2026-07-11_b03c44d840f43628da87e61a96ed14f9_icedid_luca-stealer_njrat_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-11_b03c44d840f43628da87e61a96ed14f9_icedid_luca-stealer_njrat_stealc
Size 4.3MB
Sample260711-ptplmsct8t
SHA256 d65dd6329f5aa54411998b9a0a0f39b5249680cfc241f766d8325824b759a3da
MD5 b03c44d840f43628da87e61a96ed14f9
SHA1 f08643dacd32cf03018c26eff66f2fea2aaf14fb
SHA512 a0fd6e44ec12df973940d2a993e56bf243d795565310c6ef671305f3be3ac065c0353850afdb01b34b84ffc56ec6e446d45c96e38e137bc5177567409891f660
SSDEEP 49152:6DkIbpF85dE5iqFR1n/lFUHfQYhjnPSFVVANeit:6tB/wCEr
TLSH
T11F26B54BEA7651E4C4FAC03A9553622FF871309AC3309BC7A6815A575B23BF4E93E740
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-11_b03c44d840f43628da87e61a96ed14f9_icedid_luca-stealer_njrat_stealc

File Explorer

2026-07-11_b03c44d840f43628da87e61a96ed14f9_icedid_luca-stealer_njrat_stealc

.exe 4.3MB

2026-07-11_b03c44d840f43628da87e61a96ed14f9_icedid_luca-stealer_njrat_stealc

IMPHASH 43471428b3fe0f09d5adc6bbdb580245
SHA256 d65dd6329f5aa54411998b9a0a0f39b5249680cfc241f766d8325824b759a3da
MD5 b03c44d840f43628da87e61a96ed14f9
SHA1 f08643dacd32cf03018c26eff66f2fea2aaf14fb
SHA512 a0fd6e44ec12df973940d2a993e56bf243d795565310c6ef671305f3be3ac065c0353850afdb01b34b84ffc56ec6e446d45c96e38e137bc5177567409891f660
SSDEEP 49152:6DkIbpF85dE5iqFR1n/lFUHfQYhjnPSFVVANeit:6tB/wCEr
TLSH
T11F26B54BEA7651E4C4FAC03A9553622FF871309AC3309BC7A6815A575B23BF4E93E740
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

3036136

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Build\Build_2021pd_D20250929T174559\fa_rss\engine\Release\PCAppStore.pdb

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

urlmon

CreateUri URLDownloadToFileW

kernel32

ResetEvent CreateEventW OpenEventW WaitForMultipleObjects GetModuleFileNameW LocalFree CreateFileW GetOverlappedResult ReadDirectoryChangesW CreateDirectoryW GetFileAttributesW FreeLibrary LoadLibraryW ExpandEnvironmentStringsW GetTickCount64 VerSetConditionMask FindClose FindFirstFileExW FindNextFileW ReadFile RemoveDirectoryW OpenProcess VerifyVersionInfoW LCIDToLocaleName GetUserDefaultUILanguage GetLocaleInfoEx GetConsoleOutputCP K32EnumProcessModules K32GetModuleBaseNameW Sleep GetStartupInfoW GetTickCount CopyFileA TerminateProcess IsProcessCritical GlobalAlloc GlobalFree QueryFullProcessImageNameW CreateToolhelp32Snapshot Process32FirstW Process32NextW K32EnumProcesses K32GetModuleFileNameExW GetTempPathW GetExitCodeProcess GetProcessId OpenMutexW OpenFileMappingW MapViewOfFile GetStdHandle GetEnvironmentVariableA SetCurrentDirectoryW FindFirstFileW GetCurrentProcess GetSystemTime SystemTimeToFileTime FileTimeToLocalFileTime lstrcmpA FileTimeToSystemTime FlushFileBuffers QueryPerformanceCounter CreateFileMappingW FormatMessageA GetSystemTimeAsFileTime GetFileSize LockFileEx UnlockFile HeapCompact GetSystemInfo DeleteFileA LoadLibraryA CreateFileA FlushViewOfFile GetFileAttributesExW GetFileAttributesA GetDiskFreeSpaceA GetTempPathA HeapValidate UnmapViewOfFile CreateMutexW UnlockFileEx SetEndOfFile GetFullPathNameA SetFilePointer LockFile OutputDebugStringA GetDiskFreeSpaceW WriteFile GetFullPathNameW HeapCreate AreFileApisANSI SetEnvironmentVariableW HeapReAlloc LeaveCriticalSection TryEnterCriticalSection DeleteCriticalSection DecodePointer InitializeCriticalSectionEx GlobalUnlock GlobalLock LoadLibraryExW GetEnvironmentVariableW IsValidCodePage GetConsoleMode GetACP GetOEMCP GetCommandLineA RaiseException GetExitCodeThread QueryPerformanceFrequency ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive SleepConditionVariableSRW GetCurrentDirectoryW GetFileInformationByHandle SetFileInformationByHandle GetFileInformationByHandleEx GetStringTypeW InitOnceBeginInitialize InitOnceComplete WakeAllConditionVariable EncodePointer LCMapStringEx CompareStringEx GetCPInfo InitializeSListHead RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter GetCommandLineW SetUnhandledExceptionFilter IsProcessorFeaturePresent RtlPcToFileHeader RtlUnwindEx WideCharToMultiByte InterlockedPushEntrySList SetEvent MultiByteToWideChar FormatMessageW InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue GetEnvironmentStringsW TlsFree CreateThread ExitThread FreeLibraryAndExitThread ExitProcess GetDriveTypeW GetFileType PeekNamedPipe SystemTimeToTzSpecificLocalTime FindResourceW SizeofResource LockResource LoadResource GetProcAddress GetModuleHandleExW GetModuleHandleW GetModuleFileNameA FindResourceExW GetCurrentThreadId GetCurrentProcessId CreateSemaphoreExW CreateMutexExW FlsAlloc FlsGetValue FlsSetValue FlsFree VirtualProtect GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW OpenSemaphoreW WaitForSingleObjectEx WaitForSingleObject ReleaseMutex ReleaseSemaphore GetProcessHeap HeapSize InitializeCriticalSection WriteConsoleW FreeEnvironmentStringsW HeapAlloc HeapDestroy SetLastError GetLastError CloseHandle OutputDebugStringW DebugBreak IsDebuggerPresent DeleteFileW SetStdHandle GetTimeZoneInformation HeapFree ReadConsoleW RtlUnwind SetFilePointerEx GetFileSizeEx EnterCriticalSection EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW

