2026-06-26_8e4c13c232e54d343a3a951a5018fc38_icedid_luca-stealer_njrat_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-06-26_8e4c13c232e54d343a3a951a5018fc38_icedid_luca-stealer_njrat_stealc
Size 1.2MB
Sample260629-rertkafs41
SHA256 6f6dd86ffeeceb9546400706d3348129277858dbe3517dcbe22b78055b6de705
MD5 8e4c13c232e54d343a3a951a5018fc38
SHA1 04c23858a5fa6d0b1b8c14c4f7a626b84d2d5264
SHA512 cb12e2dc60d30ef00e9320e5e87df3accf54873b7d83cbe613250282bf931fe1ccd6b3aa4f9d3c87b6e78f699f7f90587b837b4685bbb851bcec9c9e500ee73e
SSDEEP 24576:n48fFk9RpEJVsvmb57GBiOl6a8JTth/RWZvR6wQQ92pN3a:hfiCdb5+Pl6bJTIZ5jdgpc
TLSH
T1FE55AF55DE5706E8DEAA8B758A832C06F2F1781A037165FF139211590F1BAEC3A37723
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_Binary_References_Browsers

Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-06-26_8e4c13c232e54d343a3a951a5018fc38_icedid_luca-stealer_njrat_stealc

File Explorer

2026-06-26_8e4c13c232e54d343a3a951a5018fc38_icedid_luca-stealer_njrat_stealc

.exe 1.2MB

2026-06-26_8e4c13c232e54d343a3a951a5018fc38_icedid_luca-stealer_njrat_stealc

IMPHASH 0bc7ed9f7c39bccc32fee6000ee1a8c5
SHA256 6f6dd86ffeeceb9546400706d3348129277858dbe3517dcbe22b78055b6de705
MD5 8e4c13c232e54d343a3a951a5018fc38
SHA1 04c23858a5fa6d0b1b8c14c4f7a626b84d2d5264
SHA512 cb12e2dc60d30ef00e9320e5e87df3accf54873b7d83cbe613250282bf931fe1ccd6b3aa4f9d3c87b6e78f699f7f90587b837b4685bbb851bcec9c9e500ee73e
SSDEEP 24576:n48fFk9RpEJVsvmb57GBiOl6a8JTth/RWZvR6wQQ92pN3a:hfiCdb5+Pl6bJTIZ5jdgpc
TLSH
T1FE55AF55DE5706E8DEAA8B758A832C06F2F1781A037165FF139211590F1BAEC3A37723
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers
Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

414092

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

ws2_32

gethostname WSACleanup inet_ntoa gethostbyname WSAStartup

user32

CloseClipboard GetClipboardData OpenClipboard

ole32

CoCreateInstance CoInitializeEx CoUninitialize

oleaut32

SysAllocStringByteLen SysStringByteLen SysFreeString

kernel32

SetEndOfFile WriteConsoleW HeapSize SetStdHandle GetProcessHeap FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP GetACP IsValidCodePage HeapReAlloc CloseHandle Sleep GetTickCount64 GetModuleHandleA GetProcAddress LoadLibraryA LocalFree CreateFileA GetFileSize ReadFile GetLastError GetCurrentProcess lstrcmpiA GetDiskFreeSpaceExA IsDebuggerPresent QueryPerformanceCounter QueryPerformanceFrequency CreateMutexA CreateToolhelp32Snapshot Process32First Process32Next GetEnvironmentVariableA WideCharToMultiByte GlobalUnlock GlobalLock ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent GetModuleHandleW GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead FormatMessageA GetLocaleInfoEx CreateFileW FindClose FindFirstFileW FindFirstFileExW FindNextFileW GetFileAttributesExW AreFileApisANSI RtlUnwind GetFileInformationByHandleEx MultiByteToWideChar EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer LCMapStringEx CompareStringEx GetCPInfo GetStringTypeW ReadConsoleW RtlPcToFileHeader RaiseException RtlUnwindEx SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW TerminateProcess ExitProcess GetModuleHandleExW GetModuleFileNameW GetStdHandle WriteFile HeapFree HeapAlloc GetFileType FlsAlloc FlsGetValue FlsSetValue FlsFree VirtualProtect LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW FlushFileBuffers GetConsoleOutputCP GetConsoleMode GetFileSizeEx SetFilePointerEx

Name

.text

Size

564KB

Virtual Size

563KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

112KB

Virtual Size

112KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

7KB

Virtual Size

18KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

19KB

Virtual Size

19KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

568KB

Virtual Size

572KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-06-26_8e4c13c232e54d343a3a951a5018fc38_icedid_luca-stealer_njrat_stealc

ws2_32

user32

ole32

oleaut32

kernel32

generic