2026-06-02_6a10e49b55b6d133d9b934b715ce9efb_icedid_luca-stealer_njrat_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-06-02_6a10e49b55b6d133d9b934b715ce9efb_icedid_luca-stealer_njrat_stealc
Size 1.3MB
Sample260602-cys4eaby8z
SHA256 277c44e1c18002b4fe51c0ba195b9ca67083023e18cb4c5e5f37319612685481
MD5 6a10e49b55b6d133d9b934b715ce9efb
SHA1 9ff8bfc6cc19b253c96b217eeba4f71ddff33ef7
SHA512 a1bb016ccc6a0508c592d70304e2b1facc222630ca62f74e73b4f9baffe4690ef7aebad1dab779352c8868beb625e88afba28955f7463790b7d668b4d40c8ac3
SSDEEP 24576:NPjjWXU8L4z+aKMv8SKkHNryYvty5JYubykU3WjhR+:ZHWkfz+aKMv8SKKuYvty5J1byvuhR
TLSH
T1255517D455B905ACE066D97C8A91CC8AE5EB7C0C033D7AFB02B036591F3EBE50A79E11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-06-02_6a10e49b55b6d133d9b934b715ce9efb_icedid_luca-stealer_njrat_stealc

File Explorer

2026-06-02_6a10e49b55b6d133d9b934b715ce9efb_icedid_luca-stealer_njrat_stealc

.exe 1.3MB

2026-06-02_6a10e49b55b6d133d9b934b715ce9efb_icedid_luca-stealer_njrat_stealc

IMPHASH cd55a13e434889f869dc6f36fe329f82
SHA256 277c44e1c18002b4fe51c0ba195b9ca67083023e18cb4c5e5f37319612685481
MD5 6a10e49b55b6d133d9b934b715ce9efb
SHA1 9ff8bfc6cc19b253c96b217eeba4f71ddff33ef7
SHA512 a1bb016ccc6a0508c592d70304e2b1facc222630ca62f74e73b4f9baffe4690ef7aebad1dab779352c8868beb625e88afba28955f7463790b7d668b4d40c8ac3
SSDEEP 24576:NPjjWXU8L4z+aKMv8SKkHNryYvty5JYubykU3WjhR+:ZHWkfz+aKMv8SKKuYvty5J1byvuhR
TLSH
T1255517D455B905ACE066D97C8A91CC8AE5EB7C0C033D7AFB02B036591F3EBE50A79E11
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

649312

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

c:\pl\output\ProcessGovernor.pdb

wtsapi32

WTSQuerySessionInformationW WTSFreeMemory

kernel32

GetTickCount64 SetEvent FileTimeToSystemTime GetCurrentThread TerminateThread DeleteFileW LoadLibraryW CreateThread ResetEvent FileTimeToLocalFileTime GetCurrentDirectoryW SetThreadPriorityBoost GetProcAddress GetFileSize ExitProcess GetComputerNameW GetCurrentProcessId CreateProcessW SetThreadExecutionState GetModuleHandleW FreeLibrary GetSystemTime GetTickCount GetProcessTimes SetUnhandledExceptionFilter GlobalMemoryStatusEx FindFirstChangeNotificationW FindCloseChangeNotification FindNextChangeNotification CreateEventW OpenProcess ReleaseMutex GetVersionExW OpenEventW GetDateFormatEx CreateMutexW SetEndOfFile SetFilePointer InitializeCriticalSection SetThreadPriority SetProcessShutdownParameters WaitForMultipleObjects GetProcessAffinityMask GetTimeFormatEx WriteFile SetProcessAffinityMask GetCurrentProcess GetCommandLineW SetPriorityClass ReadFile CreateDirectoryW SetProcessPriorityBoost GetSystemInfo CloseHandle MultiByteToWideChar GetFileAttributesW InitializeCriticalSectionAndSpinCount GetFileTime GetSystemTimeAsFileTime VerifyVersionInfoW GetProcessHeap VerSetConditionMask DeleteCriticalSection GetActiveProcessorGroupCount GetActiveProcessorCount CreateToolhelp32Snapshot Thread32First Thread32Next OpenThread SetThreadGroupAffinity FormatMessageW GetProcessGroupAffinity GetPriorityClass SetProcessWorkingSetSize TerminateProcess LocalFree WideCharToMultiByte FindClose FindNextFileW GetLocalTime HeapDestroy GetLogicalProcessorInformationEx GetNumaHighestNodeNumber GetHandleInformation EnterCriticalSection LeaveCriticalSection GetUserDefaultUILanguage GetModuleFileNameW GetStartupInfoW ProcessIdToSessionId SetLastError GetVolumeNameForVolumeMountPointW MoveFileW GetSystemDirectoryW GlobalAlloc GlobalLock GlobalUnlock GetProcessPriorityBoost ResumeThread OpenMutexW K32GetModuleBaseNameW GetDateFormatW GetTimeFormatW GetCurrentThreadId SuspendThread GetExitCodeThread MoveFileExW FlushFileBuffers LocalAlloc MulDiv LocalLock LocalUnlock ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive WaitForSingleObjectEx LoadLibraryExW GetStringTypeW QueryPerformanceCounter EncodePointer WakeAllConditionVariable SleepConditionVariableSRW CompareStringEx GetCPInfo LCMapStringEx GetLocaleInfoEx IsDebuggerPresent OutputDebugStringW RaiseException RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter IsProcessorFeaturePresent InitializeSListHead RtlUnwindEx RtlPcToFileHeader TlsAlloc TlsGetValue TlsSetValue TlsFree ExitThread FreeLibraryAndExitThread GetModuleHandleExW GetStdHandle GetCommandLineA GetFileType FlsAlloc FlsGetValue FlsSetValue FlsFree VirtualProtect CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetFileSizeEx SetFilePointerEx GetTimeZoneInformation FindFirstFileExW IsValidCodePage GetACP GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle GetConsoleOutputCP GetConsoleMode WriteConsoleW DecodePointer HeapAlloc FindResourceW LoadResource Sleep FindResourceExW HeapReAlloc LockResource GetLastError HeapSize CreateFileW WaitForSingleObject InitializeCriticalSectionEx HeapFree SizeofResource

