2026-11-03_634de3da2e1d989dbc383afe6428a0d7_cobalt-strike_icedid_luca-stealer_njrat_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-11-03_634de3da2e1d989dbc383afe6428a0d7_cobalt-strike_icedid_luca-stealer_njrat_stealc
Size 327KB
Sample261104-xe4e9ay13r
SHA256 38b4f60988e75aa0352e329a35ebb75429d8a3e6ad53929ed37c5c16f5f670c2
MD5 634de3da2e1d989dbc383afe6428a0d7
SHA1 8109128bcb096dcf424aeb11f88188b345f9d113
SHA512 ac9f568af512a8d056dd4f9de674a62309ac74a9dea23219f75621826329e9883c4f56f9eddd01c2d6a45a1c3f3ddce0bffa8e9e458b08c06f998eea4a966584
SSDEEP 3072:jijt4uNdDDq5hGeRZvlRoTIJioOKpf1sQgJJlL//j2qmK42HSA+QXnng9P48HKdE:jiDdvq58wJQULg9//jxXnHYKdLaQe
TLSH
T1AF642806E6A610E5F5F6803885929537FA7E785503609BFB13934E962F236FC993EF00
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

2026-11-03_634de3da2e1d989dbc383afe6428a0d7_cobalt-strike_icedid_luca-stealer_njrat_stealc

.exe 327KB

2026-11-03_634de3da2e1d989dbc383afe6428a0d7_cobalt-strike_icedid_luca-stealer_njrat_stealc

IMPHASH 0dca459f7c59fbe660cbb0ec09b9b43b
SHA256 38b4f60988e75aa0352e329a35ebb75429d8a3e6ad53929ed37c5c16f5f670c2
MD5 634de3da2e1d989dbc383afe6428a0d7
SHA1 8109128bcb096dcf424aeb11f88188b345f9d113
SHA512 ac9f568af512a8d056dd4f9de674a62309ac74a9dea23219f75621826329e9883c4f56f9eddd01c2d6a45a1c3f3ddce0bffa8e9e458b08c06f998eea4a966584
SSDEEP 3072:jijt4uNdDDq5hGeRZvlRoTIJioOKpf1sQgJJlL//j2qmK42HSA+QXnng9P48HKdE:jiDdvq58wJQULg9//jxXnHYKdLaQe
TLSH
T1AF642806E6A610E5F5F6803885929537FA7E785503609BFB13934E962F236FC993EF00
MD5 SHA1 SHA512 SSDEEP TLSH

Digest

0f:21:fb:41:b1:d8:b8:6c:2b:dc:72:79:6b:7c:68:cc:46:38:cf:04:98:c7:46:87:f6:59:91:e6:70:b5:05:b9

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=000681038,CN=Bitsum Technologies (Bitsum LLC),O=Bitsum Technologies (Bitsum LLC),L=Morristown,ST=Tennessee,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130954656e6e6573736565,1.3.6.1.4.1.311.60.2.1.3=#13025553

Chains

Nov 2, 2026

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

Serial Number

08:c1:a2:26:80:ab:e5:ed:39:c3:d6:76:63:fe:27:15

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jan 12, 2025 - Mar 28, 2028

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2026 1,O=DigiCert\, Inc.,C=US

