2026-07-18_7b221af327e3817be15d4fcf5188c8a8_icedid_luca-stealer_njrat_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-18_7b221af327e3817be15d4fcf5188c8a8_icedid_luca-stealer_njrat_stealc
Size 8.5MB
Sample260718-bbpl2aa18p
SHA256 f0815435f264238b326eed28b26f269e865e576f63c20b7546642a4b93ee6515
MD5 7b221af327e3817be15d4fcf5188c8a8
SHA1 8f81c8caa8f15f4ce9eb6b2666dd6aea77a552ae
SHA512 83855dc6ead8c39b3a1fef7e23fdf12c6066f43f066ca56b2b1144ffb95560c404e5617bcf6a65b3c909a1bc439119ddc93d9febef3b55975912778807a18117
SSDEEP 196608:MaD5aI0urs7WwlVeUrf2MPc2L+PKskCS8feSCmPx:A7/Lr5Pc8+PK9Z8ff
TLSH
T10F96F15969E211BCD4B3C43AC3AB46EBE716704A1FB6486F7BC404501633CD9DEA3B26
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-07-18_7b221af327e3817be15d4fcf5188c8a8_icedid_luca-stealer_njrat_stealc

File Explorer

2026-07-18_7b221af327e3817be15d4fcf5188c8a8_icedid_luca-stealer_njrat_stealc

.exe 8.5MB

2026-07-18_7b221af327e3817be15d4fcf5188c8a8_icedid_luca-stealer_njrat_stealc

IMPHASH 54864db445de06aeb31b65a2e9817953
SHA256 f0815435f264238b326eed28b26f269e865e576f63c20b7546642a4b93ee6515
MD5 7b221af327e3817be15d4fcf5188c8a8
SHA1 8f81c8caa8f15f4ce9eb6b2666dd6aea77a552ae
SHA512 83855dc6ead8c39b3a1fef7e23fdf12c6066f43f066ca56b2b1144ffb95560c404e5617bcf6a65b3c909a1bc439119ddc93d9febef3b55975912778807a18117
SSDEEP 196608:MaD5aI0urs7WwlVeUrf2MPc2L+PKskCS8feSCmPx:A7/Lr5Pc8+PK9Z8ff
TLSH
T10F96F15969E211BCD4B3C43AC3AB46EBE716704A1FB6486F7BC404501633CD9DEA3B26
MD5 SHA1 SHA512 SSDEEP TLSH

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

f1:bf:40:15:5b:ee:b9:72:65:df:6b:c4:90:63:5f:40:f9:fe:65:4c:05:2e:ee:cc:75:a1:23:e3:bb:dd:b9:09

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Apr 28, 2026

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:05:19:da:dd:aa:8b:dc:44:b2:92:00:00:00:00:05:19

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jun 19, 2025 - Jun 17, 2026

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:07:76:56:00:00:00:00:00:08

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Oct 19, 2011 - Oct 19, 2026

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=nShield TSS ESN:591A-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:02:14:8d:cd:23:44:ee:06:df:72:00:01:00:00:02:14

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Aug 14, 2025 - Nov 13, 2026

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 30, 2021 - Sep 30, 2030

Minor OS version

Major OS version

Entry point

1033168

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

opengl32

wglCreateContext wglDeleteContext wglGetProcAddress glClear glViewport glTexParameteri wglMakeCurrent glGetString glTexImage2D glScissor glGenTextures glEnable glDrawArrays glDisable glDeleteTextures glClearColor glBindTexture

gdi32

CreateRectRgn DeleteObject GetDeviceCaps SetPixelFormat SwapBuffers ChoosePixelFormat

user32

GetKeyState EmptyClipboard GetClipboardData ShowWindow SetWindowPos GetWindowLongPtrA SetWindowLongPtrA TrackMouseEvent TranslateMessage DispatchMessageA PeekMessageA RegisterHotKey UnregisterHotKey DefWindowProcA PostQuitMessage UnregisterClassA RegisterClassExA CreateWindowExA DestroyWindow SetWindowDisplayAffinity GetSystemMetrics UpdateWindow SetForegroundWindow GetDC ReleaseDC ScreenToClient LoadCursorA LoadIconA LoadImageA SetProcessDpiAwarenessContext WaitMessage OpenClipboard CloseClipboard SetClipboardData

dwmapi

DwmEnableBlurBehindWindow DwmExtendFrameIntoClientArea

ws2_32

recv select connect shutdown getaddrinfo freeaddrinfo getsockopt getsockname __WSAFDIsSet inet_pton WSAGetLastError WSACleanup ioctlsocket accept WSAStartup bind closesocket htonl htons listen ntohs setsockopt socket send inet_ntop

winhttp

WinHttpOpenRequest WinHttpCloseHandle WinHttpConnect WinHttpReadData WinHttpSetTimeouts WinHttpSendRequest WinHttpQueryDataAvailable WinHttpReceiveResponse WinHttpOpen

bcrypt

BCryptCreateHash BCryptDecrypt BCryptFinishHash BCryptDestroyHash BCryptGenRandom BCryptHashData BCryptDestroyKey BCryptGenerateSymmetricKey BCryptCloseAlgorithmProvider BCryptSetProperty BCryptGetProperty BCryptOpenAlgorithmProvider BCryptEncrypt

wininet

InternetGetConnectedState DeleteUrlCacheEntryA DeleteUrlCacheGroup FindNextUrlCacheGroup FindFirstUrlCacheEntryA FindNextUrlCacheEntryA FindCloseUrlCache FindFirstUrlCacheGroup

