2026-07-14_08769d98a15d7f851b77f44ed99222fb_icedid_luca-stealer_njrat_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-14_08769d98a15d7f851b77f44ed99222fb_icedid_luca-stealer_njrat_stealc
Size 3.4MB
Sample260714-e81x4sgw8v
SHA256 008cfb16257c27712a85bfa72b49f2ae5c21b5e7da7efd93a2c2ac354620eb16
MD5 08769d98a15d7f851b77f44ed99222fb
SHA1 40e3467f6b3136a3e77698c26c8e34ac7429ec4c
SHA512 1eb3a1787373b2c851a8992c97f5bc12c66882b2894f703c1bd12a7107be482090e59a9f599b073605ae5ae967d8f54d6e7913d8eb089d74319d83d25ad53416
SSDEEP 49152:S1rh4I3z5A7830+Ip56n9lAk2nwUQyIn/ko4+9IdVY//g/1VJMun+:S1ao3LAk2nwUDI/kZ+9QV6g
TLSH
T189F5BE1763A910BCD4B2D23DDA975917EA7234190B7059EF03E00D852FA7BE06B7BB12
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-14_08769d98a15d7f851b77f44ed99222fb_icedid_luca-stealer_njrat_stealc

File Explorer

2026-07-14_08769d98a15d7f851b77f44ed99222fb_icedid_luca-stealer_njrat_stealc

.exe 3.4MB

2026-07-14_08769d98a15d7f851b77f44ed99222fb_icedid_luca-stealer_njrat_stealc

IMPHASH 59f2ee3ede3c66d644cda3e6dc7d4043
SHA256 008cfb16257c27712a85bfa72b49f2ae5c21b5e7da7efd93a2c2ac354620eb16
MD5 08769d98a15d7f851b77f44ed99222fb
SHA1 40e3467f6b3136a3e77698c26c8e34ac7429ec4c
SHA512 1eb3a1787373b2c851a8992c97f5bc12c66882b2894f703c1bd12a7107be482090e59a9f599b073605ae5ae967d8f54d6e7913d8eb089d74319d83d25ad53416
SSDEEP 49152:S1rh4I3z5A7830+Ip56n9lAk2nwUQyIn/ko4+9IdVY//g/1VJMun+:S1ao3LAk2nwUDI/kZ+9QV6g
TLSH
T189F5BE1763A910BCD4B2D23DDA975917EA7234190B7059EF03E00D852FA7BE06B7BB12
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

982588

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

ws2_32

inet_pton WSAGetLastError WSACleanup WSAStartup socket setsockopt send recv ntohs htons getsockname connect closesocket bind

user32

SetWindowPos IsIconic GetAsyncKeyState GetSystemMetrics UpdateWindow GetForegroundWindow SetForegroundWindow GetWindowRect GetWindowLongPtrW SetWindowLongPtrW LoadCursorW LoadIconW RegisterHotKey ShowWindow GetKeyState OpenClipboard CloseClipboard SetClipboardData GetClipboardData EmptyClipboard GetKeyboardLayout TrackMouseEvent TranslateMessage DispatchMessageW PeekMessageW SendMessageW DefWindowProcW PostQuitMessage SetLayeredWindowAttributes DestroyWindow UnregisterHotKey UnregisterClassW RegisterClassExW GetMessageExtraInfo LoadCursorA SetCapture ScreenToClient ClientToScreen GetCursorPos SetCursor SetCursorPos GetClientRect IsWindowUnicode ReleaseCapture GetCapture CreateWindowExW

d3d11

D3D11CreateDeviceAndSwapChain

shell32

ShellExecuteW CommandLineToArgvW

dwmapi

DwmSetWindowAttribute

ole32

CoInitializeEx CoUninitialize CoCreateInstance

d3dcompiler_47

D3DCompile

winhttp

WinHttpQueryHeaders WinHttpReceiveResponse WinHttpSendRequest WinHttpOpen WinHttpCloseHandle WinHttpConnect WinHttpReadData WinHttpQueryDataAvailable WinHttpSetTimeouts WinHttpOpenRequest WinHttpAddRequestHeaders

