2026-06-30_2ae83fbae6eb7f72da7e636920ea4255_icedid_luca-stealer_njrat_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-06-30_2ae83fbae6eb7f72da7e636920ea4255_icedid_luca-stealer_njrat_stealc
Size 2.5MB
Sample260701-gl99dafs8r
SHA256 8737d870a95b4f67d06ed7ca016a3571f8a13d390976478b1674bd6d8d0d163a
MD5 2ae83fbae6eb7f72da7e636920ea4255
SHA1 473e5aa33215097ff127d981e76339c8007586f3
SHA512 02ba6b5b1f31c4c8d8158d9bc9f80f54d3e9968ea39504833ab26363489cecf1e8878f958e8c78c5f75693a4542f98ef766b0d4cbae7b61bf6ad518bc9ce3151
SSDEEP 49152:OZgLxIhJy8mOQHiPxYlVYbF9sfwM08OWj+:qEiph4y
TLSH
T1A2C57D0AB2E400E9D4BFC07CC906561AEBB23865076197CF06B1869B5F63BE56E7F704
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

2026-06-30_2ae83fbae6eb7f72da7e636920ea4255_icedid_luca-stealer_njrat_stealc

.exe 2.5MB

2026-06-30_2ae83fbae6eb7f72da7e636920ea4255_icedid_luca-stealer_njrat_stealc

IMPHASH 2ea695cab40ec528371130bfa30c68a4
SHA256 8737d870a95b4f67d06ed7ca016a3571f8a13d390976478b1674bd6d8d0d163a
MD5 2ae83fbae6eb7f72da7e636920ea4255
SHA1 473e5aa33215097ff127d981e76339c8007586f3
SHA512 02ba6b5b1f31c4c8d8158d9bc9f80f54d3e9968ea39504833ab26363489cecf1e8878f958e8c78c5f75693a4542f98ef766b0d4cbae7b61bf6ad518bc9ce3151
SSDEEP 49152:OZgLxIhJy8mOQHiPxYlVYbF9sfwM08OWj+:qEiph4y
TLSH
T1A2C57D0AB2E400E9D4BFC07CC906561AEBB23865076197CF06B1869B5F63BE56E7F704
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Digest

46:63:81:8f:9a:36:73:c3:32:9f:b6:41:88:0a:62:dc:84:c8:00:36:ce:65:48:42:0a:ae:34:eb:a9:c4:76:db

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Aug 30, 2025

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Digest

46:63:81:8f:9a:36:73:c3:32:9f:b6:41:88:0a:62:dc:84:c8:00:36:ce:65:48:42:0a:ae:34:eb:a9:c4:76:db

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Aug 29, 2025

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Windows Third Party Component CA 2014,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:6e:12:29:85:6f:0a:de:6c:fc:00:00:00:00:00:6e

Issuer

CN=Microsoft Windows Third Party Component CA 2014,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 10, 2024 - Oct 8, 2025

Subject

CN=Microsoft Windows Third Party Component CA 2014,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:0d:69:0d:5d:78:93:d0:76:df:00:00:00:00:00:0d

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Oct 15, 2014 - Oct 15, 2029

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:F002-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:02:05:3c:75:6c:82:44:87:cd:fe:00:01:00:00:02:05

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 30, 2025 - Apr 22, 2026

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 30, 2021 - Sep 30, 2030

Subject

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:25:f3:1c:b5:55:76:73:40:d6:00:00:00:00:01:25

Issuer

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Feb 20, 2025 - Feb 18, 2026

Subject

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0b:aa:c1:00:00:00:00:00:09

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 18, 2012 - Apr 18, 2027

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:3703-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:02:0a:47:b2:14:d9:ee:b2:b3:0f:00:01:00:00:02:0a

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 30, 2025 - Apr 22, 2026

Minor OS version

Major OS version

Entry point

1544744

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Projects\SoundEdge\SNAPOService\x64\Release\SNAPOS64.pdb

oleaut32

SysFreeString GetErrorInfo VariantInit SysAllocString VARIANT_UserFree64 SetErrorInfo VARIANT_UserMarshal VARIANT_UserSize VARIANT_UserUnmarshal VARIANT_UserFree SysStringLen VARIANT_UserMarshal64 VARIANT_UserUnmarshal64 VARIANT_UserSize64

rpcrt4

I_RpcBindingInqLocalClientPID RpcBindingVectorFree NdrServerCall2 RpcEpUnregister NdrServerCallAll RpcMgmtWaitServerListen RpcMgmtStopServerListening RpcServerUseProtseqEpW RpcServerRegisterIf3 RpcServerInqBindings RpcEpRegisterW RpcServerListen RpcServerUnregisterIf

advapi32

RegNotifyChangeKeyValue CreateProcessAsUserW RegDeleteValueA RegSetValueExA RegSetValueExW RegGetValueA RegGetValueW RegEnumValueA RegCloseKey RegQueryValueExW RegCreateKeyExW RegOpenKeyExW RegOpenKeyExA RegQueryValueExA RegCreateKeyExA GetTokenInformation EqualSid RegisterEventSourceW ReportEventW DeregisterEventSource RegFlushKey GetUserNameW EventWriteString SetServiceStatus EventUnregister EventRegister RegOpenCurrentUser RevertToSelf ImpersonateLoggedOnUser DuplicateTokenEx FreeSid SetSecurityDescriptorDacl InitializeSecurityDescriptor SetEntriesInAclW AllocateAndInitializeSid OpenProcessToken

