2026-07-09_b4372ecac0fc537b29a79ce3ab3a4e15_icedid_luca-stealer_njrat_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-09_b4372ecac0fc537b29a79ce3ab3a4e15_icedid_luca-stealer_njrat_stealc
Size 1.3MB
Sample260709-pghbssh12j
SHA256 6fb87864efe6cbaa383bf9cbe63cfec3af4744da7b15413317e78691eba4a008
MD5 b4372ecac0fc537b29a79ce3ab3a4e15
SHA1 f6b1897d54aaed5aa14a32b388be5578cc84c5f4
SHA512 bb203f789e903a784633e9289dcfc8fa7a4f92d7b76463915f39e75f716ea829345d4035f04a6c8860124a2be0cff7b0b0a11d57cb9a33a8b6eb749beafede65
SSDEEP 24576:QSA6RQd7qesa+MVNGZCHiumO9V/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:jXQhqesMbG1zALNiXicJFFRGNzj3
TLSH
T18755BF26A7E811F9E0BBD276CD634916FBB2B816573096CF03A4135A1F37A904E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-09_b4372ecac0fc537b29a79ce3ab3a4e15_icedid_luca-stealer_njrat_stealc

File Explorer

2026-07-09_b4372ecac0fc537b29a79ce3ab3a4e15_icedid_luca-stealer_njrat_stealc

.exe 1.3MB

2026-07-09_b4372ecac0fc537b29a79ce3ab3a4e15_icedid_luca-stealer_njrat_stealc

IMPHASH d4913e49a0ce4012e564c80f09ae511a
SHA256 6fb87864efe6cbaa383bf9cbe63cfec3af4744da7b15413317e78691eba4a008
MD5 b4372ecac0fc537b29a79ce3ab3a4e15
SHA1 f6b1897d54aaed5aa14a32b388be5578cc84c5f4
SHA512 bb203f789e903a784633e9289dcfc8fa7a4f92d7b76463915f39e75f716ea829345d4035f04a6c8860124a2be0cff7b0b0a11d57cb9a33a8b6eb749beafede65
SSDEEP 24576:QSA6RQd7qesa+MVNGZCHiumO9V/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:jXQhqesMbG1zALNiXicJFFRGNzj3
TLSH
T18755BF26A7E811F9E0BBD276CD634916FBB2B816573096CF03A4135A1F37A904E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

285120

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

MsSense.pdb

kernel32

GetProductInfo GetVersionExW GetModuleFileNameW VerifyVersionInfoW DeleteCriticalSection InitializeCriticalSectionEx CreateFileW FindFirstVolumeW FindNextVolumeW FindVolumeClose GetDriveTypeW GetLogicalDrives GetVolumeInformationW QueryDosDeviceW GetVolumeNameForVolumeMountPointW GetVolumePathNamesForVolumeNameW DeviceIoControl MultiByteToWideChar QueryPerformanceCounter CompareFileTime GetSystemTimeAsFileTime Sleep VerSetConditionMask LoadLibraryW CloseThreadpoolTimer WaitForThreadpoolTimerCallbacks DeleteFileW FindClose FindFirstFileW FindNextFileW FlushFileBuffers GetFileAttributesW RemoveDirectoryW SetFileAttributesW SetFilePointerEx WriteFile SetThreadpoolTimer CreateThreadpoolTimer AcquireSRWLockShared AcquireSRWLockExclusive ReleaseSRWLockShared MoveFileExW WriteConsoleW GetWindowsDirectoryW GetComputerNameExW LeaveCriticalSection EnterCriticalSection GlobalAlloc GetTempPathW SetStdHandle SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW FindFirstFileExW GetOEMCP GetTempFileNameW ReleaseSRWLockExclusive FreeLibrary TerminateProcess GetCurrentProcess InitOnceComplete InitOnceBeginInitialize WideCharToMultiByte FormatMessageW GetProcAddress GetACP IsValidCodePage GetModuleHandleExW CompareStringW GetConsoleMode GetConsoleOutputCP EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW DecodePointer HeapReAlloc HeapSize GetModuleHandleW GetModuleFileNameA GetCurrentThreadId GetCurrentProcessId LCMapStringW CreateSemaphoreExW CreateMutexExW FlsFree OpenSemaphoreW WaitForSingleObjectEx WaitForSingleObject FlsSetValue FlsGetValue FlsAlloc GetFileType GetLongPathNameW GetCommandLineW GetCommandLineA GetStdHandle ExitProcess LoadLibraryExW GlobalFree TlsFree TlsSetValue ExpandEnvironmentStringsW TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount InterlockedPushEntrySList RtlUnwindEx GetStartupInfoW IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext InitializeSListHead ReleaseMutex ReleaseSemaphore GetProcessHeap HeapFree HeapAlloc SetLastError GetLastError CloseHandle OutputDebugStringW DebugBreak IsDebuggerPresent RaiseException GetSystemInfo VirtualProtect VirtualQuery LoadLibraryExA GetModuleHandleExA LCMapStringEx GetCPInfo CompareStringEx RtlPcToFileHeader GetStringTypeW WakeAllConditionVariable SleepConditionVariableSRW EncodePointer