advapi32

EqualSid GetTokenInformation GetUserNameW RegCloseKey RegDeleteValueW RegEnumKeyExW RegEnumValueW RegOpenKeyExW SetEntriesInAclW GetSecurityInfo SetSecurityInfo RegDeleteKeyW RegFlushKey LookupPrivilegeValueW QueryServiceStatusEx OpenServiceW OpenSCManagerW CloseServiceHandle SetNamedSecurityInfoW GetNamedSecurityInfoW GetAclInformation GetAce FreeSid OpenProcessToken AllocateAndInitializeSid AddAce SetSecurityDescriptorDacl SetKernelObjectSecurity InitializeSecurityDescriptor InitializeAcl LookupPrivilegeValueA AdjustTokenPrivileges RegQueryValueExW

shell32

SHAddToRecentDocs SHGetKnownFolderPath ShellExecuteExW ShellExecuteA Shell_NotifyIconA

secur32

AcquireCredentialsHandleA FreeCredentialsHandle InitializeSecurityContextA DeleteSecurityContext ApplyControlToken QueryContextAttributesA FreeContextBuffer EncryptMessage DecryptMessage

crypt32

CryptEncodeObject CertOpenStore CertCloseStore CertFreeCertificateContext CertAddEncodedCertificateToStore CertCreateCertificateChainEngine CertFreeCertificateChainEngine CertGetCertificateChain CertFreeCertificateChain CryptStringToBinaryA

kernel32

TlsAlloc InitializeCriticalSectionAndSpinCount RtlUnwindEx GetStartupInfoW IsDebuggerPresent InitializeSListHead TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext GetCPInfo GetStringTypeW LCMapStringEx DecodePointer EncodePointer DeleteCriticalSection GetSystemTimeAsFileTime InitializeCriticalSectionEx GetFileInformationByHandleEx AreFileApisANSI SetFileInformationByHandle TlsSetValue GetFileAttributesExW FindNextFileW FindFirstFileExW FindFirstFileW FindClose GetLocaleInfoEx IsProcessorFeaturePresent GetModuleHandleExW CloseThreadpoolWork SubmitThreadpoolWork CreateThreadpoolWork FreeLibraryWhenCallbackReturns FormatMessageA InitOnceComplete InitOnceBeginInitialize GetStdHandle ExitProcess GetCommandLineA FlsAlloc FlsGetValue FlsSetValue FlsFree CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetConsoleMode TlsGetValue TlsFree LoadLibraryExW ExitThread FreeLibraryAndExitThread ReadConsoleW SetFilePointerEx GetConsoleOutputCP GetFileSizeEx SetStdHandle WakeAllConditionVariable WakeConditionVariable RaiseException RtlPcToFileHeader SleepConditionVariableSRW TryAcquireSRWLockExclusive AcquireSRWLockExclusive ReleaseSRWLockExclusive QueryPerformanceFrequency QueryPerformanceCounter GetNativeSystemInfo WaitForSingleObjectEx IsValidCodePage GetACP GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetProcessHeap SetEndOfFile HeapSize WriteConsoleW GetFileType GetProcAddress VirtualQueryEx GetCommandLineW GetModuleFileNameA GetModuleHandleA GetModuleHandleW EnumResourceNamesA GlobalAlloc GlobalUnlock GlobalLock CreateFileW ReadFile WriteFile CloseHandle Sleep CreateMutexW OpenMutexW SetConsoleCtrlHandler FlushFileBuffers GetLastError ConnectNamedPipe DisconnectNamedPipe CreateNamedPipeW CreateProcessW GetModuleFileNameW GetFileAttributesW OpenProcess ReadProcessMemory RtlUnwind WideCharToMultiByte CreateToolhelp32Snapshot Process32FirstW Process32NextW K32GetProcessMemoryInfo MultiByteToWideChar GetComputerNameA GetTickCount CreateFileA DeviceIoControl GetWindowsDirectoryA GetSystemFirmwareTable WaitForSingleObject CreateThread GetLocalTime GetTickCount64 GetCurrentProcess VirtualProtectEx WriteProcessMemory K32EnumProcessModulesEx K32GetModuleBaseNameA K32GetModuleInformation GetFileTime SetFileTime LocalFree GetLogicalDrives GetSystemDirectoryW GetWindowsDirectoryW DeleteFileW MoveFileExW RtlAddFunctionTable GetExitCodeProcess CreateRemoteThread VirtualAlloc VirtualProtect VirtualFree VirtualAllocEx VirtualFreeEx LoadLibraryA GetExitCodeThread GetEnvironmentVariableA GetCurrentThread SetThreadPriority GetSystemInfo VirtualQuery SetLastError K32EnumProcessModules AddVectoredExceptionHandler RemoveVectoredExceptionHandler InitializeCriticalSection EnterCriticalSection LeaveCriticalSection HeapCreate HeapAlloc HeapReAlloc HeapFree GetCurrentProcessId GetCurrentThreadId OpenThread SuspendThread ResumeThread GetThreadContext SetThreadContext FlushInstructionCache Thread32First Thread32Next FreeLibrary LoadLibraryExA

ole32

CoTaskMemFree

dnsapi

DnsFree DnsQuery_A

wevtapi

EvtClearLog

Name

.text

Size

1.2MB

Virtual Size

1.2MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

610KB

Virtual Size

610KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

13KB

Virtual Size

55KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

35KB

Virtual Size

34KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.airepl

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.$~~

Size

6.6MB

Virtual Size

6.6MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

512B

Virtual Size

469B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-18_7b221af327e3817be15d4fcf5188c8a8_icedid_luca-stealer_njrat_stealc

PE Signature issue

opengl32

gdi32

user32

dwmapi

ws2_32

winhttp

bcrypt

wininet

advapi32

shell32

secur32

crypt32

kernel32

ole32

dnsapi

wevtapi

generic