Serial Number

08:4f:dc:33:4f:7e:45:4e:db:c3:0f:8f:f9:92:18:35

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Aug 5, 2026 - Nov 4, 2037

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

108856

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

c:\pl\output\ThreadRacer.exe.pdb

kernel32

LockResource SizeofResource FindResourceW LoadLibraryW GetLastError InitializeCriticalSectionEx WriteConsoleW GetConsoleMode GetConsoleOutputCP DeleteCriticalSection CloseHandle SetEvent WaitForSingleObject CreateEventW GetCurrentProcess CreateThread GetCurrentThread SetThreadPriority GetTickCount64 GlobalAlloc GlobalUnlock GlobalLock SetThreadAffinityMask GetProcAddress LoadResource GetModuleHandleW FindResourceExW ExitProcess GetProcessHeap HeapSize HeapFree FlushFileBuffers GetStringTypeW HeapReAlloc HeapAlloc HeapDestroy SetStdHandle FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetCPInfo GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW FindClose SetFilePointerEx LCMapStringW LoadLibraryExW VirtualProtect GetLogicalProcessorInformationEx GetActiveProcessorCount GetActiveProcessorGroupCount GetFileAttributesW FreeLibrary GetUserDefaultUILanguage LocalFree MultiByteToWideChar CreateFileW VerifyVersionInfoW VerSetConditionMask GetModuleFileNameW GetStartupInfoW GetCurrentProcessId SetLastError WriteFile WideCharToMultiByte GetVersionExW MulDiv LocalAlloc LocalLock LocalUnlock InitializeCriticalSectionAndSpinCount EnterCriticalSection LeaveCriticalSection IsDebuggerPresent OutputDebugStringW RaiseException ReleaseSRWLockExclusive AcquireSRWLockExclusive GetCurrentThreadId QueryPerformanceCounter GetSystemTimeAsFileTime WakeAllConditionVariable SleepConditionVariableSRW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent InitializeSListHead RtlPcToFileHeader RtlUnwindEx EncodePointer TlsAlloc TlsGetValue TlsSetValue TlsFree GetModuleHandleExW GetStdHandle GetFileType FlsAlloc FlsGetValue FlsSetValue FlsFree

user32

SystemParametersInfoW LoadImageW LoadIconW SetPropW FrameRect GetWindowRect OffsetRect IsWindow PostMessageW GetSystemMetrics SetWindowTextW GetClassNameW IsWindowEnabled IsWindowVisible RedrawWindow GetParent SetRect GetActiveWindow GetLastActivePopup MessageBeep DrawIcon GetDialogBaseUnits GetMonitorInfoW SendMessageW DestroyIcon InflateRect EnableMenuItem GetSystemMenu SetFocus SetForegroundWindow WinHelpW GetAsyncKeyState GetWindow CreateDialogIndirectParamW PeekMessageW IsDialogMessageW TranslateMessage DispatchMessageW WaitMessage PostQuitMessage LoadCursorW EnumChildWindows SetWindowLongPtrW GetWindowLongPtrW FillRect DrawFocusRect GetSysColor ClientToScreen GetClientRect GetWindowTextW InvalidateRect EndPaint BeginPaint ReleaseDC GetDC DrawTextW EnableWindow KillTimer SetTimer EmptyClipboard SetClipboardData CloseClipboard OpenClipboard GetDlgCtrlID IsDlgButtonChecked CheckDlgButton GetDlgItemInt GetDlgItem EndDialog DialogBoxParamW SetWindowPlacement GetWindowPlacement SetWindowPos MoveWindow ShowWindow DestroyWindow CreateWindowExW RegisterClassExW DefWindowProcW TrackMouseEvent MessageBoxW LoadStringW MonitorFromWindow

gdi32

GdiFlush MoveToEx SetTextColor SetBkMode SelectObject LineTo GetTextExtentPoint32W Ellipse DeleteObject DeleteDC CreateSolidBrush CreatePen CreateFontIndirectW CreateCompatibleDC CreateCompatibleBitmap BitBlt CreateDIBSection GetObjectW SetBkColor CreateDCW GetTextMetricsW Rectangle ExtCreatePen Polyline

advapi32

RegSetValueExW RegQueryValueExW RegOpenKeyExW RegCreateKeyExW RegCloseKey

ole32

CoInitialize

comctl32

ord413 ord411 ord410 ord17 InitCommonControlsEx ord412

uxtheme

SetWindowTheme

dwmapi

DwmSetWindowAttribute

Name

.text

Size

205KB

Virtual Size

204KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

76KB

Virtual Size

75KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

25KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

10KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

17KB

Virtual Size

17KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-11-03_634de3da2e1d989dbc383afe6428a0d7_cobalt-strike_icedid_luca-stealer_njrat_stealc

kernel32

user32

gdi32

advapi32

ole32

comctl32

uxtheme

dwmapi

generic