2026-07-02_984b5556188ec82763d06bc6b542460a_icedid_luca-stealer_njrat_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-02_984b5556188ec82763d06bc6b542460a_icedid_luca-stealer_njrat_stealc
Size 1.6MB
Sample260702-jexqtadz21
SHA256 071975e987ca822de9e34d2cda709b901555bb39522f63d701894fcef38b9986
MD5 984b5556188ec82763d06bc6b542460a
SHA1 2305ca04beaf44e8b066c360a333197ae71b2333
SHA512 709504740cd91700fce1edef92b066f3bc9daa24a5d8bb6e9c80adeaac5b145cbab096026c0c9c095b38a53c2e1329f868f935687686861159ee00111dcc8706
SSDEEP 12288:foBBF4BrBqYL2T4qGKGiNLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVo8:gBX4ZB8TciSNyBo4kx929bL3Hnx
TLSH
T1E3856AD11ABA8DACE461CE7C8A81CCC9A4DF6D0C463D7ABB0278341C5F7EBD65864D21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-02_984b5556188ec82763d06bc6b542460a_icedid_luca-stealer_njrat_stealc

File Explorer

2026-07-02_984b5556188ec82763d06bc6b542460a_icedid_luca-stealer_njrat_stealc

.exe 1.6MB

2026-07-02_984b5556188ec82763d06bc6b542460a_icedid_luca-stealer_njrat_stealc

IMPHASH 7b43f5be5a3777b7fc645b216e3e7a3f
SHA256 071975e987ca822de9e34d2cda709b901555bb39522f63d701894fcef38b9986
MD5 984b5556188ec82763d06bc6b542460a
SHA1 2305ca04beaf44e8b066c360a333197ae71b2333
SHA512 709504740cd91700fce1edef92b066f3bc9daa24a5d8bb6e9c80adeaac5b145cbab096026c0c9c095b38a53c2e1329f868f935687686861159ee00111dcc8706
SSDEEP 12288:foBBF4BrBqYL2T4qGKGiNLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVo8:gBX4ZB8TciSNyBo4kx929bL3Hnx
TLSH
T1E3856AD11ABA8DACE461CE7C8A81CCC9A4DF6D0C463D7ABB0278341C5F7EBD65864D21
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

63576

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\dev\projs\ProcessSupervisor\output\QuickUpgrade.pdb

kernel32

GetActiveProcessorGroupCount GetLogicalProcessorInformationEx GetActiveProcessorCount DeleteCriticalSection InitializeCriticalSectionEx CopyFileW FreeLibrary GetStartupInfoW CreateProcessW TerminateThread CreateThread Sleep OpenEventW CreateEventW SetEvent SetCurrentDirectoryW MultiByteToWideChar GetLastError GetFileAttributesW GetSystemInfo LoadLibraryW GetModuleHandleW ExitProcess GetSystemTimeAsFileTime GetExitCodeProcess VerifyVersionInfoW FindResourceW SizeofResource LockResource LoadResource FindResourceExW WaitForSingleObject GetProcessHeap HeapSize HeapFree HeapReAlloc HeapAlloc HeapDestroy CloseHandle GetTempPathW WriteFile LocalFree WideCharToMultiByte GetProcAddress GetCurrentProcess LoadLibraryExW VirtualProtect GetUserDefaultUILanguage GetModuleFileNameW GetCurrentProcessId OpenProcess SetLastError WinExec RemoveDirectoryW EnterCriticalSection LeaveCriticalSection GetCurrentThreadId InitializeCriticalSection InitializeCriticalSectionAndSpinCount TerminateProcess GetProcessTimes IsDebuggerPresent OutputDebugStringW RaiseException ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive QueryPerformanceCounter WakeAllConditionVariable SleepConditionVariableSRW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent InitializeSListHead RtlPcToFileHeader RtlUnwindEx EncodePointer TlsAlloc TlsGetValue TlsSetValue TlsFree GetModuleHandleExW GetStdHandle GetFileType FlsAlloc FlsGetValue FlsSetValue FlsFree LCMapStringW SetFilePointerEx FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle GetStringTypeW FlushFileBuffers GetConsoleOutputCP GetConsoleMode WriteConsoleW DeleteFileW CreateFileW CreateDirectoryW VerSetConditionMask

user32

EnumWindows MessageBoxW SendMessageW PostMessageW ShowWindow DialogBoxParamW EndDialog GetDlgItem SetDlgItemTextW IsWindowVisible GetWindowThreadProcessId GetWindow CreateWindowExW LoadStringW EnableWindow

advapi32

StartServiceW QueryServiceStatus ChangeServiceConfigW OpenProcessToken GetTokenInformation CloseServiceHandle InitializeSecurityDescriptor SetSecurityDescriptorDacl OpenServiceW RegOpenKeyExW RegCreateKeyExW RegDeleteValueW RegCloseKey RegQueryValueExW RegSetValueExW GetSidSubAuthorityCount GetSidSubAuthority OpenSCManagerW

shell32

SHGetSpecialFolderPathW ShellExecuteExW ShellExecuteW

ole32

CoInitialize

oleaut32

SysFreeString SysAllocString

wininet

InternetOpenW InternetCloseHandle InternetOpenUrlW InternetReadFile

wintrust

WinVerifyTrust

Name

.text

Size

149KB

Virtual Size

148KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

67KB

Virtual Size

66KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

20KB

Virtual Size

28KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

8KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

227KB

Virtual Size

227KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

1.2MB

Virtual Size

1.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-02_984b5556188ec82763d06bc6b542460a_icedid_luca-stealer_njrat_stealc

kernel32

user32

advapi32

shell32

ole32

oleaut32

wininet

wintrust

generic