2026-11-12_2f96c029cbb817e936425fdc44591931_cobalt-strike_icedid_luca-stealer_njrat_poet-rat

Sharing

Copy URL Twitter E-mail

General

Target
2026-11-12_2f96c029cbb817e936425fdc44591931_cobalt-strike_icedid_luca-stealer_njrat_poet-rat
Size 16.6MB
Sample261113-gpgfgagx2p
SHA256 dfbbda2711088d30a1523ca6291b9ab2e5a86ad28b2a584b2e00e7a8129b20e3
MD5 2f96c029cbb817e936425fdc44591931
SHA1 e402281f5ad9b7d249b1c5f9c6ae0320f15815d9
SHA512 df4b499027d4357cf33713ed4d27925835099a7c8091828557af4f5090289d25f578154eca22bb07495c8c40197140e03e8ea1c195ec5203efe781bbc383b4f3
SSDEEP 196608:f0wRxdgI8deOI7jJReV2kApgHdvsTFPS:fdHeqkIS
TLSH
T1BF07BE03FB4646DDD03AD43042A5B323B722B8088B3456DB1BD2AE295E67FD05E7B749
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-11-12_2f96c029cbb817e936425fdc44591931_cobalt-strike_icedid_luca-stealer_njrat_poet-rat

File Explorer

2026-11-12_2f96c029cbb817e936425fdc44591931_cobalt-strike_icedid_luca-stealer_njrat_poet-rat

.exe 16.6MB

2026-11-12_2f96c029cbb817e936425fdc44591931_cobalt-strike_icedid_luca-stealer_njrat_poet-rat

IMPHASH 1f2a6f073f34e68408b01cb9dad5b5dc
SHA256 dfbbda2711088d30a1523ca6291b9ab2e5a86ad28b2a584b2e00e7a8129b20e3
MD5 2f96c029cbb817e936425fdc44591931
SHA1 e402281f5ad9b7d249b1c5f9c6ae0320f15815d9
SHA512 df4b499027d4357cf33713ed4d27925835099a7c8091828557af4f5090289d25f578154eca22bb07495c8c40197140e03e8ea1c195ec5203efe781bbc383b4f3
SSDEEP 196608:f0wRxdgI8deOI7jJReV2kApgHdvsTFPS:fdHeqkIS
TLSH
T1BF07BE03FB4646DDD03AD43042A5B323B722B8088B3456DB1BD2AE295E67FD05E7B749
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

17760960

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

SetThreadErrorMode GetFileInformationByHandle GlobalFree DeleteFileW GetFileInformationByHandleEx HeapFree HeapAlloc FindNextFileA FindFirstFileA GlobalSize GetFullPathNameW GetModuleHandleA GetFileType DuplicateHandle CopyFileExW HeapReAlloc GetModuleHandleExW SetFilePointerEx CreateSymbolicLinkW GetFinalPathNameByHandleW FileTimeToLocalFileTime GetProcessHeap FindFirstFileExW MoveFileExW MoveFileW CopyFileW LocalFree GetProcAddress GetModuleFileNameW VirtualFreeEx VirtualQueryEx VirtualAllocEx VirtualProtect VirtualAlloc Sleep SetLastError GetLastError CloseHandle GetTempPathW SetFileInformationByHandle SetFileAttributesW RemoveDirectoryW GetFileSizeEx GetFileAttributesExW GetFileAttributesW FindNextFileW FindFirstFileW FindClose HeapSize SetEndOfFile GlobalLock SetHandleInformation FreeLibrary LoadLibraryExW GlobalAlloc SetFileTime FlushFileBuffers UnlockFile GlobalUnlock lstrcpynA K32EnumProcessModules K32EnumDeviceDrivers K32GetDeviceDriverBaseNameA

gdi32

BitBlt CreateCompatibleDC DeleteDC DeleteObject GetObjectW GetDeviceCaps GetDIBits SelectObject CreateCompatibleBitmap SetBitmapBits CreateRectRgn CreateBitmap CreateDIBitmap SetPixelFormat DescribePixelFormat SwapBuffers ChoosePixelFormat