user32

SetRect GetActiveWindow GetLastActivePopup MessageBeep BeginPaint DrawIcon EndPaint GetSysColor GetDialogBaseUnits SystemParametersInfoW DrawTextW LoadIconW DestroyIcon FillRect EnableMenuItem GetSystemMenu SetFocus SetForegroundWindow MoveWindow GetParent SetTimer KillTimer WinHelpW RedrawWindow GetAsyncKeyState CreateDialogIndirectParamW PeekMessageW IsDialogMessageW TranslateMessage DispatchMessageW SetWindowLongPtrW PostQuitMessage DestroyWindow GetDlgItem SetWindowTextW GetWindowTextW SendMessageW GetSystemMetrics GetClientRect LoadStringW PostMessageW EnumWindows IsWindowVisible GetWindow wvsprintfW GetClassNameW GetWindowLongPtrW GetWindowRect EnableWindow CloseClipboard SetClipboardData CheckDlgButton EmptyClipboard OpenClipboard GetWindowThreadProcessId GetLastInputInfo GetForegroundWindow MessageBoxW SetWindowPos WaitMessage IsWindow

advapi32

LookupAccountSidW EnumServicesStatusExW StartServiceW ControlService QueryServiceStatus GetUserNameW InitializeSecurityDescriptor SetSecurityDescriptorDacl QueryServiceConfigW CloseServiceHandle OpenServiceW OpenSCManagerW RegEnumKeyExW RegQueryInfoKeyW RegDeleteKeyW OpenProcessToken LookupPrivilegeValueW AdjustTokenPrivileges RegOpenKeyExW GetSidSubAuthority RegCreateKeyExW RegDeleteValueW RegCloseKey RegQueryValueExW RegSetValueExW GetTokenInformation RegEnumValueW GetSidSubAuthorityCount

shell32

SHCreateDirectoryExW ShellExecuteW ShellExecuteExW SHGetSpecialFolderPathW

oleaut32

VariantClear VariantInit SysAllocString SysFreeString

shlwapi

SHDeleteKeyW

pdh

PdhRemoveCounter PdhGetFormattedCounterValue PdhAddEnglishCounterW PdhCloseQuery PdhOpenQueryW PdhCollectQueryData

dbghelp

MiniDumpWriteDump

uxtheme

SetWindowTheme

dwmapi

DwmSetWindowAttribute

rpcrt4

UuidCreate UuidFromStringW

gdi32

SetTextColor SetBkColor SetBkMode CreateSolidBrush GetTextExtentPoint32W SelectObject CreateDCW CreateFontIndirectW DeleteDC DeleteObject D3DKMTSetProcessSchedulingPriorityClass D3DKMTGetProcessSchedulingPriorityClass

ole32

CoCreateInstance CoInitialize IIDFromString StringFromGUID2

Name

.text

Size

841KB

Virtual Size

840KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

196KB

Virtual Size

195KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

22KB

Virtual Size

38KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

32KB

Virtual Size

32KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

226KB

Virtual Size

225KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-06-02_6a10e49b55b6d133d9b934b715ce9efb_icedid_luca-stealer_njrat_stealc

wtsapi32

kernel32

user32

advapi32

shell32

oleaut32

shlwapi

pdh

dbghelp

uxtheme

dwmapi

rpcrt4

gdi32

ole32

generic