user32

AppendMenuW InsertMenuW GetMenuItemCount DestroyMenu CreatePopupMenu GetClassInfoExW RegisterClassExW AttachThreadInput SendMessageTimeoutW RegisterWindowMessageW UpdateWindow GetWindowLongPtrW SetWindowLongW SetRectEmpty TrackPopupMenu CloseClipboard LoadIconW ChangeWindowMessageFilterEx TrackMouseEvent GetCapture SetCapture PtInRect SetClassLongPtrW FillRect AdjustWindowRectEx GetClientRect IsZoomed GetWindowPlacement UnregisterClassW MonitorFromWindow LoadCursorW EqualRect InvalidateRect EndPaint BeginPaint PostMessageW DestroyWindow RemoveMenu CreateWindowExW RegisterClassW SetClipboardData EmptyClipboard ReleaseCapture OpenIcon SetWindowPlacement IsIconic SetWindowLongPtrW OpenClipboard PostQuitMessage DefWindowProcW FindWindowExW UnhookWinEvent GetForegroundWindow keybd_event SetCursorPos GetWindowTextW SetWindowPos wsprintfW GetPhysicalCursorPos GetSystemMetrics GetAsyncKeyState CallNextHookEx UnhookWindowsHookEx SetWindowsHookExW EnumChildWindows WindowFromPoint ScreenToClient GetCursorPos IsChild PostThreadMessageW SendMessageW GetMessageW GetThreadDpiAwarenessContext SetThreadDpiAwarenessContext EnumDisplayMonitors FindWindowW IntersectRect GetMonitorInfoW MonitorFromRect DialogBoxParamW MonitorFromPoint SystemParametersInfoW GetWindow GetWindowThreadProcessId GetClassNameW EnumWindows GetDesktopWindow ReleaseDC GetDC SendInput EndDialog IsWindowVisible SetWinEventHook PeekMessageW DispatchMessageW TranslateMessage KillTimer SetTimer SetForegroundWindow SetFocus ShowWindow IsWindow GetWindowRect SetWindowTextW

gdi32

BitBlt CreateCompatibleBitmap CreateCompatibleDC DeleteDC CreateSolidBrush DeleteObject SelectObject

winspool.drv

EnumPrintersW

advapi32

EventRegister RegGetValueW EventUnregister EventWriteTransfer EventSetInformation RegCreateKeyExW RegNotifyChangeKeyValue RegSetKeyValueW RegDeleteValueW RegCreateKeyW GetUserNameW RegSetValueExW RegQueryValueExW RegOpenKeyExW RegCloseKey