user32

CloseClipboard SetClipboardData OpenClipboard ValidateRect CountClipboardFormats EnumClipboardFormats EnumDisplayMonitors MonitorFromPoint GetClipboardData GetClipboardFormatNameW MonitorFromRect ScreenToClient IsClipboardFormatAvailable MonitorFromWindow GetMonitorInfoW RedrawWindow ClientToScreen ChangeDisplaySettingsExW InvalidateRgn GetDC RegisterClipboardFormatW ReleaseDC EmptyClipboard GetKeyboardLayout MapVirtualKeyExW AdjustWindowRectEx GetWindowLongW SetWindowLongW SetWindowTextW GetWindowTextLengthW SendInput MapVirtualKeyW CreateWindowExW RegisterClassExW TrackPopupMenu SetMenuDefaultItem EnableMenuItem GetSystemMenu GetWindowRect CloseTouchInputHandle GetTouchInputInfo TrackMouseEvent SetCapture DefWindowProcW SetWindowLongPtrW GetMenu ReleaseCapture GetCursorPos CreateIconFromResourceEx GetWindowLongPtrW TranslateMessage DispatchMessageW DestroyWindow GetForegroundWindow SetCursorPos GetActiveWindow FlashWindowEx SetWindowPlacement GetWindowPlacement GetKeyboardState CreateIcon GetClipCursor ClipCursor PeekMessageW SetCursor LoadCursorW SetWindowPos PostMessageW GetClientRect LoadImageW DestroyIcon LoadIconW GetWindowThreadProcessId SetClassLongPtrW IsWindowVisible SendMessageW EnumWindows FindWindowW MessageBoxA GetWindowTextW SetForegroundWindow GetSystemMetrics ShowWindow wsprintfA ShowCursor GetRawInputDeviceInfoW CreateIconIndirect SystemParametersInfoA ToUnicode SetWindowDisplayAffinity RegisterWindowMessageA DestroyCursor GetKeyState RegisterTouchWindow GetAsyncKeyState IsProcessDPIAware MsgWaitForMultipleObjectsEx GetRawInputData SetPropW GetPropW CallWindowProcW RemovePropW GetClassNameW GetClassInfoExW ToUnicodeEx RegisterRawInputDevices IsIconic

api-ms-win-core-synch-l1-2-0

WakeByAddressAll WaitOnAddress WakeAllConditionVariable WakeConditionVariable InitOnceExecuteOnce WakeByAddressSingle SleepConditionVariableSRW

ntdll

RtlPcToFileHeader NtCreateNamedPipeFile NtCreateFile NtOpenFile NtWriteFile RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext NtSetInformationFile NtReadFile RtlUnwindEx RtlNtStatusToDosError RtlUnwind

userenv

GetUserProfileDirectoryW

bcryptprimitives

ProcessPrng

ole32

CoInitializeEx CoCreateGuid PropVariantCopy RevokeDragDrop OleInitialize RegisterDragDrop PropVariantClear CoUninitialize CoCreateInstance

shell32

DragFinish DragQueryFileW ShellExecuteW ShellExecuteExW ShellExecuteA

shlwapi

AssocQueryStringW

api-ms-win-core-path-l1-1-0

PathCchStripPrefix

oleaut32

SysFreeString SysAllocStringLen SysStringLen SetErrorInfo SafeArrayPutElement SafeArrayCreateVector VariantClear GetErrorInfo VariantCopy

winhttp

WinHttpOpen WinHttpSetTimeouts WinHttpConnect WinHttpOpenRequest WinHttpSendRequest WinHttpReceiveResponse WinHttpCloseHandle WinHttpReadData WinHttpQueryHeaders

ws2_32

listen bind getsockname GetHostNameW getpeername shutdown freeaddrinfo WSARecv sendto WSASend connect WSAStartup WSACleanup WSCUnInstallNameSpace select closesocket getaddrinfo WSAGetLastError setsockopt recvfrom getsockopt send ioctlsocket WSADuplicateSocketW accept WSASocketW recv

advapi32

RegCloseKey SetSecurityDescriptorDacl InitializeSecurityDescriptor GetTokenInformation AdjustTokenPrivileges OpenProcessToken RegOpenKeyExA RegOpenKeyExW RegQueryValueExA RegQueryValueExW CloseServiceHandle OpenSCManagerW OpenServiceW QueryServiceStatusEx ConvertSidToStringSidA RegDeleteValueW ControlService CreateServiceW StartServiceW ImpersonateAnonymousToken RevertToSelf LookupPrivilegeValueW

bcrypt

BCryptGenRandom BCryptExportKey BCryptSecretAgreement BCryptDestroySecret BCryptSetProperty BCryptCloseAlgorithmProvider BCryptEncrypt BCryptDeriveKey BCryptGenerateKeyPair BCryptGenerateSymmetricKey BCryptFinalizeKeyPair BCryptImportKeyPair BCryptDestroyHash BCryptOpenAlgorithmProvider BCryptDecrypt BCryptDestroyKey BCryptCreateHash BCryptHashData BCryptFinishHash

setupapi

SetupDiCreateDeviceInfoW SetupDiGetDeviceInstanceIdW SetupDiEnumDeviceInfo SetupDiDestroyDeviceInfoList SetupDiGetClassDevsW SetupDiCallClassInstaller SetupDiSetClassInstallParamsW SetupDiCreateDeviceInfoList SetupDiSetDeviceRegistryPropertyW

