2026-07-03_f0690a3dd690ef423ca28273b8d228bb_icedid_luca-stealer_njrat_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-03_f0690a3dd690ef423ca28273b8d228bb_icedid_luca-stealer_njrat_stealc
Size 2.8MB
Sample260703-lpjcaabv9q
SHA256 24393abea83d856031e5e086d5cb992d2722931e081afabff5fe8ce1c73a336b
MD5 f0690a3dd690ef423ca28273b8d228bb
SHA1 0e8e94ab53af8fd923700b642ac1860f20bfb58b
SHA512 9204ec69c6917bc9a13413da20365c8845279802bda0d2fa1e78156dbbef63219fda4dd533a5616ed95626e5b65bac4da9deb239a61bc9432677d87f94840dd7
SSDEEP 49152:SySQxd8OaqcRHmN6ydRZDbaxaK1Elt3YRDDz1yz82hhtVqtnc:S8/bheRiltoD2Kc
TLSH
T1BCD5C047E3B800F8C0A7C178CA16561BEB72780517759BDB16D086AA6F23FE15B7E720
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_Binary_References_Browsers

Detects executables Discord URL observed in first stage droppers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_DiscordURL

Detects executables containing SQL queries to confidential data stores. Observed in infostealers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-03_f0690a3dd690ef423ca28273b8d228bb_icedid_luca-stealer_njrat_stealc

File Explorer

2026-07-03_f0690a3dd690ef423ca28273b8d228bb_icedid_luca-stealer_njrat_stealc

.exe 2.8MB

2026-07-03_f0690a3dd690ef423ca28273b8d228bb_icedid_luca-stealer_njrat_stealc

IMPHASH 1683cb1bdb3fb245d3dd78b965012f0c
SHA256 24393abea83d856031e5e086d5cb992d2722931e081afabff5fe8ce1c73a336b
MD5 f0690a3dd690ef423ca28273b8d228bb
SHA1 0e8e94ab53af8fd923700b642ac1860f20bfb58b
SHA512 9204ec69c6917bc9a13413da20365c8845279802bda0d2fa1e78156dbbef63219fda4dd533a5616ed95626e5b65bac4da9deb239a61bc9432677d87f94840dd7
SSDEEP 49152:SySQxd8OaqcRHmN6ydRZDbaxaK1Elt3YRDDz1yz82hhtVqtnc:S8/bheRiltoD2Kc
TLSH
T1BCD5C047E3B800F8C0A7C178CA16561BEB72780517759BDB16D086AA6F23FE15B7E720
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers
Detects executables Discord URL observed in first stage droppers
Detects executables containing SQL queries to confidential data stores. Observed in infostealers
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1315988

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

winhttp

WinHttpQueryDataAvailable WinHttpReceiveResponse WinHttpOpen WinHttpQueryHeaders WinHttpReadData WinHttpOpenRequest WinHttpSetOption WinHttpCloseHandle WinHttpSendRequest WinHttpConnect WinHttpCrackUrl WinHttpSetTimeouts

crypt32

CryptUnprotectData CryptStringToBinaryA

bcrypt

BCryptGenerateSymmetricKey BCryptOpenAlgorithmProvider BCryptDecrypt BCryptCloseAlgorithmProvider BCryptSetProperty BCryptDestroyKey

ole32

CoSetProxyBlanket CoInitializeEx CoUninitialize CoCreateInstance

shell32

CommandLineToArgvW SHGetFolderPathW

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

advapi32

GetUserNameW

kernel32

CompareStringW LCMapStringW FlsFree FlsSetValue FlsGetValue GetLocaleInfoW VirtualProtect IsValidLocale FlsAlloc GetFileType GetUserDefaultLCID WriteConsoleW SetStdHandle SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP GetACP SetFilePointerEx GetFileSizeEx ExitProcess GetModuleHandleExW FreeLibraryAndExitThread ExitThread CreateNamedPipeW GetTempPathW Sleep LocalFree WideCharToMultiByte OutputDebugStringA OutputDebugStringW MultiByteToWideChar GetComputerNameW GlobalMemoryStatusEx GetSystemTime GetModuleFileNameW WaitForSingleObject GetLastError CloseHandle CreateProcessW AreFileApisANSI ReadFile TryEnterCriticalSection HeapCreate HeapFree EnterCriticalSection GetFullPathNameW WriteFile GetDiskFreeSpaceW LockFile LeaveCriticalSection InitializeCriticalSection SetFilePointer GetFullPathNameA SetEndOfFile UnlockFileEx CreateMutexW CreateFileW GetFileAttributesW GetCurrentThreadId UnmapViewOfFile HeapValidate HeapSize GetTempPathA FormatMessageW GetDiskFreeSpaceA GetFileAttributesA GetFileAttributesExW FlushViewOfFile CreateFileA LoadLibraryA WaitForSingleObjectEx DeleteFileA DeleteFileW HeapReAlloc RaiseException GetSystemInfo LoadLibraryW HeapAlloc HeapCompact HeapDestroy UnlockFile GetProcAddress LockFileEx GetFileSize DeleteCriticalSection GetCurrentProcessId GetProcessHeap SystemTimeToFileTime FreeLibrary GetSystemTimeAsFileTime FormatMessageA CreateFileMappingW MapViewOfFile QueryPerformanceCounter GetTickCount FlushFileBuffers ExpandEnvironmentStringsW SetConsoleTextAttribute GetConsoleScreenBufferInfo GetStdHandle SetConsoleOutputCP EnumSystemLocalesW PeekNamedPipe ConnectNamedPipe GetModuleHandleW CreateThread LoadLibraryExW TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount SetLastError InitializeSListHead GetStartupInfoW IsDebuggerPresent IsValidCodePage GetTimeZoneInformation ReadConsoleW GetConsoleMode GetConsoleOutputCP GetLocaleInfoEx CreateDirectoryW FindClose FindFirstFileW FindFirstFileExW FindNextFileW GetFileInformationByHandle SetFileInformationByHandle CopyFileW GetFileInformationByHandleEx GetStringTypeW GetExitCodeThread ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive InitializeCriticalSectionEx EncodePointer DecodePointer LCMapStringEx WakeAllConditionVariable SleepConditionVariableSRW CompareStringEx GetCPInfo UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent

oleaut32

VariantInit SysFreeString SysAllocString VariantClear SysStringLen

ntdll

RtlVirtualUnwind RtlUnwind RtlLookupFunctionEntry RtlUnwindEx RtlPcToFileHeader RtlCaptureContext

Name

.text

Size

1.4MB

Virtual Size

1.4MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.3MB

Virtual Size

1.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.data

Size

21KB

Virtual Size

36KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

60KB

Virtual Size

64KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

6KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-03_f0690a3dd690ef423ca28273b8d228bb_icedid_luca-stealer_njrat_stealc

winhttp

crypt32

bcrypt

ole32

shell32

version

advapi32

kernel32

oleaut32

ntdll

generic