCount GetTokenInformation SetTokenInformation

userenv

CreateEnvironmentBlock DestroyEnvironmentBlock

user32

GetClipboardData CloseClipboard CountClipboardFormats EnumClipboardFormats OpenClipboard

kernel32

WriteConsoleW HeapReAlloc HeapSize GetConsoleMode GetConsoleOutputCP FlushFileBuffers GetStringTypeW SetStdHandle GetCommandLineW CreateFileW ReadFile WriteFile CloseHandle SetHandleInformation GetLastError CreatePipe SetNamedPipeHandleState QueryPerformanceCounter QueryPerformanceFrequency GetOverlappedResult CancelIoEx SetEvent ResetEvent WaitForSingleObject CreateEventW Sleep WaitForMultipleObjects GetCurrentProcess ExitProcess TerminateProcess GetExitCodeProcess ResumeThread CreateProcessW InitializeProcThreadAttributeList DeleteProcThreadAttributeList UpdateProcThreadAttribute AssignProcessToJobObject TerminateJobObject LocalFree MultiByteToWideChar WideCharToMultiByte GetStdHandle GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentVariableW GetFileType GetCurrentProcessId ProcessIdToSessionId GetProcessMitigationPolicy SetProcessMitigationPolicy IsProcessInJob CreateJobObjectW SetInformationJobObject QueryInformationJobObject GlobalSize GlobalUnlock GlobalLock GetConsoleWindow GetProcessHeap WaitForSingleObjectEx GetCurrentThreadId GetExitCodeThread ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW InitializeCriticalSectionEx GetSystemTimeAsFileTime GetModuleHandleW GetProcAddress RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent InitializeSListHead RtlPcToFileHeader RaiseException RtlUnwindEx SetLastError EncodePointer EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW CreateThread ExitThread FreeLibraryAndExitThread GetModuleHandleExW GetModuleFileNameW HeapAlloc HeapFree FlsAlloc FlsGetValue FlsSetValue FlsFree VirtualProtect LCMapStringW GetFileSizeEx SetFilePointerEx FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA

Name

.text

Size

195KB

Virtual Size

195KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

74KB

Virtual Size

74KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

10KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

26KB

Virtual Size

25KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-11-03_6c11d07dc4df49af2520cc7665dce684_cobalt-strike_icedid_luca-stealer_njrat_stealc

shell32

advapi32

userenv

user32

kernel32

generic