cabinet

ord40 ord45 ord43

api-ms-win-core-winrt-error-l1-1-0

RoOriginateErrorW

api-ms-win-core-processenvironment-l1-1-0

GetCommandLineA FreeEnvironmentStringsW GetEnvironmentStringsW ExpandEnvironmentStringsW SetEnvironmentVariableW SetCurrentDirectoryW SetEnvironmentVariableA GetEnvironmentVariableW GetEnvironmentVariableA GetStdHandle SetStdHandle GetCurrentDirectoryW GetCommandLineW

api-ms-win-core-file-l1-1-0

CreateDirectoryW CreateDirectoryA ReadFile WriteFile CreateFileW ReadFileEx WriteFileEx LockFileEx CreateFileA

api-ms-win-core-debug-l1-1-0

IsDebuggerPresent OutputDebugStringW

api-ms-win-core-debug-l1-1-1

CheckRemoteDebuggerPresent

api-ms-win-core-errorhandling-l1-1-0

SetUnhandledExceptionFilter UnhandledExceptionFilter RaiseException

api-ms-win-core-namedpipe-l1-1-0

ConnectNamedPipe CreatePipe CreateNamedPipeW

api-ms-win-core-synch-l1-1-0

InitializeCriticalSectionEx EnterCriticalSection SetWaitableTimer CreateWaitableTimerExW LeaveCriticalSection CreateMutexA DeleteCriticalSection SetEvent CreateEventW WaitForSingleObjectEx ReleaseSRWLockExclusive AcquireSRWLockExclusive InitializeCriticalSectionAndSpinCount SleepEx CreateSemaphoreExW ReleaseMutex WaitForSingleObject CreateEventExW TryAcquireSRWLockExclusive CreateMutexW

api-ms-win-core-processthreads-l1-1-0

TlsGetValue ExitProcess SetThreadStackGuarantee SwitchToThread GetProcessId CreateThread TlsSetValue TlsFree ExitThread UpdateProcThreadAttribute ResumeThread GetStartupInfoW GetExitCodeThread CreateProcessW TlsAlloc FlushProcessWriteBuffers InitializeProcThreadAttributeList GetCurrentThreadId GetCurrentThread DeleteProcThreadAttributeList CreateRemoteThread GetExitCodeProcess TerminateProcess GetCurrentProcess GetCurrentProcessId

api-ms-win-core-processthreads-l1-1-1

OpenProcess GetCurrentProcessorNumber IsProcessorFeaturePresent

api-ms-win-core-sysinfo-l1-1-0

GetTickCount GetTickCount64 GetSystemTimeAsFileTime GetSystemDirectoryW GetWindowsDirectoryW GetSystemInfo

api-ms-win-core-memory-l1-1-0

ReadProcessMemory WriteProcessMemory

api-ms-win-core-libraryloader-l1-2-1

LoadLibraryW LoadLibraryA

api-ms-win-core-string-obsolete-l1-1-0

lstrcatW lstrcpynW lstrlenW

api-ms-win-core-psapi-l1-1-0

K32GetModuleBaseNameW QueryFullProcessImageNameW

api-ms-win-core-string-l1-1-0

GetStringTypeW MultiByteToWideChar WideCharToMultiByte CompareStringOrdinal CompareStringW

api-ms-win-core-console-l1-1-0

GetConsoleOutputCP ReadConsoleW AllocConsole SetConsoleMode GetConsoleMode SetConsoleCtrlHandler WriteConsoleW

api-ms-win-core-console-l1-2-0

FreeConsole AttachConsole

api-ms-win-core-console-l2-2-0

SetConsoleTitleA

api-ms-win-core-toolhelp-l1-1-0

Process32FirstW Process32NextW CreateToolhelp32Snapshot

crypt32

CryptUnprotectData CryptProtectData CryptStringToBinaryA CryptBinaryToStringA

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleW FreeLibraryAndExitThread LoadLibraryExA

api-ms-win-core-io-l1-1-0

DeviceIoControl GetOverlappedResult

api-ms-win-core-sysinfo-l1-2-1

GetPhysicallyInstalledSystemMemory

api-ms-win-core-timezone-l1-1-0

FileTimeToSystemTime

api-ms-win-core-file-l2-1-0

CreateHardLinkW

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter QueryPerformanceFrequency

