2026-11-06_cbaeb0e83c5ab8bce93ada55e1fc3cba_cobalt-strike_icedid_luca-stealer_njrat_stealc

General

Target
2026-11-06_cbaeb0e83c5ab8bce93ada55e1fc3cba_cobalt-strike_icedid_luca-stealer_njrat_stealc
Size 288KB
Sample261107-28mrtawsc1
SHA256 595b1bf53b2d2efc4ebf759acbdb42b47967c22b6243ebe918569464b3c2676e
MD5 cbaeb0e83c5ab8bce93ada55e1fc3cba
SHA1 ce25cc136f0c60396107d0089bf210c1ee6fa362
SHA512 a8ae9dc2f92fa36c2d40b4ecc3557a17fb5bed0ceaba29f5252778c3d08bc05248dd53f7e195d4088212c074e41b44a993908e5dba6f2eb036b41129152542b3
SSDEEP 3072:bIS+nWSd+ZxRmPx+qnlTI7LjvnnJ4+DlDoNVTNyQPZG65odIQm5gdlx8s8yCWwQr:qN/cDnnJ4+JDoN7PPLcxnes8zn+M+
TLSH
T1A8545B0AF6A510F5D9B7C13DC952151AFE7278964760E7CB13A04E9B2F23AE09E3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-11-06_cbaeb0e83c5ab8bce93ada55e1fc3cba_cobalt-strike_icedid_luca-stealer_njrat_stealc

File Explorer

2026-11-06_cbaeb0e83c5ab8bce93ada55e1fc3cba_cobalt-strike_icedid_luca-stealer_njrat_stealc

.exe 288KB

2026-11-06_cbaeb0e83c5ab8bce93ada55e1fc3cba_cobalt-strike_icedid_luca-stealer_njrat_stealc

IMPHASH 74eb66784d418cb6bd2172f0f025215b
SHA256 595b1bf53b2d2efc4ebf759acbdb42b47967c22b6243ebe918569464b3c2676e
MD5 cbaeb0e83c5ab8bce93ada55e1fc3cba
SHA1 ce25cc136f0c60396107d0089bf210c1ee6fa362
SHA512 a8ae9dc2f92fa36c2d40b4ecc3557a17fb5bed0ceaba29f5252778c3d08bc05248dd53f7e195d4088212c074e41b44a993908e5dba6f2eb036b41129152542b3
SSDEEP 3072:bIS+nWSd+ZxRmPx+qnlTI7LjvnnJ4+DlDoNVTNyQPZG65odIQm5gdlx8s8yCWwQr:qN/cDnnJ4+JDoN7PPLcxnes8zn+M+
TLSH
T1A8545B0AF6A510F5D9B7C13DC952151AFE7278964760E7CB13A04E9B2F23AE09E3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

62156

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

QueryPerformanceCounter WideCharToMultiByte EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection GetSystemTimeAsFileTime GetModuleHandleW GetProcAddress EncodePointer DecodePointer MultiByteToWideChar LCMapStringEx GetStringTypeW GetCPInfo RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent GetCurrentProcessId GetCurrentThreadId InitializeSListHead IsDebuggerPresent GetStartupInfoW WriteConsoleW RtlPcToFileHeader RaiseException RtlUnwindEx GetLastError SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW ExitProcess GetModuleHandleExW GetStdHandle WriteFile GetModuleFileNameW GetCommandLineA GetCommandLineW HeapAlloc HeapFree GetFileType FlsAlloc FlsGetValue FlsSetValue FlsFree VirtualProtect CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW CloseHandle FlushFileBuffers GetConsoleOutputCP GetConsoleMode ReadFile GetFileSizeEx SetFilePointerEx ReadConsoleW HeapReAlloc FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle GetProcessHeap HeapSize CreateFileW RtlUnwind

Name

.text

Size

192KB

Virtual Size

192KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

74KB

Virtual Size

74KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

12KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-11-06_cbaeb0e83c5ab8bce93ada55e1fc3cba_cobalt-strike_icedid_luca-stealer_njrat_stealc

kernel32

generic