2026-07-04_18575497e4fe2142cd4b20200438d719_icedid_luca-stealer_njrat_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-04_18575497e4fe2142cd4b20200438d719_icedid_luca-stealer_njrat_stealc
Size 4.0MB
Sample260704-mtfbvsev4y
SHA256 57341e593a7fdeaae093825573de58fca8248d0f6347333269cdee4cd6987ba8
MD5 18575497e4fe2142cd4b20200438d719
SHA1 2091fa468db7c1fd36ad934588dfc0ca21dd8b2a
SHA512 a6b140fd0a367488899a20a123400c58dc7a5b47acbbf624374e9155598eb6c65f93d8e6be4c4c97238d74edabc4ae0061e85b57efddfdf543622236dd833378
SSDEEP 98304:gKFAq/zYu6ZpHvcLrIr0N5oDZ9lwsNmo7cEfUk1:gKiqcJ9vW0QN5ozlwocEMk
TLSH
T17C16F164B7A61264E0B3C6384EE3C336FA76B8052F35D6CF72A645290E137F0593A752
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-04_18575497e4fe2142cd4b20200438d719_icedid_luca-stealer_njrat_stealc

File Explorer

2026-07-04_18575497e4fe2142cd4b20200438d719_icedid_luca-stealer_njrat_stealc

.exe 4.0MB

2026-07-04_18575497e4fe2142cd4b20200438d719_icedid_luca-stealer_njrat_stealc

IMPHASH e76174465a3ae37ac5b78cba065fa367
SHA256 57341e593a7fdeaae093825573de58fca8248d0f6347333269cdee4cd6987ba8
MD5 18575497e4fe2142cd4b20200438d719
SHA1 2091fa468db7c1fd36ad934588dfc0ca21dd8b2a
SHA512 a6b140fd0a367488899a20a123400c58dc7a5b47acbbf624374e9155598eb6c65f93d8e6be4c4c97238d74edabc4ae0061e85b57efddfdf543622236dd833378
SSDEEP 98304:gKFAq/zYu6ZpHvcLrIr0N5oDZ9lwsNmo7cEfUk1:gKiqcJ9vW0QN5ozlwocEMk
TLSH
T17C16F164B7A61264E0B3C6384EE3C336FA76B8052F35D6CF72A645290E137F0593A752
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

294364

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\Acron\Desktop\ProtectKoyke\Loader\MegaSelfCodeLoader\x64\Release\launcher.pdb

kernel32

GetModuleHandleExW TerminateProcess WaitForSingleObject GetCurrentThreadId ReleaseMutex FreeEnvironmentStringsW OpenProcess MultiByteToWideChar FormatMessageW OutputDebugStringW WaitForSingleObjectEx LockResource GlobalAlloc OpenSemaphoreW GlobalFree CloseHandle LoadResource FindResourceW HeapAlloc GetProcAddress GlobalLock CreateMutexExW GetCurrentProcessId GetProcessHeap GlobalMemoryStatusEx CreateProcessW GetModuleHandleW DebugBreak GetEnvironmentStringsW GlobalUnlock ReleaseSemaphore GetExitCodeProcess GetFileAttributesW CreateFileW OutputDebugStringA GetModuleFileNameW LoadLibraryExW LoadLibraryW FreeLibrary GetEnvironmentVariableW SetEndOfFile WriteConsoleW HeapSize SetStdHandle GetCommandLineW GetCommandLineA GetOEMCP GetACP IsValidCodePage HeapReAlloc ReadConsoleW ReadFile EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW HeapFree SetLastError CreateSemaphoreExW SizeofResource GetModuleFileNameA WideCharToMultiByte GetComputerNameW GetLocalTime GetLastError GetVolumeInformationW IsDebuggerPresent CreateDirectoryW VirtualProtect FlsFree FlsSetValue FlsGetValue FlsAlloc GetConsoleMode GetConsoleOutputCP FlushFileBuffers GetFileType SetFilePointerEx GetFileSizeEx WriteFile GetStdHandle ExitProcess FreeLibraryAndExitThread ExitThread CreateThread TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount RaiseException RtlPcToFileHeader RtlUnwindEx InitializeSListHead GetStartupInfoW IsProcessorFeaturePresent GetCurrentProcess SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry FormatMessageA LocalFree GetLocaleInfoEx QueryPerformanceCounter QueryPerformanceFrequency GetStringTypeW FindClose FindFirstFileW FindFirstFileExW FindNextFileW GetFileAttributesExW SetFileInformationByHandle AreFileApisANSI GetFileInformationByHandleEx ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive SleepConditionVariableSRW Sleep EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer LCMapStringEx GetSystemTimeAsFileTime WakeAllConditionVariable GetCPInfo RtlCaptureContext RtlUnwind

user32

LoadCursorW TranslateMessage SetLayeredWindowAttributes DispatchMessageW ShowWindow RegisterClassExW GetSystemMetrics SendMessageW ScreenToClient CreateWindowExW SetWindowRgn MessageBoxW DestroyWindow GetClientRect DefWindowProcW GetMessageW ReleaseCapture PostQuitMessage PostMessageW

gdi32

CreateRoundRectRgn

advapi32

EventUnregister EventWriteTransfer EventSetInformation EventRegister RegCloseKey RegCreateKeyExW RegSetValueExW RegOpenKeyExW RegQueryValueExW RegGetValueW

shell32

SHGetFolderPathW ShellExecuteW

ole32

CoTaskMemAlloc CreateStreamOnHGlobal CoTaskMemFree

winhttp

WinHttpQueryHeaders WinHttpReadData WinHttpOpenRequest WinHttpCloseHandle WinHttpAddRequestHeaders WinHttpConnect WinHttpCrackUrl WinHttpQueryDataAvailable WinHttpReceiveResponse WinHttpSendRequest WinHttpOpen

bcrypt

BCryptCloseAlgorithmProvider BCryptGetProperty BCryptHashData BCryptCreateHash BCryptEncrypt BCryptFinishHash BCryptOpenAlgorithmProvider BCryptDecrypt BCryptSetProperty BCryptGenerateSymmetricKey BCryptDestroyHash BCryptDestroyKey

wininet

InternetOpenW InternetReadFile HttpQueryInfoW InternetCloseHandle InternetOpenUrlW

dwmapi

DwmSetWindowAttribute

Name

.text

Size

458KB

Virtual Size

458KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

213KB

Virtual Size

213KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

14KB

Virtual Size

21KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

20KB

Virtual Size

20KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

3.3MB

Virtual Size

3.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-04_18575497e4fe2142cd4b20200438d719_icedid_luca-stealer_njrat_stealc

kernel32

user32

gdi32

advapi32

shell32

ole32

winhttp

bcrypt

wininet

dwmapi

generic