shell32

Shell_NotifyIconW ShellExecuteExW SHGetFolderPathW SHEmptyRecycleBinW SHQueryRecycleBinW CommandLineToArgvW SHGetKnownFolderPath SHAppBarMessage ShellExecuteW

ole32

RevokeDragDrop CoTaskMemAlloc CoAllowSetForegroundWindow OleRun CoInitialize CoCreateInstance OleInitialize CoInitializeSecurity RegisterDragDrop CoInitializeEx CoTaskMemFree CoUninitialize CoCreateFreeThreadedMarshaler CoSetProxyBlanket

oleaut32

VariantInit SysFreeString SysAllocString VariantChangeType SysStringLen GetErrorInfo VariantClear SetErrorInfo

iphlpapi

IcmpCreateFile IcmpCloseHandle

winhttp

WinHttpSendRequest WinHttpOpenRequest WinHttpSetTimeouts WinHttpConnect WinHttpCloseHandle WinHttpOpen WinHttpQueryDataAvailable WinHttpReadData WinHttpQueryHeaders WinHttpReceiveResponse

crypt32

CryptMsgClose CryptQueryObject CertGetNameStringW CertFreeCertificateContext CertFindCertificateInStore CertCloseStore CertOpenStore CryptMsgGetParam CryptMsgUpdate CryptDecodeObjectEx CryptDecodeObject CryptMsgOpenToDecode

ws2_32

closesocket recv send shutdown socket WSAStartup WSACleanup WSAGetLastError WSAConnectByNameW

sspicli

QueryContextAttributesW DecryptMessage EncryptMessage FreeContextBuffer FreeCredentialsHandle ApplyControlToken DeleteSecurityContext InitializeSecurityContextW AcquireCredentialsHandleW

ext-ms-win-networking-wlanapi-l1-1-0

WlanOpenHandle WlanEnumInterfaces WlanCloseHandle WlanGetAvailableNetworkList WlanFreeMemory

wlanapi

WlanRegisterNotification WlanScan WlanAllocateMemory

shlwapi

PathCreateFromUrlW PathFindFileNameW AssocCreate PathRenameExtensionW SHCreateStreamOnFileEx UrlCreateFromPathW PathAddBackslashW

api-ms-win-shcore-scaling-l1-1-1

GetDpiForMonitor

dwmapi

DwmSetWindowAttribute DwmGetWindowAttribute

wtsapi32

WTSRegisterSessionNotification WTSUnRegisterSessionNotification

gdiplus

GdipCloneImage GdiplusStartup GdiplusShutdown GdipAlloc GdipFlush GdipDisposeImage GdipCreateBitmapFromHBITMAP GdipCreateFromHDC GdipDeleteGraphics GdipFree GdipCreateMatrix GdipDeleteMatrix GdipSetStringFormatAlign GdipCloneBrush GdipDeleteBrush GdipCreateSolidFill GdipSetSmoothingMode GdipSetWorldTransform GdipTranslateWorldTransform GdipScaleWorldTransform GdipFillEllipse GdipDrawImageI GdipCreateFontFamilyFromName GdipDeleteFontFamily GdipCreateFont GdipDeleteFont GdipDrawString GdipCreateStringFormat GdipDeleteStringFormat

msi

ord70 ord8 ord32 ord159 ord160 ord92 ord118 ord45

wininet

InternetOpenUrlW InternetReadFile HttpQueryInfoW InternetCheckConnectionW InternetCloseHandle InternetOpenW

setupapi

SetupDiEnumDeviceInfo SetupDiGetClassDevsW SetupDiGetDeviceRegistryPropertyW SetupDiDestroyDeviceInfoList

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory

api-ms-win-core-winrt-error-l1-1-1

RoOriginateLanguageException

Name

.text

Size

3.2MB

Virtual Size

3.2MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

548KB

Virtual Size

547KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

158KB

Virtual Size

229KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

208KB

Virtual Size

207KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

96KB

Virtual Size

96KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

13KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-11_b03c44d840f43628da87e61a96ed14f9_icedid_luca-stealer_njrat_stealc

version

urlmon

kernel32

user32

gdi32

winspool.drv

advapi32

shell32

ole32

oleaut32

iphlpapi

winhttp

crypt32

ws2_32

sspicli

ext-ms-win-networking-wlanapi-l1-1-0

wlanapi

shlwapi

api-ms-win-shcore-scaling-l1-1-1

dwmapi

wtsapi32

gdiplus

msi

wininet

setupapi

api-ms-win-core-winrt-l1-1-0

api-ms-win-core-winrt-error-l1-1-1

generic