2026-07-20_734eb1ab65ba6c7aee95267fbba7aabf_icedid_luca-stealer_njrat

General

Target
2026-07-20_734eb1ab65ba6c7aee95267fbba7aabf_icedid_luca-stealer_njrat
Size 1.6MB
Sample260720-llxeqsdt4k
SHA256 99fd931b897f7dca0ad7086b621a82769c60a02d5fde258cb63e678abe473de7
MD5 734eb1ab65ba6c7aee95267fbba7aabf
SHA1 6bcc8ac086639864bc6a1b195064fe9a63089508
SHA512 5071b39a7c9fa8bc85a4a1e2885e9f833ab18a65267f7c42bfa2619b8885829e9832193754868f21d9a4adef95cbb1efab869f587c06f38028f6d20f2429bad4
SSDEEP 24576:BNkc9Ysk2vqIx5mduxCmhUD3q1NbTJJVMWzqVxfLrBz7pjsY6Oj:Acq/2SIx5mduE0UD3OxtlzqVxf39
TLSH
T11775021696E401FCE1B7D1B8CD928D46EB72BC060BA05ADF13E045961F676E08E7E732
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects executables Discord URL observed in first stage droppers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_DiscordURL

Detects executables using Telegram Chat Bot 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_TelegramChatBot

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-20_734eb1ab65ba6c7aee95267fbba7aabf_icedid_luca-stealer_njrat

File Explorer

2026-07-20_734eb1ab65ba6c7aee95267fbba7aabf_icedid_luca-stealer_njrat

.exe 1.6MB

2026-07-20_734eb1ab65ba6c7aee95267fbba7aabf_icedid_luca-stealer_njrat

IMPHASH 885f8fe9f30be0b91752b9ba3252a7c6
SHA256 99fd931b897f7dca0ad7086b621a82769c60a02d5fde258cb63e678abe473de7
MD5 734eb1ab65ba6c7aee95267fbba7aabf
SHA1 6bcc8ac086639864bc6a1b195064fe9a63089508
SHA512 5071b39a7c9fa8bc85a4a1e2885e9f833ab18a65267f7c42bfa2619b8885829e9832193754868f21d9a4adef95cbb1efab869f587c06f38028f6d20f2429bad4
SSDEEP 24576:BNkc9Ysk2vqIx5mduxCmhUD3q1NbTJJVMWzqVxfLrBz7pjsY6Oj:Acq/2SIx5mduE0UD3OxtlzqVxf39
TLSH
T11775021696E401FCE1B7D1B8CD928D46EB72BC060BA05ADF13E045961F676E08E7E732
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects executables Discord URL observed in first stage droppers
Detects executables using Telegram Chat Bot
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

1479052

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

version

VerQueryValueW GetFileVersionInfoW GetFileVersionInfoSizeW

winhttp

WinHttpOpenRequest WinHttpSetOption WinHttpCloseHandle WinHttpOpen WinHttpSetTimeouts WinHttpConnect WinHttpQueryDataAvailable WinHttpReadData WinHttpReceiveResponse WinHttpSendRequest

iphlpapi

GetAdaptersInfo

kernel32

WriteConsoleW HeapSize SetStdHandle GetProcessHeap SetEnvironmentVariableW SetEndOfFile GetEnvironmentStringsW GetOEMCP GetACP IsValidCodePage HeapReAlloc FreeEnvironmentStringsW DecodePointer GetConsoleScreenBufferInfo SetConsoleTextAttribute GetStdHandle Sleep CloseHandle WideCharToMultiByte SetConsoleOutputCP GetComputerNameA ExpandEnvironmentStringsW WaitForSingleObject ReadFile SetFilePointer CreateFileW GetLastError CreateProcessW WriteFile CreateNamedPipeW PeekNamedPipe GetTickCount64 GetCurrentProcessId GetTickCount ConnectNamedPipe GetModuleHandleW GetModuleFileNameW GetCurrentDirectoryW CreateDirectoryW FindClose FindFirstFileW FindFirstFileExW FindNextFileW GetFileAttributesExW GetFinalPathNameByHandleW SetFileInformationByHandle AreFileApisANSI GetProcAddress GetFileInformationByHandleEx MultiByteToWideChar LocalFree FormatMessageA GetLocaleInfoEx EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer RtlUnwind GetStringTypeW LCMapStringEx GetCPInfo RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead GetCurrentProcess TerminateProcess RtlUnwindEx RtlPcToFileHeader RaiseException SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW ExitProcess GetModuleHandleExW GetCommandLineA GetCommandLineW GetFileSizeEx SetFilePointerEx GetFileType FlushFileBuffers GetConsoleOutputCP GetConsoleMode HeapFree HeapAlloc FlsAlloc FlsGetValue FlsSetValue FlsFree VirtualProtect CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW ReadConsoleW

Name

.text

Size

1.6MB

Virtual Size

1.6MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

16KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-20_734eb1ab65ba6c7aee95267fbba7aabf_icedid_luca-stealer_njrat

version

winhttp

iphlpapi

kernel32

generic