2026-07-20_f6688256a093bb1147ff409187b134f6_icedid_luca-stealer_njrat

General

Target
2026-07-20_f6688256a093bb1147ff409187b134f6_icedid_luca-stealer_njrat
Size 1.5MB
Sample260720-ctx7kacv4m
SHA256 04aff7e8874fe81f28ea2997ac0c883ef39596abae5fc214bfcf900702523a74
MD5 f6688256a093bb1147ff409187b134f6
SHA1 a149c317fd1ef51855d2c2f9624a0cd4550dd996
SHA512 19d372a681daeaf0d607d5ae774cea05932583fa5aee8b5b3132b2197347b46b8afe88e88a8cde6a5e6fb34e8b547c324bd8b0ce39ded1f29ae0b9133becb12a
SSDEEP 24576:dI7hTBcz7eE391letC9zjf6Axg4Y8FJdzLCX4XJgeXkO9GAAmHWlblusYGiC1P2q:dmmCE3JecdjxYAJCoXJ7yDlY7C1U
TLSH
T1A675021B66A400FCE1EBD278CE164547E7B2BC0A4B71A68F07E445D61F27BA09D3E712
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects executables Discord URL observed in first stage droppers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_DiscordURL

Detects executables using Telegram Chat Bot 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_TelegramChatBot

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-20_f6688256a093bb1147ff409187b134f6_icedid_luca-stealer_njrat

File Explorer

2026-07-20_f6688256a093bb1147ff409187b134f6_icedid_luca-stealer_njrat

.exe 1.5MB

2026-07-20_f6688256a093bb1147ff409187b134f6_icedid_luca-stealer_njrat

IMPHASH 5d54686eb8d6133657508d5c3bce9d83
SHA256 04aff7e8874fe81f28ea2997ac0c883ef39596abae5fc214bfcf900702523a74
MD5 f6688256a093bb1147ff409187b134f6
SHA1 a149c317fd1ef51855d2c2f9624a0cd4550dd996
SHA512 19d372a681daeaf0d607d5ae774cea05932583fa5aee8b5b3132b2197347b46b8afe88e88a8cde6a5e6fb34e8b547c324bd8b0ce39ded1f29ae0b9133becb12a
SSDEEP 24576:dI7hTBcz7eE391letC9zjf6Axg4Y8FJdzLCX4XJgeXkO9GAAmHWlblusYGiC1P2q:dmmCE3JecdjxYAJCoXJ7yDlY7C1U
TLSH
T1A675021B66A400FCE1EBD278CE164547E7B2BC0A4B71A68F07E445D61F27BA09D3E712
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects executables Discord URL observed in first stage droppers
Detects executables using Telegram Chat Bot
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

1377088

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

version

VerQueryValueW GetFileVersionInfoW GetFileVersionInfoSizeW

winhttp

WinHttpOpenRequest WinHttpSetOption WinHttpCloseHandle WinHttpOpen WinHttpSetTimeouts WinHttpConnect WinHttpQueryDataAvailable WinHttpReadData WinHttpReceiveResponse WinHttpSendRequest

iphlpapi

GetAdaptersInfo

kernel32

WriteConsoleW HeapSize SetStdHandle GetProcessHeap SetEnvironmentVariableW SetEndOfFile GetEnvironmentStringsW GetOEMCP GetACP IsValidCodePage HeapReAlloc FreeEnvironmentStringsW DecodePointer GetConsoleScreenBufferInfo SetConsoleTextAttribute GetStdHandle Sleep CloseHandle WideCharToMultiByte SetConsoleOutputCP GetComputerNameA ExpandEnvironmentStringsW WaitForSingleObject ReadFile SetFilePointer CreateFileW GetLastError CreateProcessW WriteFile CreateNamedPipeW PeekNamedPipe GetTickCount64 GetCurrentProcessId GetTickCount ConnectNamedPipe GetModuleHandleW GetModuleFileNameW GetCurrentDirectoryW CreateDirectoryW FindClose FindFirstFileW FindFirstFileExW FindNextFileW GetFileAttributesExW GetFinalPathNameByHandleW SetFileInformationByHandle AreFileApisANSI GetProcAddress GetFileInformationByHandleEx MultiByteToWideChar LocalFree FormatMessageA GetLocaleInfoEx EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer RtlUnwind GetStringTypeW LCMapStringEx GetCPInfo RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead GetCurrentProcess TerminateProcess RtlUnwindEx RtlPcToFileHeader RaiseException SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW ExitProcess GetModuleHandleExW GetCommandLineA GetCommandLineW GetFileSizeEx SetFilePointerEx GetFileType HeapAlloc FlushFileBuffers GetConsoleOutputCP GetConsoleMode HeapFree FlsAlloc FlsGetValue FlsSetValue FlsFree VirtualProtect CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW ReadConsoleW

Name

.text

Size

1.5MB

Virtual Size

1.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

14KB

Virtual Size

14KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-20_f6688256a093bb1147ff409187b134f6_icedid_luca-stealer_njrat

version

winhttp

iphlpapi

kernel32

generic