2026-07-05_5c086187244b1b07f545614ca9efa85f_icedid_luca-stealer_njrat_qakbot_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-05_5c086187244b1b07f545614ca9efa85f_icedid_luca-stealer_njrat_qakbot_stealc
Size 3.0MB
Sample260705-ma148aby3t
SHA256 553f8bbbd862c6c1ef8315a9cc58903d2872eda06c106fe7061ed788d8394ae5
MD5 5c086187244b1b07f545614ca9efa85f
SHA1 d8bc1cfc2c110b907ddfcff8800773b27c6cd2e6
SHA512 94345c493f206be532d7678f0bc07f155255f993c5a72653bc47b086fe94007376a39d45c166e0520630853b2f5fdba39c7ae6bfeb64eb7bd1f57365268d4bd4
SSDEEP 98304:Hdswbru4gDqh2pb/AQb84gi4zgcBvCHVaoj+:6w8AQb8TNEcBvCHVaoj+
TLSH
T124E5E127E76410E9C0BBC178C91A5907E775784523306BDF56D09AA63FA3BE16E3E320
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-05_5c086187244b1b07f545614ca9efa85f_icedid_luca-stealer_njrat_qakbot_stealc

File Explorer

2026-07-05_5c086187244b1b07f545614ca9efa85f_icedid_luca-stealer_njrat_qakbot_stealc

.exe 3.0MB

2026-07-05_5c086187244b1b07f545614ca9efa85f_icedid_luca-stealer_njrat_qakbot_stealc

IMPHASH 50b75f8798ba80fbda396a6e04e35419
SHA256 553f8bbbd862c6c1ef8315a9cc58903d2872eda06c106fe7061ed788d8394ae5
MD5 5c086187244b1b07f545614ca9efa85f
SHA1 d8bc1cfc2c110b907ddfcff8800773b27c6cd2e6
SHA512 94345c493f206be532d7678f0bc07f155255f993c5a72653bc47b086fe94007376a39d45c166e0520630853b2f5fdba39c7ae6bfeb64eb7bd1f57365268d4bd4
SSDEEP 98304:Hdswbru4gDqh2pb/AQb84gi4zgcBvCHVaoj+:6w8AQb8TNEcBvCHVaoj+
TLSH
T124E5E127E76410E9C0BBC178C91A5907E775784523306BDF56D09AA63FA3BE16E3E320
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1181568

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

bcrypt

BCryptGenerateSymmetricKey BCryptSetProperty BCryptCloseAlgorithmProvider BCryptOpenAlgorithmProvider BCryptDecrypt BCryptDestroyKey

wininet

InternetOpenUrlA InternetConnectA HttpSendRequestA InternetSetOptionA HttpOpenRequestA InternetReadFile InternetCloseHandle InternetOpenA

kernel32

SetFileAttributesA GetTickCount ReadFile CreateFileW CloseHandle GetFileSize LoadLibraryA DeleteFileA GetProcAddress LocalFree FreeLibrary CopyFileW SizeofResource Process32First WriteFile TerminateProcess FindResourceA WaitForSingleObject GetModuleHandleA OpenProcess CreateToolhelp32Snapshot CopyFileA CreateFileA LockResource Process32Next LoadResource CreateProcessA GlobalAlloc GlobalFree GlobalLock GlobalMemoryStatusEx GlobalUnlock GetComputerNameA LoadLibraryExA GetModuleFileNameA GetCurrentProcess GetEnvironmentVariableA CreateMutexA GetLastError ExitProcess GetDiskFreeSpaceExA IsDebuggerPresent CheckRemoteDebuggerPresent ExpandEnvironmentStringsA GetLocalTime WideCharToMultiByte FlushFileBuffers QueryPerformanceCounter MapViewOfFile CreateFileMappingW FormatMessageA GetSystemTime GetSystemInfo GetModuleHandleW SystemTimeToFileTime GetProcessHeap GetCurrentProcessId LockFileEx UnlockFile HeapDestroy HeapCompact HeapAlloc LoadLibraryW HeapReAlloc DeleteFileW WaitForSingleObjectEx FlushViewOfFile OutputDebugStringW GetFileAttributesExW GetFileAttributesA GetDiskFreeSpaceA FormatMessageW MultiByteToWideChar HeapSize HeapValidate UnmapViewOfFile GetFileAttributesW CreateMutexW GetTempPathW UnlockFileEx SetEndOfFile GetFullPathNameA SetFilePointer LockFile OutputDebugStringA GetDiskFreeSpaceW GetFullPathNameW HeapFree HeapCreate AreFileApisANSI RaiseException InitializeCriticalSection EnterCriticalSection LeaveCriticalSection TryEnterCriticalSection DeleteCriticalSection GetCurrentThreadId LCMapStringW CompareStringW VirtualProtect FlsFree FlsSetValue IsValidLocale GetTempPathA Sleep GetUserDefaultLCID EnumSystemLocalesW ReadConsoleW GetTimeZoneInformation SetStdHandle IsValidCodePage GetACP GetOEMCP GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW WriteConsoleW GetSystemTimeAsFileTime RtlUnwind FlsGetValue FlsAlloc GetConsoleMode GetLocaleInfoEx CreateDirectoryW FindClose FindFirstFileW FindFirstFileExW FindNextFileW GetFileInformationByHandle SetFileInformationByHandle GetFileInformationByHandleEx InitializeCriticalSectionEx EncodePointer DecodePointer LCMapStringEx CompareStringEx GetCPInfo GetStringTypeW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent InitializeSListHead GetStartupInfoW RtlUnwindEx RtlPcToFileHeader SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW GetFileType CreateThread ExitThread FreeLibraryAndExitThread GetModuleHandleExW GetStdHandle GetModuleFileNameW GetFileSizeEx SetFilePointerEx GetConsoleOutputCP GetLocaleInfoW

user32

EnumDisplayDevicesA GetDesktopWindow ReleaseDC PeekMessageA GetSystemMetrics GetDC

gdi32

CreateCompatibleBitmap SelectObject CreateCompatibleDC GetDIBits DeleteDC DeleteObject GetObjectA BitBlt

advapi32

RegEnumKeyA CredEnumerateW CredFree RegSetValueExA RegCloseKey GetCurrentHwProfileA RegQueryValueExA GetUserNameA RegOpenKeyExA

shell32

ShellExecuteA SHGetFolderPathA

Name

.text

Size

1.3MB

Virtual Size

1.3MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

245KB

Virtual Size

245KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

21KB

Virtual Size

28KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

58KB

Virtual Size

57KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1.4MB

Virtual Size

1.4MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-05_5c086187244b1b07f545614ca9efa85f_icedid_luca-stealer_njrat_qakbot_stealc

bcrypt

wininet

kernel32

user32

gdi32

advapi32

shell32

generic