2026-05-29_a3b4ac727f32f0d5ac33c9524d3a08dd_icedid_luca-stealer_njrat_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-05-29_a3b4ac727f32f0d5ac33c9524d3a08dd_icedid_luca-stealer_njrat_stealc
Size 1.3MB
Sample260529-2ms2psbt4s
SHA256 64816eac12fc92edeb2965e689bb241c1c0ccc98cdf768326bb0f7380b986570
MD5 a3b4ac727f32f0d5ac33c9524d3a08dd
SHA1 ce3cae2ed644e3b532a019c8237cbdbcf9db1b75
SHA512 65a04435c2850cfbc34a8490f2499d9960d35c68f47e7f74497c82de95fa86e66df7e2ece69e7a857effaf12ed73c52e3949052fe323ed99aa9545953fd1141f
SSDEEP 24576:0YPCE217VujGGkRIQcijwStTnFh0lhSMXlBbXJ1Xo16pQo3DlN4E7fem:0YPCE217Vuj/kRIQcijxyBXJUW3X4yf
TLSH
T1F255D055A7E540E9D132C1398A574B0CFBB2B8E8435597CF03A08166EF279ED2D3E392
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-05-29_a3b4ac727f32f0d5ac33c9524d3a08dd_icedid_luca-stealer_njrat_stealc

File Explorer

2026-05-29_a3b4ac727f32f0d5ac33c9524d3a08dd_icedid_luca-stealer_njrat_stealc

.exe 1.3MB

2026-05-29_a3b4ac727f32f0d5ac33c9524d3a08dd_icedid_luca-stealer_njrat_stealc

IMPHASH 63fee4abc83bb74bd8ac299981c247ce
SHA256 64816eac12fc92edeb2965e689bb241c1c0ccc98cdf768326bb0f7380b986570
MD5 a3b4ac727f32f0d5ac33c9524d3a08dd
SHA1 ce3cae2ed644e3b532a019c8237cbdbcf9db1b75
SHA512 65a04435c2850cfbc34a8490f2499d9960d35c68f47e7f74497c82de95fa86e66df7e2ece69e7a857effaf12ed73c52e3949052fe323ed99aa9545953fd1141f
SSDEEP 24576:0YPCE217VujGGkRIQcijwStTnFh0lhSMXlBbXJ1Xo16pQo3DlN4E7fem:0YPCE217Vuj/kRIQcijxyBXJUW3X4yf
TLSH
T1F255D055A7E540E9D132C1398A574B0CFBB2B8E8435597CF03A08166EF279ED2D3E392
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

262220

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Projects\SoundEdge\APO\SNAPOSystemService\x64\Release\SNAPOSS64.exe.pdb

rpcrt4

NdrServerCall2 RpcBindingVectorFree RpcServerListen RpcServerInqBindings RpcServerUseProtseqEpW NdrServerCallAll

kernel32

WaitForSingleObject CloseHandle CreateThreadpoolWork SubmitThreadpoolWork LocalAlloc GetCurrentProcess CreateEventW Sleep GetLastError SetEvent GetTickCount64 LocalFree CreateThread ResumeThread GetCurrentThreadId GetModuleHandleW IsWow64Process GetWindowsDirectoryW LCMapStringW WriteConsoleW HeapSize HeapReAlloc ReadConsoleW GetConsoleMode CompareStringW GetConsoleOutputCP GetProcessId FlushFileBuffers SetFilePointerEx GetFileSizeEx SetStdHandle OutputDebugStringW GetProcessHeap SetEnvironmentVariableW WaitForMultipleObjects FreeEnvironmentStringsW GetCurrentThread InitializeCriticalSectionEx CreateNamedPipeA CancelIoEx GetOverlappedResult ResetEvent ConnectNamedPipe DisconnectNamedPipe ReadFile WriteFile GetLocaleInfoW WTSGetActiveConsoleSessionId LoadLibraryW GetProcAddress GetEnvironmentStringsW RtlUnwind GetOEMCP FreeLibrary CreateProcessW GetACP SetLastError IsValidCodePage GetModuleFileNameW IsValidLocale EnumSystemLocalesW WaitForSingleObjectEx ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime InitializeSListHead TryAcquireSRWLockExclusive MultiByteToWideChar FormatMessageA WideCharToMultiByte GetStringTypeW GetExitCodeThread CreateFileW FindClose FindFirstFileW FindFirstFileExW FindNextFileW GetFileAttributesExW AreFileApisANSI GetFileInformationByHandleEx GetLocaleInfoEx QueryPerformanceFrequency WakeConditionVariable EncodePointer DecodePointer EnterCriticalSection LeaveCriticalSection DeleteCriticalSection LCMapStringEx GetCPInfo RtlUnwindEx RtlPcToFileHeader RaiseException InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW ExitProcess GetModuleHandleExW ExitThread FreeLibraryAndExitThread GetStdHandle GetCommandLineA GetCommandLineW HeapFree HeapAlloc GetFileType FlsAlloc FlsGetValue FlsSetValue FlsFree VirtualProtect GetUserDefaultLCID

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

advapi32

EventUnregister RegQueryValueExA CreateProcessAsUserW GetTokenInformation OpenProcessToken FreeSid CreateServiceW EventWriteString OpenSCManagerW OpenServiceW ControlService SetServiceStatus QueryServiceStatus EventRegister DeleteService CloseServiceHandle RegisterServiceCtrlHandlerExW GetSecurityInfo SetEntriesInAclW SetSecurityInfo RegDeleteTreeW RegCloseKey StartServiceCtrlDispatcherW EqualSid RegSetValueExW RegDeleteValueA RegSetValueExA SetSecurityDescriptorDacl InitializeSecurityDescriptor AllocateAndInitializeSid RegOpenKeyExA RegCreateKeyExA

ole32

CoUninitialize CoInitializeEx CoCreateGuid CoCreateInstance PropVariantClear

user32

DefWindowProcW GetWindowLongPtrW PostMessageW PostQuitMessage GetClassInfoW SetWindowLongPtrW DispatchMessageW TranslateMessage GetMessageW CreateWindowExW RegisterClassW

wtsapi32

WTSRegisterSessionNotification WTSUnRegisterSessionNotification

userenv

DestroyEnvironmentBlock CreateEnvironmentBlock

Name

.text

Size

431KB

Virtual Size

431KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

242KB

Virtual Size

242KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

74KB

Virtual Size

100KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

30KB

Virtual Size

29KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.msvcjmc

Size

512B

Virtual Size

464B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

576KB

Virtual Size

580KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-05-29_a3b4ac727f32f0d5ac33c9524d3a08dd_icedid_luca-stealer_njrat_stealc

rpcrt4

kernel32

version

advapi32

ole32

user32

wtsapi32

userenv

generic