2026-07-18_34769deda5790264a12cd1291e3e70df_icedid_luca-stealer_njrat

General

Target
2026-07-18_34769deda5790264a12cd1291e3e70df_icedid_luca-stealer_njrat
Size 1.5MB
Sample260718-3vsxcaas51
SHA256 f0db25f16eb7bd2fbd68a305a4f9c79d5de98af308c80d76f9475af1f4ea29f8
MD5 34769deda5790264a12cd1291e3e70df
SHA1 f99b419ef6c63b6cc39110e65a6f959b62eb75b5
SHA512 78bb3469c64bf77c571001611c82af57fbed66a5b79e5e0bb7ddbf78ca1a697516a05b2bfc6e7dd73c2eb18ead2cc8b2f32fe366523149e6eac02c36f2d09ace
SSDEEP 24576:YtF5Pae92VZ/CLW5Q62xCMMf6YoqKqU2jkPWrQ1llRsZjW+ZlpqZaa1q:4F5CCIZ5R2xVtqnp4uE17Wt3Zlpqh
TLSH
T10E75F11AA2A401FCE1E7D174CD674903DA72F84A4B71A64F07E459D61F237A09E3EB22
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects executables Discord URL observed in first stage droppers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_DiscordURL

Detects executables using Telegram Chat Bot 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_TelegramChatBot

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-18_34769deda5790264a12cd1291e3e70df_icedid_luca-stealer_njrat

File Explorer

2026-07-18_34769deda5790264a12cd1291e3e70df_icedid_luca-stealer_njrat

.exe 1.5MB

2026-07-18_34769deda5790264a12cd1291e3e70df_icedid_luca-stealer_njrat

IMPHASH 41c7a73c2b9ca73950714007dd9837b0
SHA256 f0db25f16eb7bd2fbd68a305a4f9c79d5de98af308c80d76f9475af1f4ea29f8
MD5 34769deda5790264a12cd1291e3e70df
SHA1 f99b419ef6c63b6cc39110e65a6f959b62eb75b5
SHA512 78bb3469c64bf77c571001611c82af57fbed66a5b79e5e0bb7ddbf78ca1a697516a05b2bfc6e7dd73c2eb18ead2cc8b2f32fe366523149e6eac02c36f2d09ace
SSDEEP 24576:YtF5Pae92VZ/CLW5Q62xCMMf6YoqKqU2jkPWrQ1llRsZjW+ZlpqZaa1q:4F5CCIZ5R2xVtqnp4uE17Wt3Zlpqh
TLSH
T10E75F11AA2A401FCE1E7D174CD674903DA72F84A4B71A64F07E459D61F237A09E3EB22
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects executables Discord URL observed in first stage droppers
Detects executables using Telegram Chat Bot
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

1381408

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

winhttp

WinHttpSetTimeouts WinHttpCloseHandle WinHttpQueryDataAvailable WinHttpSetOption WinHttpOpenRequest WinHttpReadData WinHttpOpen WinHttpSendRequest WinHttpReceiveResponse WinHttpConnect

kernel32

EncodePointer SetEndOfFile WriteConsoleW HeapSize SetStdHandle GetProcessHeap SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP GetACP IsValidCodePage HeapReAlloc ReadConsoleW EnumSystemLocalesW GetUserDefaultLCID GetConsoleScreenBufferInfo SetConsoleTextAttribute GetStdHandle Sleep CloseHandle WideCharToMultiByte SetConsoleOutputCP ExpandEnvironmentStringsW WaitForSingleObject ReadFile SetFilePointer CreateFileW GetLastError CreateProcessW WriteFile CreateNamedPipeW PeekNamedPipe GetCurrentThreadId GetCurrentProcessId GetTickCount ConnectNamedPipe GetModuleHandleW GetModuleFileNameW GetCurrentDirectoryW CreateDirectoryW FindClose FindFirstFileW FindFirstFileExW FindNextFileW GetFileAttributesExW GetFinalPathNameByHandleW SetFileInformationByHandle AreFileApisANSI GetProcAddress GetFileInformationByHandleEx MultiByteToWideChar LocalFree FormatMessageA GetLocaleInfoEx EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection RtlUnwind DecodePointer GetStringTypeW LCMapStringEx GetCPInfo RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent QueryPerformanceCounter GetSystemTimeAsFileTime InitializeSListHead GetCurrentProcess TerminateProcess IsValidLocale RtlUnwindEx RtlPcToFileHeader RaiseException SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW ExitProcess GetModuleHandleExW GetCommandLineA GetCommandLineW GetFileSizeEx SetFilePointerEx GetFileType HeapAlloc FlushFileBuffers GetConsoleOutputCP GetConsoleMode HeapFree FlsAlloc FlsGetValue FlsSetValue FlsFree VirtualProtect CompareStringW LCMapStringW GetLocaleInfoW

Name

.text

Size

1.5MB

Virtual Size

1.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

14KB

Virtual Size

14KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-18_34769deda5790264a12cd1291e3e70df_icedid_luca-stealer_njrat

version

winhttp

kernel32

generic