2026-07-13_d55e2d7cd941e51dd301bf32dd030c82_icedid_luca-stealer_njrat_ryuk_stealc

General

Target
2026-07-13_d55e2d7cd941e51dd301bf32dd030c82_icedid_luca-stealer_njrat_ryuk_stealc
Size 3.0MB
Sample260713-bdv7lacw21
SHA256 5615533ffacb69baf0d87194bb19a9a95dbc5a269d6a7315010c905c3f5f7909
MD5 d55e2d7cd941e51dd301bf32dd030c82
SHA1 412033b222689dd6c42d975f49fb999403410563
SHA512 9d919abd69a2273fb8c706ae2f5454885e0c968875b919ca10ebcdc4550d16cd785e3218eb85131ee24279cb5da6011121b589863619c14861f50cf9c16d88f6
SSDEEP 49152:CH0cD1pTwwGQRAkUZBsM0L5FSpc6koA7TgRevoter0b8c9tTP8f1xDf:gbswGvkUZd0L5FSpcTp7TWqLr0bhLYvL
TLSH
T144E52254FDD500AAD463463040228E39E2727F566B2C8AAB16F1B2599F7F0D11E7AF23
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-13_d55e2d7cd941e51dd301bf32dd030c82_icedid_luca-stealer_njrat_ryuk_stealc

File Explorer

2026-07-13_d55e2d7cd941e51dd301bf32dd030c82_icedid_luca-stealer_njrat_ryuk_stealc

.exe 3.0MB

2026-07-13_d55e2d7cd941e51dd301bf32dd030c82_icedid_luca-stealer_njrat_ryuk_stealc

IMPHASH c5e134cc1c1e4c253962fc1102568c64
SHA256 5615533ffacb69baf0d87194bb19a9a95dbc5a269d6a7315010c905c3f5f7909
MD5 d55e2d7cd941e51dd301bf32dd030c82
SHA1 412033b222689dd6c42d975f49fb999403410563
SHA512 9d919abd69a2273fb8c706ae2f5454885e0c968875b919ca10ebcdc4550d16cd785e3218eb85131ee24279cb5da6011121b589863619c14861f50cf9c16d88f6
SSDEEP 49152:CH0cD1pTwwGQRAkUZBsM0L5FSpc6koA7TgRevoter0b8c9tTP8f1xDf:gbswGvkUZd0L5FSpcTp7TWqLr0bhLYvL
TLSH
T144E52254FDD500AAD463463040228E39E2727F566B2C8AAB16F1B2599F7F0D11E7AF23
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

30852

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

ole32

CoCreateInstance CoInitializeEx CoUninitialize

oleaut32

SysAllocString VariantClear VariantInit SysFreeString

advapi32

RegSetValueExA RegOpenKeyExA RegCloseKey GetUserNameA RegCreateKeyExA

kernel32

GetConsoleOutputCP SetFilePointerEx GetConsoleMode CreateFileW WriteConsoleW HeapSize FlushFileBuffers IsProcessorFeaturePresent GetEnvironmentVariableA CreateDirectoryA CreateFileA DeleteFileA GetFileAttributesA WriteFile GetTempPathA GetTempFileNameA CloseHandle Sleep GetModuleFileNameA GetModuleHandleA GetProcAddress CopyFileA GetComputerNameA GetModuleHandleW VirtualAlloc VirtualProtect AddVectoredExceptionHandler RemoveVectoredExceptionHandler GetCurrentThread GetThreadContext SetThreadContext WaitForSingleObject GetExitCodeProcess CreateProcessA MultiByteToWideChar FreeLibrary GetCurrentProcessId GetTickCount GetFileSize ReadFile GetCurrentProcess LoadLibraryA GetTickCount64 WideCharToMultiByte InitializeCriticalSection EnterCriticalSection LeaveCriticalSection DeleteCriticalSection VirtualFree GetLastError LocalFree GetProcessHeap LCMapStringW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess QueryPerformanceCounter GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW RtlPcToFileHeader RaiseException RtlUnwindEx SetLastError EncodePointer InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW GetStdHandle GetModuleFileNameW ExitProcess GetModuleHandleExW HeapFree HeapAlloc GetFileType HeapReAlloc FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle GetStringTypeW FlsAlloc FlsGetValue FlsSetValue FlsFree InitializeCriticalSectionEx

Name

.text

Size

123KB

Virtual Size

122KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

52KB

Virtual Size

52KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

2.8MB

Virtual Size

2.8MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-13_d55e2d7cd941e51dd301bf32dd030c82_icedid_luca-stealer_njrat_ryuk_stealc

ole32

oleaut32

advapi32

kernel32

generic