2026-07-12_32e04b3d9d26c1a2087d349be3f29ff0_icedid_luca-stealer_njrat

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-12_32e04b3d9d26c1a2087d349be3f29ff0_icedid_luca-stealer_njrat
Size 2.6MB
Sample260712-q2rxeaaz5n
SHA256 0f1f37e7ce169ea992084a8dafa8b68fcfb1e259f009124c40ce072cef16b48c
MD5 32e04b3d9d26c1a2087d349be3f29ff0
SHA1 553ada00ad3dfe896460bf071761cea9909ded10
SHA512 1e8e826a5fbf1627cc6c2ceb2fca56b15a64ffd6b2151f04bdeb8e99ddad862eb14fa87904c87f98ca73bd4ce63647a48274585f7a3090e0dd6c09d79774b22c
SSDEEP 49152:oexvGWmqBD3e8rovOvlEoBuhZcsNfarqQVyDrzKHM:oT013H+roGvfaiWHM
TLSH
T1BDC5BF26A7F8074DF5F3AA359E748C3FF526FD29A925D60E020005491E2A7E29C74F63
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-07-12_32e04b3d9d26c1a2087d349be3f29ff0_icedid_luca-stealer_njrat

File Explorer

2026-07-12_32e04b3d9d26c1a2087d349be3f29ff0_icedid_luca-stealer_njrat

.exe 2.6MB

2026-07-12_32e04b3d9d26c1a2087d349be3f29ff0_icedid_luca-stealer_njrat

IMPHASH 5b3f6b6f9bec9d3d6fea24237b79c9f0
SHA256 0f1f37e7ce169ea992084a8dafa8b68fcfb1e259f009124c40ce072cef16b48c
MD5 32e04b3d9d26c1a2087d349be3f29ff0
SHA1 553ada00ad3dfe896460bf071761cea9909ded10
SHA512 1e8e826a5fbf1627cc6c2ceb2fca56b15a64ffd6b2151f04bdeb8e99ddad862eb14fa87904c87f98ca73bd4ce63647a48274585f7a3090e0dd6c09d79774b22c
SSDEEP 49152:oexvGWmqBD3e8rovOvlEoBuhZcsNfarqQVyDrzKHM:oT013H+roGvfaiWHM
TLSH
T1BDC5BF26A7F8074DF5F3AA359E748C3FF526FD29A925D60E020005491E2A7E29C74F63
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

a4:a1:08:86:c7:fc:f7:b9:39:51:b7:70:d8:53:67:e2:45:80:09:20:b5:72:6d:d9:1b:9c:a4:97:a0:11:28:a2

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=Beijing Duyou Science and Technology Co.\,Ltd.,O=Beijing Duyou Science and Technology Co.\,Ltd.,ST=Beijing,C=CN

Chains

Apr 13, 2026

CN=Beijing Duyou Science and Technology Co.\,Ltd.,O=Beijing Duyou Science and Technology Co.\,Ltd.,ST=Beijing,C=CN

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

PE Signature issue

Digest

69:2d:24:6e:8f:85:e5:fa:95:73:88:2c:b1:c8:9c:72:06:f6:a7:e0

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=Beijing Duyou Science and Technology Co.\,Ltd.,O=Beijing Duyou Science and Technology Co.\,Ltd.,ST=Beijing,C=CN

Chains

Apr 13, 2026

CN=Beijing Duyou Science and Technology Co.\,Ltd.,O=Beijing Duyou Science and Technology Co.\,Ltd.,ST=Beijing,C=CN

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Serial Number

1b:b5:8f:25:2a:df:23:00:49:28:c9:ae:3d:7e:ed:27

Issuer

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

May 31, 2021 - Sep 17, 2029

Subject

CN=Certum Timestamp 2026,O=Asseco Data Systems S.A.,C=PL

Serial Number

28:f0:77:c1:1c:36:bd:fe:5f:74:32:47:70:27:2e:03

Issuer

CN=Certum Timestamping 2021 CA,O=Asseco Data Systems S.A.,C=PL

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 11, 2026 - Feb 27, 2036

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=Certum Timestamping 2021 CA,O=Asseco Data Systems S.A.,C=PL

Serial Number

e7:ff:69:c7:3b:35:ce:4b:91:26:d8:74:7c:68:a5:87

Issuer

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 19, 2021 - May 18, 2036

Subject

CN=Beijing Duyou Science and Technology Co.\,Ltd.,O=Beijing Duyou Science and Technology Co.\,Ltd.,ST=Beijing,C=CN

