2026-07-13_a3e02f13f0cc28f1def6215f9adba4c8_amadey_icedid_luca-stealer_njrat_smoke-loader_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-13_a3e02f13f0cc28f1def6215f9adba4c8_amadey_icedid_luca-stealer_njrat_smoke-loader_stealc
Size 1.9MB
Sample260713-bfpgtsaw2m
SHA256 7ebc7c64aa39399dc1c9063243e196306cb5211c8ae952f0197639a3a84414f3
MD5 a3e02f13f0cc28f1def6215f9adba4c8
SHA1 182b57b02f62448edde5ad1fa499b6ee98120f88
SHA512 0ce570f457e616c32066d78270573f702c5318f18a909cab83d3a3c3dc94da00429ae4d5bb9ae9a067a5da14027ea17d4567133eeff3936342163c1e5583df54
SSDEEP 24576:WcC8etlElfhMpAN4WIq1Bid+ju0C5FrgrjETOzTjC/s7DjkDZddLHC2ybA+G+GV:WcTetylSGBM+r1nDYD5LHbd+Gp
TLSH
T1F2956C26E3B610F8E8B7D134C9A29662FBB17805477897DF1790455A0F33BE09A3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects executables containing anti-forensic artifacts of deleting USN change journal. Observed in r 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_USNDeleteJournal

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-13_a3e02f13f0cc28f1def6215f9adba4c8_amadey_icedid_luca-stealer_njrat_smoke-loader_stealc

File Explorer

2026-07-13_a3e02f13f0cc28f1def6215f9adba4c8_amadey_icedid_luca-stealer_njrat_smoke-loader_stealc

.exe 1.9MB

2026-07-13_a3e02f13f0cc28f1def6215f9adba4c8_amadey_icedid_luca-stealer_njrat_smoke-loader_stealc

IMPHASH cc586d258688da612d514c03a7e639b8
SHA256 7ebc7c64aa39399dc1c9063243e196306cb5211c8ae952f0197639a3a84414f3
MD5 a3e02f13f0cc28f1def6215f9adba4c8
SHA1 182b57b02f62448edde5ad1fa499b6ee98120f88
SHA512 0ce570f457e616c32066d78270573f702c5318f18a909cab83d3a3c3dc94da00429ae4d5bb9ae9a067a5da14027ea17d4567133eeff3936342163c1e5583df54
SSDEEP 24576:WcC8etlElfhMpAN4WIq1Bid+ju0C5FrgrjETOzTjC/s7DjkDZddLHC2ybA+G+GV:WcTetylSGBM+r1nDYD5LHbd+Gp
TLSH
T1F2956C26E3B610F8E8B7D134C9A29662FBB17805477897DF1790455A0F33BE09A3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Detects executables containing anti-forensic artifacts of deleting USN change journal. Observed in r
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

336820

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

powrprof

PowerGetActiveScheme PowerReadFriendlyName PowerSetActiveScheme

advapi32

LookupPrivilegeValueA QueryServiceStatusEx QueryAllTracesA ControlTraceA RegSetValueExA RegCreateKeyExA RegCloseKey OpenServiceA OpenSCManagerA CloseServiceHandle QueryServiceStatus OpenProcessToken ChangeServiceConfigA AdjustTokenPrivileges RegOpenKeyExA RegQueryValueExA StartServiceA ControlService DeleteService CreateServiceA RegEnumKeyExA

user32

GetWindow IsWindowVisible PostMessageA EnumWindows GetWindowThreadProcessId UnregisterHotKey RegisterHotKey wsprintfW PeekMessageA RedrawWindow SetWindowTextA MoveWindow SetLayeredWindowAttributes GetWindowLongPtrA SetWindowLongPtrA SystemParametersInfoA GetForegroundWindow

kernel32

HeapSize WriteConsoleW SetStdHandle GetProcessHeap SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW HeapReAlloc ReadConsoleW ReadFile GetConsoleOutputCP FlushFileBuffers SetFilePointerEx GetFileSizeEx GetFileAttributesExW CreateProcessW FillConsoleOutputCharacterA SetConsoleCtrlHandler FindFirstFileA GetConsoleScreenBufferInfo SetConsoleTextAttribute SetConsoleTitleA SetConsoleScreenBufferSize GetStdHandle SetConsoleMode SetCurrentConsoleFontEx GetDriveTypeA SetConsoleWindowInfo FindNextFileA FindClose Sleep GetConsoleMode GetLargestConsoleWindowSize GetFileAttributesA GetLocalTime FillConsoleOutputAttribute GetCurrentConsoleFontEx GetLogicalDriveStringsA SetEndOfFile SetConsoleOutputCP SetConsoleCursorPosition SetProcessPriorityBoost SetPriorityClass SetProcessAffinityMask CreateFileW OpenProcess CreateToolhelp32Snapshot Process32NextW Process32FirstW CloseHandle GetPriorityClass GetExitCodeProcess GetProcessAffinityMask Thread32Next Thread32First GetLastError QueryFullProcessImageNameA GetThreadPriority GetCurrentProcessId WideCharToMultiByte OpenThread SetThreadAffinityMask SetProcessInformation TerminateProcess SetThreadPriority K32EmptyWorkingSet SuspendThread ResumeThread GetModuleHandleA LoadLibraryA SetThreadIdealProcessor SetThreadPriorityBoost GetProcAddress GetCurrentProcess GetLogicalProcessorInformationEx GetSystemInfo LocalFree GlobalMemoryStatusEx FreeLibrary GetModuleFileNameA GetThreadPriorityBoost QueryThreadCycleTime Module32FirstW Module32NextW WaitForSingleObject CreateProcessA DeviceIoControl CreateFileA GetEnvironmentVariableA GetTempPathA CreateDirectoryA K32EnumDeviceDrivers SizeofResource GetFileAttributesExA WriteFile FindResourceA GetCurrentDirectoryA RtlUnwind MoveFileExA SetDllDirectoryA LockResource DeleteFileA LoadResource SetFileAttributesA RemoveDirectoryA GetFileType GetConsoleWindow SetCurrentDirectoryA ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive GetCurrentThreadId WaitForSingleObjectEx GetExitCodeThread QueryPerformanceCounter WakeAllConditionVariable SleepConditionVariableSRW EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer MultiByteToWideChar LCMapStringEx GetSystemTimeAsFileTime GetModuleHandleW GetStringTypeW GetCPInfo RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent InitializeSListHead RtlUnwindEx RtlPcToFileHeader RaiseException SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW GetModuleHandleExW ExitProcess GetModuleFileNameW GetCommandLineA GetCommandLineW HeapAlloc HeapFree FlsAlloc FlsGetValue FlsSetValue FlsFree VirtualProtect CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW

gdi32

AddFontResourceExA

Name

.text

Size

521KB

Virtual Size

521KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

183KB

Virtual Size

182KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

6KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

19KB

Virtual Size

18KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1.2MB

Virtual Size

1.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-13_a3e02f13f0cc28f1def6215f9adba4c8_amadey_icedid_luca-stealer_njrat_smoke-loader_stealc

powrprof

advapi32

user32

kernel32

gdi32

generic