advapi32

GetSecurityDescriptorDacl RegDeleteKeyValueW RegOpenKeyExW RegCreateKeyExW OpenSCManagerW CloseServiceHandle RegSetValueExW StartServiceCtrlDispatcherW EventRegister EventUnregister EventSetInformation EventWriteTransfer GetSecurityDescriptorOwner GetSecurityDescriptorGroup RegGetValueW LookupPrivilegeValueW AdjustTokenPrivileges OpenServiceW StartServiceW OpenProcessToken SetNamedSecurityInfoW ConvertStringSecurityDescriptorToSecurityDescriptorW GetSecurityDescriptorSacl DestroyPrivateObjectSecurity QueryServiceConfigW ControlService RegCloseKey ChangeServiceConfigW

api-ms-win-core-featurestaging-l1-1-0

RecordFeatureError RecordFeatureUsage GetFeatureEnabledState UnsubscribeFeatureStateChangeNotification SubscribeFeatureStateChangeNotification

api-ms-win-core-featurestaging-l1-1-1

GetFeatureVariant

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

api-ms-win-core-path-l1-1-0

PathCchCombine

userenv

GetAllUsersProfileDirectoryW

ws2_32

InetNtopW

iphlpapi

GetUnicastIpAddressEntry GetIfEntry2 FreeMibTable GetUnicastIpAddressTable

setupapi

SetupOpenInfFileW SetupDiEnumDeviceInterfaces SetupDiEnumDeviceInfo SetupDiGetClassDevsW SetupDiGetDevicePropertyW SetupDiGetDeviceRegistryPropertyW SetupDiGetDeviceInterfaceDetailW SetupDiDestroyDeviceInfoList SetupInstallFromInfSectionW SetupInstallServicesFromInfSectionW

bcrypt

BCryptCloseAlgorithmProvider BCryptDestroyHash

ntdll

RtlInitUnicodeString

Name

.text

Size

480KB

Virtual Size

478KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

188KB

Virtual Size

187KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

16KB

Virtual Size

30KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

28KB

Virtual Size

24KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.didat

Size

4KB

Virtual Size

32B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.fptable

Size

4KB

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

44KB

Virtual Size

40KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

576KB

Virtual Size

580KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-09_b4372ecac0fc537b29a79ce3ab3a4e15_icedid_luca-stealer_njrat_stealc

kernel32

advapi32

api-ms-win-core-featurestaging-l1-1-0

api-ms-win-core-featurestaging-l1-1-1

version

api-ms-win-core-path-l1-1-0

userenv

ws2_32

iphlpapi

setupapi

bcrypt

ntdll

generic