Serial Number

0d:6e:19:12:bb:a3:1f:61:ea:6a:ef:ee:89:21:fc:c8

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Oct 17, 2023 - Jan 13, 2027

Subject

CN=Sectigo Public Time Stamping Signer R36,O=Sectigo Limited,ST=West Yorkshire,C=GB

Serial Number

a4:29:3b:6e:1e:dd:d7:a7:34:08:87:ad:7a:4e:b7:24

Issuer

CN=Sectigo Public Time Stamping CA R36,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 27, 2025 - Mar 21, 2036

Subject

CN=Sectigo Public Time Stamping CA R36,O=Sectigo Limited,C=GB

Serial Number

7a:23:ae:da:53:69:96:0f:91:c8:3e:5c:f4:c7:e3:3f

Issuer

CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Mar 21, 2036

Subject

CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

Serial Number

36:c2:b0:bd:7c:1b:3a:e7:a3:b3:dd:36:cb:c9:75:68

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Jan 18, 2038

Minor OS version

Major OS version

Entry point

29152

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

GetLastError QueryPerformanceCounter QueryPerformanceFrequency GetProcessHeap HeapCompact Sleep GetCurrentProcessId ExitProcess OpenProcess GlobalMemoryStatusEx GetSystemInfo GetTickCount GetTickCount64 VirtualAlloc VirtualFree GetModuleFileNameW lstrlenW QueryFullProcessImageNameW MoveFileW MoveFileExW CreateToolhelp32Snapshot Process32FirstW Process32NextW WriteConsoleW ReadConsoleW SetFilePointerEx SetFilePointer GetConsoleMode CloseHandle FlushFileBuffers HeapReAlloc HeapSize SetConsoleCtrlHandler LCMapStringW CompareStringW ReadFile GetFileSize FindNextFileW FindFirstFileW FindClose DeleteFileW GetTimeFormatW GetDateFormatW VirtualProtect InitializeCriticalSectionEx IsThreadAFiber FlsFree FlsSetValue FlsGetValue FlsAlloc GetTempPathW EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW GetStringTypeW GetFileType GetConsoleOutputCP WriteFile SetStdHandle SetEnvironmentVariableW FreeEnvironmentStringsW GetCurrentDirectoryW GetCommandLineW DeviceIoControl GetFileSizeEx CreateFileW GetEnvironmentStringsW RtlUnwind WideCharToMultiByte MultiByteToWideChar RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW GetModuleHandleW RtlUnwindEx InterlockedPushEntrySList InterlockedFlushSList SetLastError EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary GetProcAddress LoadLibraryExW EncodePointer RaiseException RtlPcToFileHeader GetStdHandle GetModuleHandleExW GetCurrentThread OutputDebugStringW HeapAlloc HeapFree FindFirstFileExW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA

user32

GetLastInputInfo GetSystemMetrics GetDC ReleaseDC SystemParametersInfoW MessageBoxW LoadStringW wsprintfW PeekMessageW GetMessagePos

advapi32

RegQueryValueExW RegCloseKey RegOpenKeyExW RegEnumKeyExW RegCreateKeyExW

ole32

CoUninitialize OleInitialize CoInitialize CoCreateInstance CreateStreamOnHGlobal

oleaut32

VariantInit SysAllocString SysFreeString

shell32

ShellExecuteExW CommandLineToArgvW SHGetSpecialFolderPathW SHGetFileInfoW SHCreateDirectoryExW

gdi32

GetDeviceCaps

version

GetFileVersionInfoSizeW VerQueryValueW

comctl32

ImageList_Create InitCommonControlsEx

comdlg32

GetOpenFileNameW

bcrypt

BCryptOpenAlgorithmProvider

propsys

PSGetPropertyFromPropertyStorage

Name

.text

Size

400KB

Virtual Size

400KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

99KB

Virtual Size

98KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

19KB

Virtual Size

18KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

225KB

Virtual Size

224KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-12_32e04b3d9d26c1a2087d349be3f29ff0_icedid_luca-stealer_njrat

PE Signature issue

PE Signature issue

kernel32

user32

advapi32

ole32

oleaut32

shell32

gdi32

version

comctl32

comdlg32

bcrypt

propsys

generic