2026-07-15_91ad9fd7b72257504009cbcb0b1248ec_icedid_luca-stealer_njrat_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-15_91ad9fd7b72257504009cbcb0b1248ec_icedid_luca-stealer_njrat_stealc
Size 1.8MB
Sample260715-ssprssft8l
SHA256 5a3e81fae4c028c72c2547d2157f82d031af0101eb404efb631f862452ff0392
MD5 91ad9fd7b72257504009cbcb0b1248ec
SHA1 5488e6a004f8a0b20bc62c06822ee81aadf89319
SHA512 fddbbdcb9f51a0900e3a384c058de06ed1c6d8f3461faecab6ff8b049bf84bfd9a7eae19f0bf863264804f9e148787b33a744ae2b55dceb5f58172a5c299d59e
SSDEEP 12288:RNUsXPXApetpLxfA+EY53zeyZqpFABFvtpC8TkZN/5IeL:RNUsXPXxtM+ESjeyZqpypC8TQhNL
TLSH
T17895D88523DFD5B3D43F89364F116EDEA9357C9086B0626A23F08C539A37B436A99343
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-15_91ad9fd7b72257504009cbcb0b1248ec_icedid_luca-stealer_njrat_stealc

File Explorer

2026-07-15_91ad9fd7b72257504009cbcb0b1248ec_icedid_luca-stealer_njrat_stealc

.exe 1.8MB

2026-07-15_91ad9fd7b72257504009cbcb0b1248ec_icedid_luca-stealer_njrat_stealc

IMPHASH f83f95022b72a65675d2edb9e03e4129
SHA256 5a3e81fae4c028c72c2547d2157f82d031af0101eb404efb631f862452ff0392
MD5 91ad9fd7b72257504009cbcb0b1248ec
SHA1 5488e6a004f8a0b20bc62c06822ee81aadf89319
SHA512 fddbbdcb9f51a0900e3a384c058de06ed1c6d8f3461faecab6ff8b049bf84bfd9a7eae19f0bf863264804f9e148787b33a744ae2b55dceb5f58172a5c299d59e
SSDEEP 12288:RNUsXPXApetpLxfA+EY53zeyZqpFABFvtpC8TkZN/5IeL:RNUsXPXxtM+ESjeyZqpypC8TQhNL
TLSH
T17895D88523DFD5B3D43F89364F116EDEA9357C9086B0626A23F08C539A37B436A99343
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

301748

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

U44g8IoQ5GVPVFewY3K4787CC2EKw5wqwWto2Bt641peuwg1CJ9BsBlp731ru7X8

kernel32

GetCurrentProcess FreeLibrary GetModuleFileNameA GetProcAddress LoadLibraryA lstrlenW GetThreadLocale K32EnumProcessModules SetCurrentDirectoryW DeleteFileW GetFileAttributesW CloseHandle GetLastError SuspendThread ResumeThread CreateProcessW GetModuleFileNameW LoadLibraryW FormatMessageA WriteConsoleW SetEndOfFile HeapSize GetFileSizeEx GetConsoleOutputCP FlushFileBuffers CreateFileW SetConsoleCtrlHandler GetProcessHeap QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent GetModuleHandleW RtlPcToFileHeader RaiseException RtlUnwindEx InterlockedPushEntrySList InterlockedFlushSList SetLastError EncodePointer EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW TerminateProcess ExitProcess GetModuleHandleExW ReadFile GetStdHandle WriteFile GetCurrentThread HeapFree HeapAlloc HeapReAlloc GetConsoleMode ReadConsoleW SetFilePointerEx GetFileType OutputDebugStringW FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle GetStringTypeW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetTempPathW FlsAlloc FlsGetValue FlsSetValue FlsFree IsThreadAFiber InitializeCriticalSectionEx VirtualProtect GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW RtlUnwind

user32

MessageBoxW MessageBoxA

shell32

CommandLineToArgvW

shlwapi

StrCmpW PathRemoveFileSpecW

Name

.text

Size

697KB

Virtual Size

696KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

83KB

Virtual Size

83KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

21KB

Virtual Size

21KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

46KB

Virtual Size

46KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.tNCD7

Size

1024KB

Virtual Size

1024KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-15_91ad9fd7b72257504009cbcb0b1248ec_icedid_luca-stealer_njrat_stealc

kernel32

user32

shell32

shlwapi

generic