2026-06-02_f3033309fa309b03ff0f66345bbe7525_icedid_luca-stealer_njrat_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-06-02_f3033309fa309b03ff0f66345bbe7525_icedid_luca-stealer_njrat_stealc
Size 1.1MB
Sample260602-yncjkadw3s
SHA256 c0729e6ab68f021721edcd00389c4aa5e6267dc9dc9f8a6a86471f3908f324d1
MD5 f3033309fa309b03ff0f66345bbe7525
SHA1 cdc3315aeb8e8e1847fda1bd4b92a7f9ca3a1456
SHA512 f3f6dfa83bbe5be7f73afb0e4e392c1c29543da190fc1592aac3568c145a719147dbe881cff3f667fa36cc867f36cc4134135b44e3058e892cf1f1023deabb14
SSDEEP 24576:PONv21LryR2rhh0lhSMXlX05P/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:PC2pr5owPLNiXicJFFRGNzj3
TLSH
T15A45E05AB7E841F8E5BAC07888A25629FA737C95439067CB03907A571F73AE14F3E701
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-06-02_f3033309fa309b03ff0f66345bbe7525_icedid_luca-stealer_njrat_stealc

File Explorer

2026-06-02_f3033309fa309b03ff0f66345bbe7525_icedid_luca-stealer_njrat_stealc

.exe 1.1MB

2026-06-02_f3033309fa309b03ff0f66345bbe7525_icedid_luca-stealer_njrat_stealc

IMPHASH 14d0c7ea580037c344b5907e698d40b1
SHA256 c0729e6ab68f021721edcd00389c4aa5e6267dc9dc9f8a6a86471f3908f324d1
MD5 f3033309fa309b03ff0f66345bbe7525
SHA1 cdc3315aeb8e8e1847fda1bd4b92a7f9ca3a1456
SHA512 f3f6dfa83bbe5be7f73afb0e4e392c1c29543da190fc1592aac3568c145a719147dbe881cff3f667fa36cc867f36cc4134135b44e3058e892cf1f1023deabb14
SSDEEP 24576:PONv21LryR2rhh0lhSMXlX05P/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:PC2pr5owPLNiXicJFFRGNzj3
TLSH
T15A45E05AB7E841F8E5BAC07888A25629FA737C95439067CB03907A571F73AE14F3E701
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

174044

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Build\Build_2042d_D20260403T104826\fa_rss\Release\AppStoreSRV.pdb

wtsapi32

WTSQueryUserToken WTSFreeMemory WTSEnumerateSessionsW

kernel32

GetProcessHeap HeapSize HeapFree HeapReAlloc HeapAlloc DecodePointer CopyFileW LocalFree LocalAlloc GetExitCodeProcess GetCurrentProcess WaitForSingleObject CloseHandle TerminateProcess GetLastError DeleteCriticalSection InitializeCriticalSectionEx SetEndOfFile WriteConsoleW CreateFileW SetStdHandle SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP GetACP IsValidCodePage ReadConsoleW ReadFile GetConsoleMode GetConsoleOutputCP FlushFileBuffers SetFilePointerEx GetFileSizeEx GetFileType EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW VirtualProtect FlsFree FlsSetValue FlsGetValue FlsAlloc MultiByteToWideChar WideCharToMultiByte GetCommandLineW WaitForMultipleObjects CreateMutexW ReleaseMutex UnmapViewOfFile CreateEventW SetEvent CreateFileMappingW MapViewOfFile FindFirstFileExW FindNextFileW RemoveDirectoryW GetModuleFileNameW FindClose GetFileAttributesW Sleep DeleteFileW GetSystemFirmwareTable GetProcAddress FreeLibrary WaitForSingleObjectEx GetCurrentThreadId GetExitCodeThread RtlUnwind ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive WakeConditionVariable WakeAllConditionVariable SleepConditionVariableSRW GetStringTypeW QueryPerformanceCounter EnterCriticalSection LeaveCriticalSection EncodePointer LCMapStringEx GetSystemTimeAsFileTime GetModuleHandleW GetCPInfo IsDebuggerPresent OutputDebugStringW RaiseException RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent GetStartupInfoW GetCurrentProcessId InitializeSListHead RtlUnwindEx RtlPcToFileHeader SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW CreateThread ExitThread FreeLibraryAndExitThread GetModuleHandleExW ExitProcess GetStdHandle WriteFile GetCommandLineA

advapi32

RegOpenKeyExW SetSecurityDescriptorDacl StartServiceCtrlDispatcherW SetServiceStatus RegisterServiceCtrlHandlerExW ConvertStringSidToSidW ConvertSidToStringSidW RegQueryValueExW SetTokenInformation GetTokenInformation GetLengthSid DuplicateTokenEx CreateProcessAsUserW RegCloseKey InitializeSecurityDescriptor RegCreateKeyExW

userenv

DestroyEnvironmentBlock CreateEnvironmentBlock

shell32

CommandLineToArgvW

Name

.text

Size

308KB

Virtual Size

307KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

231KB

Virtual Size

230KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

7KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

19KB

Virtual Size

19KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

18KB

Virtual Size

18KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

568KB

Virtual Size

572KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-06-02_f3033309fa309b03ff0f66345bbe7525_icedid_luca-stealer_njrat_stealc

wtsapi32

kernel32

advapi32

userenv

shell32

generic