advapi32

RegOpenKeyExW RegCloseKey RegQueryValueExW

bcrypt

BCryptDestroyHash BCryptFinishHash BCryptHashData BCryptCreateHash BCryptDestroyKey BCryptOpenAlgorithmProvider BCryptGenerateSymmetricKey BCryptDecrypt BCryptCloseAlgorithmProvider BCryptSetProperty

kernel32

GetTimeZoneInformation ReadConsoleW SetFilePointerEx GetFileSizeEx GetConsoleMode GetConsoleOutputCP FlushFileBuffers GetFileType EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW VirtualProtect FlsFree FlsSetValue IsValidCodePage FlsAlloc GetEnvironmentStringsW HeapFree HeapAlloc GetStdHandle ExitProcess LoadLibraryExW TlsFree TlsSetValue HeapSize TlsAlloc InitializeCriticalSectionAndSpinCount SetLastError RtlUnwindEx HeapReAlloc GetACP GetOEMCP FlsGetValue GetCommandLineA InitializeSListHead GetCurrentProcess GetStartupInfoW SetUnhandledExceptionFilter FreeEnvironmentStringsW SetEnvironmentVariableW GetProcessHeap UnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext GetCPInfo GetStringTypeW LCMapStringEx DecodePointer EncodePointer SetStdHandle GetSystemTimeAsFileTime WriteConsoleW SetEndOfFile TlsGetValue GlobalLock DeleteCriticalSection InitializeCriticalSectionEx LeaveCriticalSection EnterCriticalSection IsProcessorFeaturePresent GetModuleHandleExW CloseThreadpoolWork SubmitThreadpoolWork CreateThreadpoolWork GetCommandLineW GetEnvironmentVariableW CreateFileW GetFileAttributesW WriteFile CloseHandle GetLastError WaitForSingleObject Sleep GetCurrentProcessId TerminateProcess GetExitCodeProcess CreateRemoteThread GetExitCodeThread CreateProcessW OpenProcess GetSystemTime GetTickCount64 VirtualAllocEx WriteProcessMemory VirtualFreeEx GetModuleFileNameW GetModuleHandleW GetProcAddress LoadResource LockResource SizeofResource FindResourceW LocalFree MultiByteToWideChar WideCharToMultiByte CreateToolhelp32Snapshot Process32FirstW Process32NextW CreateDirectoryW DeleteFileW ReadFile OutputDebugStringA GlobalAlloc GlobalUnlock RtlUnwind GlobalFree QueryPerformanceCounter QueryPerformanceFrequency FreeLibrary LoadLibraryA GetLocaleInfoA IsDBCSLeadByte RtlPcToFileHeader RaiseException ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive GetCurrentThreadId WakeAllConditionVariable SleepConditionVariableSRW FormatMessageA GetLocaleInfoEx InitOnceBeginInitialize InitOnceComplete FindClose FindFirstFileW FindFirstFileExW FindNextFileW GetFileAttributesExW GetFullPathNameW SetFileInformationByHandle GetTempPathW AreFileApisANSI MoveFileExW GetFileInformationByHandleEx FreeLibraryWhenCallbackReturns

imm32

ImmGetContext ImmSetCompositionWindow ImmSetCandidateWindow ImmReleaseContext

Name

.text

Size

1.2MB

Virtual Size

1.2MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

305KB

Virtual Size

305KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

37KB

Virtual Size

44KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

48KB

Virtual Size

47KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1.8MB

Virtual Size

1.8MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-14_08769d98a15d7f851b77f44ed99222fb_icedid_luca-stealer_njrat_stealc

ws2_32

user32

d3d11

shell32

dwmapi

ole32

d3dcompiler_47

winhttp

advapi32

bcrypt

kernel32

imm32

generic