2026-11-10_1adde2bbabebe1f5d8b1b270287850f2_cobalt-strike_icedid_luca-stealer_njrat_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-11-10_1adde2bbabebe1f5d8b1b270287850f2_cobalt-strike_icedid_luca-stealer_njrat_stealc
Size 430KB
Sample261110-ldvaeav19r
SHA256 a8f62726784d5878a4d8777b3d9cd9113aaf11a1f6a691875292b0b23295726d
MD5 1adde2bbabebe1f5d8b1b270287850f2
SHA1 46eea7842f71dafaca83b64e79edc648de88bf40
SHA512 9bd029647592e7b6f917eb394386206089c3619a296497323b70b3679c856cd0b813072f91490b62a274c6f8b538e3dd32e0e4d50d8efbc31b044b1813eb8f99
SSDEEP 6144:/FtWBWxy1BDhthwTT4s8XyLEH8R6uLzIOIg22/Pu38:q8OBlkGcEcRln5638
TLSH
T1EA947E2AD79901FCE1A7D178CE525942DB767C0E03A1EADF07C449721E276E09E3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-11-10_1adde2bbabebe1f5d8b1b270287850f2_cobalt-strike_icedid_luca-stealer_njrat_stealc

File Explorer

2026-11-10_1adde2bbabebe1f5d8b1b270287850f2_cobalt-strike_icedid_luca-stealer_njrat_stealc

.exe 430KB

2026-11-10_1adde2bbabebe1f5d8b1b270287850f2_cobalt-strike_icedid_luca-stealer_njrat_stealc

IMPHASH 3e3137df8495c502e106da0bc256fe00
SHA256 a8f62726784d5878a4d8777b3d9cd9113aaf11a1f6a691875292b0b23295726d
MD5 1adde2bbabebe1f5d8b1b270287850f2
SHA1 46eea7842f71dafaca83b64e79edc648de88bf40
SHA512 9bd029647592e7b6f917eb394386206089c3619a296497323b70b3679c856cd0b813072f91490b62a274c6f8b538e3dd32e0e4d50d8efbc31b044b1813eb8f99
SSDEEP 6144:/FtWBWxy1BDhthwTT4s8XyLEH8R6uLzIOIg22/Pu38:q8OBlkGcEcRln5638
TLSH
T1EA947E2AD79901FCE1A7D178CE525942DB767C0E03A1EADF07C449721E276E09E3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

157316

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

winhttp

WinHttpReceiveResponse WinHttpSendRequest WinHttpOpenRequest WinHttpSetTimeouts WinHttpReadData WinHttpQueryHeaders WinHttpOpen WinHttpConnect WinHttpCloseHandle WinHttpQueryDataAvailable

ole32

CLSIDFromString CreateStreamOnHGlobal

shell32

ShellExecuteA

advapi32

RegCreateKeyExA RegCloseKey RegDeleteValueA RegOpenKeyExA RegSetValueExA GetUserNameA

user32

GetSystemMetrics ReleaseDC MessageBoxW SystemParametersInfoW GetDC

gdi32

CreateCompatibleDC DeleteDC DeleteObject CreateCompatibleBitmap SelectObject BitBlt

gdiplus

GdipAlloc GdipCreateBitmapFromHBITMAP GdipFree GdiplusStartup GdiplusShutdown GdipCloneImage GdipDisposeImage GdipSaveImageToStream

kernel32

GetACP IsValidCodePage GetOEMCP GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetProcessHeap FindNextFileW FindFirstFileExW HeapReAlloc ReadConsoleW SetStdHandle CreateFileW HeapSize WriteConsoleW SetEndOfFile LCMapStringEx SetFilePointerEx GetFileSizeEx GetConsoleMode GetConsoleOutputCP FlushFileBuffers GetFileType EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetEnvironmentVariableA CreateDirectoryA DeleteFileA FindClose FindFirstFileA FindNextFileA GetFileAttributesA ReadFile RemoveDirectoryA SetFileAttributesA GetTempPathA GetTempFileNameA CloseHandle SetHandleInformation GetLastError CreatePipe PeekNamedPipe CreateMutexA Sleep ExitProcess TerminateProcess GetExitCodeProcess CreateProcessA GlobalMemoryStatusEx GetTickCount GetTickCount64 GetComputerNameExW GetModuleFileNameA GetModuleHandleA GetProcAddress CopyFileA GetComputerNameA MultiByteToWideChar WideCharToMultiByte CreateToolhelp32Snapshot Process32FirstW Process32NextW GetCurrentThreadId EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection QueryPerformanceCounter ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW EncodePointer DecodePointer RtlUnwind GetSystemTimeAsFileTime GetModuleHandleW GetStringTypeW GetCPInfo RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent GetCurrentProcessId InitializeSListHead GetCurrentProcess GetLocaleInfoW RtlPcToFileHeader RaiseException RtlUnwindEx SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW CreateThread ExitThread FreeLibraryAndExitThread GetModuleHandleExW GetModuleFileNameW GetStdHandle WriteFile HeapFree WaitForSingleObject CreateProcessW GetFileAttributesExW HeapAlloc FlsAlloc FlsGetValue FlsSetValue FlsFree VirtualProtect CompareStringW LCMapStringW

Name

.text

Size

301KB

Virtual Size

301KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

94KB

Virtual Size

94KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

16KB

Virtual Size

22KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

13KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-11-10_1adde2bbabebe1f5d8b1b270287850f2_cobalt-strike_icedid_luca-stealer_njrat_stealc

winhttp

ole32

shell32

advapi32

user32

gdi32

gdiplus

kernel32

generic