2026-11-06_ead60dc0548031bc23fd387b6b6e1e7d_cobalt-strike_icedid_luca-stealer_njrat_stealc

General

Target
2026-11-06_ead60dc0548031bc23fd387b6b6e1e7d_cobalt-strike_icedid_luca-stealer_njrat_stealc
Size 318KB
Sample261107-yhszcsga49
SHA256 7487224acd23ce36c81e0eb0dc6fae6a4ddafd7fbbb2ee332692b3489fbb5a18
MD5 ead60dc0548031bc23fd387b6b6e1e7d
SHA1 43001cd34d98b657cdf86b4fdc096184075cf776
SHA512 69a16c6828472fe80130ae5d3f6a2d08959047bc7005551be2586cab50780325a2eaf12e5adc543f71554f57177539520a23e60e9af448613bbced0f57bdfcd8
SSDEEP 6144:UG1EWDLXmbUceYsNhemAVLnzvYWuC8YJV:N1dLXnRNhg
TLSH
T1C164284EE66600E4ECBAC13C8591261ABB71BC614325D7DBA7E066171F336E09D3FB60
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-11-06_ead60dc0548031bc23fd387b6b6e1e7d_cobalt-strike_icedid_luca-stealer_njrat_stealc

File Explorer

2026-11-06_ead60dc0548031bc23fd387b6b6e1e7d_cobalt-strike_icedid_luca-stealer_njrat_stealc

.exe 318KB

2026-11-06_ead60dc0548031bc23fd387b6b6e1e7d_cobalt-strike_icedid_luca-stealer_njrat_stealc

IMPHASH b536288b2ed516e4ea5e18d79a1c782f
SHA256 7487224acd23ce36c81e0eb0dc6fae6a4ddafd7fbbb2ee332692b3489fbb5a18
MD5 ead60dc0548031bc23fd387b6b6e1e7d
SHA1 43001cd34d98b657cdf86b4fdc096184075cf776
SHA512 69a16c6828472fe80130ae5d3f6a2d08959047bc7005551be2586cab50780325a2eaf12e5adc543f71554f57177539520a23e60e9af448613bbced0f57bdfcd8
SSDEEP 6144:UG1EWDLXmbUceYsNhemAVLnzvYWuC8YJV:N1dLXnRNhg
TLSH
T1C164284EE66600E4ECBAC13C8591261ABB71BC614325D7DBA7E066171F336E09D3FB60
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

89036

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW GetModuleHandleW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead WriteConsoleW RtlPcToFileHeader RaiseException RtlUnwindEx GetLastError SetLastError EncodePointer EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary GetProcAddress LoadLibraryExW ExitProcess GetModuleHandleExW GetModuleFileNameW GetStdHandle WriteFile GetCommandLineA GetCommandLineW HeapAlloc HeapFree FlsAlloc FlsGetValue FlsSetValue FlsFree InitializeCriticalSectionEx VirtualProtect CompareStringW LCMapStringW GetFileType GetFileSizeEx SetFilePointerEx FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetProcessHeap SetStdHandle GetStringTypeW FlushFileBuffers GetConsoleOutputCP GetConsoleMode HeapSize HeapReAlloc CloseHandle CreateFileW RtlUnwind

Name

.text

Size

180KB

Virtual Size

179KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

119KB

Virtual Size

119KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

8KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-11-06_ead60dc0548031bc23fd387b6b6e1e7d_cobalt-strike_icedid_luca-stealer_njrat_stealc

kernel32

generic