2026-05-08_840bcc152e55fe61ec7902ec84c51e76_icedid_luca-stealer_njrat_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-05-08_840bcc152e55fe61ec7902ec84c51e76_icedid_luca-stealer_njrat_stealc
Size 1.1MB
Sample260508-ylj6mac13x
SHA256 642a792cc1e49c6364fdc7688c66a0fd389058dfb7b43f69b0e72907ddbf8c95
MD5 840bcc152e55fe61ec7902ec84c51e76
SHA1 bece1f734b7d6b9716dc19c7b3e6fc1bc66b0294
SHA512 9b3734af15a5207fdee225e3ea191ca20d9245f2d8853a2af277b8aeffea7559433e45fe01ea23018c5cb5636aea54b628e630e5ad088529846213147a073f40
SSDEEP 24576:jyZdBLudXCeCPar3+e9Gqi5lNlaV1tO552j4GyID:I3Lu1ePFqiJlaUaPyI
TLSH
T141358D46F69901FDD07BD078CA968617EB7278160314AADB43A1CBA53F27AE44F3D312
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-05-08_840bcc152e55fe61ec7902ec84c51e76_icedid_luca-stealer_njrat_stealc

File Explorer

2026-05-08_840bcc152e55fe61ec7902ec84c51e76_icedid_luca-stealer_njrat_stealc

.exe 1.1MB

2026-05-08_840bcc152e55fe61ec7902ec84c51e76_icedid_luca-stealer_njrat_stealc

IMPHASH ff6dbff11e8b49fa0fa20d14478d68df
SHA256 642a792cc1e49c6364fdc7688c66a0fd389058dfb7b43f69b0e72907ddbf8c95
MD5 840bcc152e55fe61ec7902ec84c51e76
SHA1 bece1f734b7d6b9716dc19c7b3e6fc1bc66b0294
SHA512 9b3734af15a5207fdee225e3ea191ca20d9245f2d8853a2af277b8aeffea7559433e45fe01ea23018c5cb5636aea54b628e630e5ad088529846213147a073f40
SSDEEP 24576:jyZdBLudXCeCPar3+e9Gqi5lNlaV1tO552j4GyID:I3Lu1ePFqiJlaUaPyI
TLSH
T141358D46F69901FDD07BD078CA968617EB7278160314AADB43A1CBA53F27AE44F3D312
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

983040

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

comctl32

InitCommonControlsEx

shell32

CommandLineToArgvW ShellExecuteExW SHGetKnownFolderPath SHGetFolderPathW

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

winhttp

WinHttpSetOption WinHttpQueryHeaders WinHttpConnect WinHttpCrackUrl WinHttpQueryDataAvailable WinHttpOpenRequest WinHttpReadData WinHttpOpen WinHttpSendRequest WinHttpReceiveResponse WinHttpCloseHandle

wintrust

WinVerifyTrust

kernel32

GetStringTypeW ReadFile CreateFileW CloseHandle WriteFile WaitForSingleObject GetLastError CreateDirectoryW FindFirstFileW FindClose GetCurrentDirectoryW LocalFree CopyFileW GetFileSize GetFileSizeEx SetLastError GetFullPathNameW RemoveDirectoryW GetModuleFileNameW WaitForMultipleObjects GetTempPathW CreateMutexW GetFileAttributesW ReleaseMutex OpenProcess CreateEventW MultiByteToWideChar SetEvent DeleteFileW CreateThread K32EnumProcesses SetCurrentDirectoryW MoveFileExW ExitProcess IsValidCodePage CreateProcessW WideCharToMultiByte VerifyVersionInfoW QueryFullProcessImageNameW GetTempFileNameW OpenMutexW MoveFileW GetExitCodeProcess EnterCriticalSection LeaveCriticalSection DeleteCriticalSection WakeAllConditionVariable LCMapStringW FlsFree FlsSetValue FlsGetValue FlsAlloc GetFileType HeapFree HeapAlloc GetStdHandle GetCPInfo LoadLibraryExW FreeLibrary TlsFree GetACP GetOEMCP GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW GetProcessHeap SetStdHandle FlushFileBuffers GetConsoleOutputCP GetConsoleMode HeapSize HeapReAlloc WriteConsoleW SetFilePointerEx VerSetConditionMask RtlPcToFileHeader RaiseException GetCurrentThreadId IsProcessorFeaturePresent FreeLibraryWhenCallbackReturns CreateThreadpoolWork SubmitThreadpoolWork CloseThreadpoolWork GetModuleHandleExW FormatMessageA GetLocaleInfoEx InitOnceComplete InitOnceBeginInitialize FindFirstFileExW FindNextFileW GetFileAttributesExW SetFileInformationByHandle AreFileApisANSI GetModuleHandleW GetProcAddress GetFileInformationByHandleEx ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive SleepConditionVariableSRW QueryPerformanceCounter InitializeCriticalSectionEx GetSystemTimeAsFileTime RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsDebuggerPresent GetStartupInfoW GetCurrentProcessId InitializeSListHead RtlUnwindEx EncodePointer InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue

user32

SetWindowLongPtrW SendMessageW GetWindowLongPtrW ShowWindow DispatchMessageW IsDialogMessageW SetDlgItemTextW TranslateMessage LoadIconW GetDlgItem PostQuitMessage SetForegroundWindow EnableWindow SendDlgItemMessageW AllowSetForegroundWindow CreateDialogParamW GetMessageW MessageBoxW

ole32

CoTaskMemFree

advapi32

SetEntriesInAclW CryptAcquireContextW CryptGenRandom AllocateAndInitializeSid RegSetValueExA FreeSid CheckTokenMembership RegOpenKeyExA RegCloseKey CryptReleaseContext RegCreateKeyExW SetNamedSecurityInfoW GetNamedSecurityInfoW ConvertStringSidToSidW RegSetValueExW RegOpenKeyExW RegDeleteValueW RegQueryValueExW

Name

.text

Size

682KB

Virtual Size

682KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

126KB

Virtual Size

125KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

10KB

Virtual Size

17KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

20KB

Virtual Size

20KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

95KB

Virtual Size

95KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.rcd7cb

Size

120KB

Virtual Size

120KB

Characteristics

IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-05-08_840bcc152e55fe61ec7902ec84c51e76_icedid_luca-stealer_njrat_stealc

comctl32

shell32

version

winhttp

wintrust

kernel32

user32

ole32

advapi32

generic