2026-07-18_10b055312e4c014c9117362249ef238f_icedid_luca-stealer_njrat

General

Target
2026-07-18_10b055312e4c014c9117362249ef238f_icedid_luca-stealer_njrat
Size 1.5MB
Sample260718-3xfd2aas9v
SHA256 2e41002e1f6848748f6afe28caea7f6d46675acf3de9157f6f8faf43f2ae1f76
MD5 10b055312e4c014c9117362249ef238f
SHA1 36b4ba8d140156d4c440bdb9598ea4ef1df1f933
SHA512 8dced7a1fa78e785cdfc9f840aaf44aaed6267405b4f819507498b62e1231445fd22d12fba2656cf077bf2c7776b962e29fd5d5e25f4e7134fb6ec7bac8749b9
SSDEEP 24576:uk7btrFBbfqN7tCbbK31erCqaVYyGBY4ThCd9fmzv/+sGMwXXC0zrU/Nxyz66:u8Vjy40eOqaeetdgDWsAyOrU/S
TLSH
T18675021F57A500FDD0EBC2B4CD564A07D6B2F80A4B71A69F03E549961F237A09E3E722
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects executables Discord URL observed in first stage droppers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_DiscordURL

Detects executables using Telegram Chat Bot 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_TelegramChatBot

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-18_10b055312e4c014c9117362249ef238f_icedid_luca-stealer_njrat

File Explorer

2026-07-18_10b055312e4c014c9117362249ef238f_icedid_luca-stealer_njrat

.exe 1.5MB

2026-07-18_10b055312e4c014c9117362249ef238f_icedid_luca-stealer_njrat

IMPHASH 5d54686eb8d6133657508d5c3bce9d83
SHA256 2e41002e1f6848748f6afe28caea7f6d46675acf3de9157f6f8faf43f2ae1f76
MD5 10b055312e4c014c9117362249ef238f
SHA1 36b4ba8d140156d4c440bdb9598ea4ef1df1f933
SHA512 8dced7a1fa78e785cdfc9f840aaf44aaed6267405b4f819507498b62e1231445fd22d12fba2656cf077bf2c7776b962e29fd5d5e25f4e7134fb6ec7bac8749b9
SSDEEP 24576:uk7btrFBbfqN7tCbbK31erCqaVYyGBY4ThCd9fmzv/+sGMwXXC0zrU/Nxyz66:u8Vjy40eOqaeetdgDWsAyOrU/S
TLSH
T18675021F57A500FDD0EBC2B4CD564A07D6B2F80A4B71A69F03E549961F237A09E3E722
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects executables Discord URL observed in first stage droppers
Detects executables using Telegram Chat Bot
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

1388288

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

version

VerQueryValueW GetFileVersionInfoW GetFileVersionInfoSizeW

winhttp

WinHttpOpenRequest WinHttpSetOption WinHttpCloseHandle WinHttpOpen WinHttpSetTimeouts WinHttpConnect WinHttpQueryDataAvailable WinHttpReadData WinHttpReceiveResponse WinHttpSendRequest

iphlpapi

GetAdaptersInfo

kernel32

WriteConsoleW HeapSize SetStdHandle GetProcessHeap SetEnvironmentVariableW SetEndOfFile GetEnvironmentStringsW GetOEMCP GetACP IsValidCodePage HeapReAlloc FreeEnvironmentStringsW DecodePointer GetConsoleScreenBufferInfo SetConsoleTextAttribute GetStdHandle Sleep CloseHandle WideCharToMultiByte SetConsoleOutputCP GetComputerNameA ExpandEnvironmentStringsW WaitForSingleObject ReadFile SetFilePointer CreateFileW GetLastError CreateProcessW WriteFile CreateNamedPipeW PeekNamedPipe GetTickCount64 GetCurrentProcessId GetTickCount ConnectNamedPipe GetModuleHandleW GetModuleFileNameW GetCurrentDirectoryW CreateDirectoryW FindClose FindFirstFileW FindFirstFileExW FindNextFileW GetFileAttributesExW GetFinalPathNameByHandleW SetFileInformationByHandle AreFileApisANSI GetProcAddress GetFileInformationByHandleEx MultiByteToWideChar LocalFree FormatMessageA GetLocaleInfoEx EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer RtlUnwind GetStringTypeW LCMapStringEx GetCPInfo RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead GetCurrentProcess TerminateProcess RtlUnwindEx RtlPcToFileHeader RaiseException SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW ExitProcess GetModuleHandleExW GetCommandLineA GetCommandLineW GetFileSizeEx SetFilePointerEx GetFileType HeapAlloc FlushFileBuffers GetConsoleOutputCP GetConsoleMode HeapFree FlsAlloc FlsGetValue FlsSetValue FlsFree VirtualProtect CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW ReadConsoleW

Name

.text

Size

1.5MB

Virtual Size

1.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

14KB

Virtual Size

14KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-18_10b055312e4c014c9117362249ef238f_icedid_luca-stealer_njrat

version

winhttp

iphlpapi

kernel32

generic