2026-07-03_657834a3d3cee7d01669c502960c781f_icedid_luca-stealer_njrat_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-03_657834a3d3cee7d01669c502960c781f_icedid_luca-stealer_njrat_stealc
Size 1.5MB
Sample260703-e1646abt6y
SHA256 60ba214796ece45ea2131e23425919c61a635afe75180ea0feeaaefa7b63195b
MD5 657834a3d3cee7d01669c502960c781f
SHA1 2de45ca436e7ad3ad91e21dbb894b87a08afc706
SHA512 848bf77389d555d12243ad6744287ec927c5cf6af3310f826b222e237f7d2f8e77ec3110240e64724471c557400641d38022f65520b56cbe8307fd51dd88b7ab
SSDEEP 24576:bEjU5PYcrZMYMx19POnaWnHrtjGstZ1UXHhmPh4bGgdW8ooBQeX:bscrq3lIL4sv1UxmYW8R3
TLSH
T138758F46B6B400FCD057C27889566907E7B278061F74A7DF16D08AAA6F33EE11A7E334
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_Binary_References_Browsers

Detects executables containing SQL queries to confidential data stores. Observed in infostealers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-03_657834a3d3cee7d01669c502960c781f_icedid_luca-stealer_njrat_stealc

File Explorer

2026-07-03_657834a3d3cee7d01669c502960c781f_icedid_luca-stealer_njrat_stealc

.exe 1.5MB

2026-07-03_657834a3d3cee7d01669c502960c781f_icedid_luca-stealer_njrat_stealc

IMPHASH 87e79db33ca303bd8712c83fd2a179ff
SHA256 60ba214796ece45ea2131e23425919c61a635afe75180ea0feeaaefa7b63195b
MD5 657834a3d3cee7d01669c502960c781f
SHA1 2de45ca436e7ad3ad91e21dbb894b87a08afc706
SHA512 848bf77389d555d12243ad6744287ec927c5cf6af3310f826b222e237f7d2f8e77ec3110240e64724471c557400641d38022f65520b56cbe8307fd51dd88b7ab
SSDEEP 24576:bEjU5PYcrZMYMx19POnaWnHrtjGstZ1UXHhmPh4bGgdW8ooBQeX:bscrq3lIL4sv1UxmYW8R3
TLSH
T138758F46B6B400FCD057C27889566907E7B278061F74A7DF16D08AAA6F33EE11A7E334
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers
Detects executables containing SQL queries to confidential data stores. Observed in infostealers
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1128008

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

winhttp

WinHttpConnect WinHttpSendRequest WinHttpCloseHandle WinHttpOpenRequest WinHttpReadData WinHttpQueryHeaders WinHttpAddRequestHeaders WinHttpOpen WinHttpReceiveResponse WinHttpWebSocketCompleteUpgrade WinHttpWebSocketClose WinHttpWebSocketReceive WinHttpSetOption WinHttpWebSocketSend WinHttpQueryDataAvailable

crypt32

CryptUnprotectData CryptStringToBinaryA

bcrypt

BCryptDestroyKey BCryptGenerateSymmetricKey BCryptSetProperty BCryptCloseAlgorithmProvider BCryptOpenAlgorithmProvider BCryptDecrypt

ole32

CoInitializeEx CoTaskMemFree CoUninitialize CoCreateInstance CreateStreamOnHGlobal

gdiplus

GdiplusShutdown GdiplusStartup GdipGetImageEncoders GdipCloneImage GdipCreateBitmapFromHBITMAP GdipSaveImageToStream GdipGetImageEncodersSize GdipFree GdipDisposeImage GdipAlloc

kernel32

GetUserDefaultLCID EnumSystemLocalesW ReadConsoleW GetExitCodeProcess IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW VirtualProtect FlsFree FlsSetValue FlsGetValue FlsAlloc GetConsoleMode GetConsoleOutputCP GetFileType SetFilePointerEx GetFileSizeEx GetCommandLineW GetCommandLineA ExitProcess GetModuleFileNameW GetStdHandle GetModuleHandleExW GetTempPathA GetTickCount64 GetComputerNameA GetEnvironmentVariableA LocalFree MultiByteToWideChar ReadFile WriteFile CreateFileA DeleteFileA CloseHandle GetCurrentProcessId TerminateProcess WaitForSingleObject GetLastError CreateProcessA AreFileApisANSI HeapCreate HeapFree GetFullPathNameW CreateProcessW OutputDebugStringA LockFile SetFilePointer GetFullPathNameA SetEndOfFile UnlockFileEx GetTempPathW CreateMutexW CreateFileW GetFileAttributesW UnmapViewOfFile HeapValidate HeapSize Sleep FormatMessageW GetDiskFreeSpaceA GetFileAttributesA GetFileAttributesExW OutputDebugStringW FlushViewOfFile LoadLibraryA WaitForSingleObjectEx DeleteFileW HeapReAlloc RaiseException GetSystemInfo LoadLibraryW HeapAlloc HeapCompact HeapDestroy UnlockFile GetProcAddress LockFileEx GetFileSize GetProcessHeap SystemTimeToFileTime FreeLibrary WideCharToMultiByte GetSystemTimeAsFileTime GetSystemTime FormatMessageA CreateFileMappingW MapViewOfFile QueryPerformanceCounter GetTickCount FlushFileBuffers FreeLibraryAndExitThread ExitThread CreateThread LoadLibraryExW GetTimeZoneInformation IsValidCodePage GetACP GetOEMCP FreeEnvironmentStringsW GetEnvironmentStringsW SetEnvironmentVariableW SetStdHandle WriteConsoleW RtlUnwind GetDiskFreeSpaceW GetCurrentThreadId GetExitCodeThread GetLocaleInfoEx FindClose FindFirstFileW FindFirstFileExW FindNextFileW GetModuleHandleW GetFileInformationByHandleEx QueryPerformanceFrequency ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer LCMapStringEx WakeAllConditionVariable CompareStringEx GetCPInfo GetStringTypeW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess IsProcessorFeaturePresent InitializeSListHead IsDebuggerPresent GetStartupInfoW RtlUnwindEx RtlPcToFileHeader SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree

user32

GetSystemMetrics ReleaseDC GetDC

gdi32

DeleteDC DeleteObject CreateCompatibleDC SelectObject CreateCompatibleBitmap BitBlt

advapi32

RegOpenKeyExA RegEnumValueA GetUserNameA RegCloseKey

Name

.text

Size

1.2MB

Virtual Size

1.2MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

211KB

Virtual Size

211KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

20KB

Virtual Size

27KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

51KB

Virtual Size

50KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-03_657834a3d3cee7d01669c502960c781f_icedid_luca-stealer_njrat_stealc

winhttp

crypt32

bcrypt

ole32

gdiplus

kernel32

user32

gdi32

advapi32

generic