api-ms-win-core-sysinfo-l1-2-0

GetSystemTimePreciseAsFileTime GetNativeSystemInfo

api-ms-win-core-io-l1-1-1

CancelIo

api-ms-win-core-errorhandling-l1-1-1

AddVectoredExceptionHandler

api-ms-win-core-fibers-l1-1-0

FlsSetValue FlsAlloc FlsFree FlsGetValue

api-ms-win-core-fibers-l1-1-1

IsThreadAFiber

api-ms-win-core-localization-l1-2-0

LCMapStringW GetLocaleInfoW GetOEMCP GetACP FormatMessageA IsValidCodePage FormatMessageW GetCPInfo GetLocaleInfoEx GetUserDefaultLCID EnumSystemLocalesW IsValidLocale

api-ms-win-core-synch-l1-2-1

WaitForMultipleObjects

ext-ms-win-uiacore-l1-1-1

UiaRaiseAutomationEvent UiaGetReservedNotSupportedValue UiaRaiseAutomationPropertyChangedEvent

ext-ms-win-uiacore-l1-1-0

UiaHostProviderFromHwnd UiaReturnRawElementProvider

propsys

VariantToInt16 VariantToUInt32 PropVariantToUInt32 VariantToInt32 PropVariantToInt32 VariantToUInt64 VariantToDouble VariantToUInt16 PropVariantToUInt16 PropVariantToDouble PropVariantToBoolean PropVariantToVariant PropVariantCompareEx VariantToPropVariant PropVariantToBSTR PropVariantToInt16 VariantToBoolean PropVariantToInt64 VariantToInt64 PropVariantToUInt64

opengl32

wglGetCurrentContext wglShareLists wglGetCurrentDC wglDeleteContext wglCreateContext wglGetProcAddress wglMakeCurrent

dwmapi

DwmEnableBlurBehindWindow DwmSetWindowAttribute

uxtheme

SetWindowTheme

imm32

ImmSetCandidateWindow ImmAssociateContextEx ImmSetCompositionWindow ImmGetCompositionStringW ImmGetContext ImmReleaseContext

uiautomationcore

UiaLookupId

api-ms-win-core-threadpool-l1-2-0

WaitForThreadpoolTimerCallbacks CloseThreadpoolTimer CreateThreadpoolWait SetThreadpoolWait CloseThreadpoolWait SetThreadpoolTimer CreateThreadpoolTimer FreeLibraryWhenCallbackReturns

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead InterlockedPushEntrySList InterlockedFlushSList

api-ms-win-core-util-l1-1-0

EncodePointer

api-ms-win-core-datetime-l1-1-0

GetTimeFormatW GetDateFormatW

Name

.text

Size

8.5MB

Virtual Size

8.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

7.3MB

Virtual Size

7.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

24KB

Virtual Size

352KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

165KB

Virtual Size

164KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

36KB

Virtual Size

35KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.00cfg

Size

512B

Virtual Size

373B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

1024B

Virtual Size

563B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

278KB

Virtual Size

278KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

68KB

Virtual Size

67KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.text1

Size

217KB

Virtual Size

216KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata1

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.data1

Size

1024B

Virtual Size

960B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-11-12_2f96c029cbb817e936425fdc44591931_cobalt-strike_icedid_luca-stealer_njrat_poet-rat

kernel32

gdi32

user32

api-ms-win-core-synch-l1-2-0

ntdll

userenv

bcryptprimitives

ole32

shell32

shlwapi

api-ms-win-core-path-l1-1-0

oleaut32

winhttp

ws2_32

advapi32

bcrypt

setupapi

cabinet

api-ms-win-core-winrt-error-l1-1-0

api-ms-win-core-processenvironment-l1-1-0

api-ms-win-core-file-l1-1-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-debug-l1-1-1

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-namedpipe-l1-1-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-processthreads-l1-1-1

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-memory-l1-1-0

api-ms-win-core-libraryloader-l1-2-1

api-ms-win-core-string-obsolete-l1-1-0

api-ms-win-core-psapi-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-console-l1-1-0

api-ms-win-core-console-l1-2-0

api-ms-win-core-console-l2-2-0

api-ms-win-core-toolhelp-l1-1-0

crypt32

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-io-l1-1-0

api-ms-win-core-sysinfo-l1-2-1

api-ms-win-core-timezone-l1-1-0

api-ms-win-core-file-l2-1-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-sysinfo-l1-2-0

api-ms-win-core-io-l1-1-1

api-ms-win-core-errorhandling-l1-1-1

api-ms-win-core-fibers-l1-1-0

api-ms-win-core-fibers-l1-1-1

api-ms-win-core-localization-l1-2-0

api-ms-win-core-synch-l1-2-1

ext-ms-win-uiacore-l1-1-1

ext-ms-win-uiacore-l1-1-0

propsys

opengl32

dwmapi

uxtheme

imm32

uiautomationcore

api-ms-win-core-threadpool-l1-2-0

api-ms-win-core-interlocked-l1-1-0

api-ms-win-core-util-l1-1-0

api-ms-win-core-datetime-l1-1-0

generic