kernel32

CloseHandle GetCurrentThread GetCurrentProcess GetModuleFileNameA CreateSemaphoreExW HeapFree SetLastError ReleaseSemaphore GetModuleHandleExW InitializeCriticalSectionEx GetCurrentThreadId ReleaseMutex HeapSize FormatMessageW OutputDebugStringW WaitForSingleObjectEx OpenSemaphoreW HeapReAlloc HeapAlloc FreeLibraryAndExitThread DecodePointer FlushFileBuffers CreateMutexExW DeleteCriticalSection GetCurrentProcessId GetProcessHeap WideCharToMultiByte DebugBreak IsDebuggerPresent CreateThreadpoolWork SubmitThreadpoolWork SetEvent ExitProcess GetStdHandle GetThreadId GetConsoleOutputCP GetConsoleMode LocalFree EnumSystemLocalesW CreateThread CreateEventW GetFileSizeEx ReadConsoleW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeZoneInformation GetTimeFormatW GetDateFormatW VirtualProtect WTSGetActiveConsoleSessionId IsValidCodePage GetACP GetOEMCP FlsFree GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetModuleHandleW SetStdHandle WriteConsoleW SetEndOfFile CreateDirectoryW ExitThread LockResource SizeofResource Sleep LoadResource FindResourceW FlsSetValue FlsGetValue WaitForSingleObject RtlUnwind FlsAlloc GetFileType GetCommandLineW GetCommandLineA WaitForMultipleObjects MultiByteToWideChar GetModuleHandleA FindFirstFileW FindClose GetFileAttributesW GetWindowsDirectoryW IsWow64Process CreateToolhelp32Snapshot Process32FirstW Process32NextW K32GetModuleFileNameExW OpenProcess DuplicateHandle RaiseException CreateProcessW LocalAlloc CreateFileW SetFilePointerEx ReadFile CreateFileA GetProcessId CreateNamedPipeA CancelIoEx GetOverlappedResult ResetEvent ConnectNamedPipe DisconnectNamedPipe WriteFile GetProcessTimes ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW FreeLibrary RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent GetStartupInfoW QueryPerformanceCounter GetSystemTimeAsFileTime InitializeSListHead TryAcquireSRWLockExclusive GetTickCount64 GetExitCodeThread QueryPerformanceFrequency GetStringTypeW FormatMessageA GetLocaleInfoEx FindFirstFileExW FindNextFileW GetFileAttributesExW AreFileApisANSI GetFileInformationByHandleEx WakeConditionVariable EnterCriticalSection LeaveCriticalSection EncodePointer LCMapStringEx CompareStringEx GetCPInfo GetLastError GetProcAddress LoadLibraryW GetModuleFileNameW LoadLibraryExW FindPackagesByPackageFamily TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount RtlPcToFileHeader InterlockedPushEntrySList RtlUnwindEx RtlCaptureContext

ole32

CLSIDFromString CoUninitialize CoInitializeEx CoCreateGuid CoCreateInstance CoTaskMemFree PropVariantClear CoTaskMemAlloc CoCreateFreeThreadedMarshaler

shell32

SHGetKnownFolderPath ShellExecuteW

wtsapi32

WTSUnRegisterSessionNotification WTSQuerySessionInformationW WTSFreeMemory WTSRegisterSessionNotification WTSQueryUserToken

user32

PostQuitMessage DispatchMessageW PostThreadMessageW DefWindowProcW RegisterClassW DestroyWindow CreateWindowExW GetMessageW TranslateMessage

api-ms-win-security-base-l1-2-2

DeriveCapabilitySidsFromName

mfplat

MFStartup MFCreateMediaType

winhttp

WinHttpReadData WinHttpSendRequest WinHttpOpenRequest WinHttpConnect WinHttpCloseHandle WinHttpQueryDataAvailable WinHttpReceiveResponse WinHttpOpen

userenv

DestroyEnvironmentBlock CreateEnvironmentBlock

propsys

InitPropVariantFromStringVector InitPropVariantFromCLSID PropVariantToInt64

setupapi

CM_Open_DevNode_Key CM_Get_DevNode_Registry_PropertyW CM_Locate_DevNodeA

mfreadwrite

MFCreateSourceReaderFromURL

api-ms-win-power-base-l1-1-0

PowerRegisterSuspendResumeNotification PowerUnregisterSuspendResumeNotification

Name

.text

Size

1.8MB

Virtual Size

1.8MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

437KB

Virtual Size

436KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

84KB

Virtual Size

181KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

116KB

Virtual Size

116KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.msvcjmc

Size

512B

Virtual Size

464B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

19KB

Virtual Size

18KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-06-30_2ae83fbae6eb7f72da7e636920ea4255_icedid_luca-stealer_njrat_stealc

oleaut32

rpcrt4

advapi32

kernel32

ole32

shell32

wtsapi32

user32

api-ms-win-security-base-l1-2-2

mfplat

winhttp

userenv

propsys

setupapi

mfreadwrite

api-ms-win-power-base-l1-1-0

generic