2026-07-20_f7b8b870d75015be5ce869d189cc6313_icedid_luca-stealer_njrat_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-20_f7b8b870d75015be5ce869d189cc6313_icedid_luca-stealer_njrat_stealc
Size 4.7MB
Sample260720-t797qaas2t
SHA256 7e423e8253366b54dd97f283255a6149a372da3ba1415f6cfb8cb7eaab44730e
MD5 f7b8b870d75015be5ce869d189cc6313
SHA1 c376e07743372c97c9773c551d621ba1a436376a
SHA512 172276b2aff01603621b6ad460d64f1e1af507c10103db35796fe1f801ca92bc2cc6fe9ea5e11545f404f817cd059693d1ac56866ededa52724f98dee8e3a879
SSDEEP 98304:AKs+j9DMbJcioxcKK2SewFiYCJc7vfmI+zjjQGfdKTQ9DMbJcioxcKK2SewFiYC+:fsN+PjPQT+hjPjCF
TLSH
T13E36DF13F35243A8C156A178CEE5C76AF331BC142B15A2DB32D95B618E9B5F00EB93E4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-20_f7b8b870d75015be5ce869d189cc6313_icedid_luca-stealer_njrat_stealc

File Explorer

2026-07-20_f7b8b870d75015be5ce869d189cc6313_icedid_luca-stealer_njrat_stealc

.exe 4.7MB

2026-07-20_f7b8b870d75015be5ce869d189cc6313_icedid_luca-stealer_njrat_stealc

IMPHASH 5851a784e66ee8d43e2c11c428b81c6b
SHA256 7e423e8253366b54dd97f283255a6149a372da3ba1415f6cfb8cb7eaab44730e
MD5 f7b8b870d75015be5ce869d189cc6313
SHA1 c376e07743372c97c9773c551d621ba1a436376a
SHA512 172276b2aff01603621b6ad460d64f1e1af507c10103db35796fe1f801ca92bc2cc6fe9ea5e11545f404f817cd059693d1ac56866ededa52724f98dee8e3a879
SSDEEP 98304:AKs+j9DMbJcioxcKK2SewFiYCJc7vfmI+zjjQGfdKTQ9DMbJcioxcKK2SewFiYC+:fsN+PjPQT+hjPjCF
TLSH
T13E36DF13F35243A8C156A178CEE5C76AF331BC142B15A2DB32D95B618E9B5F00EB93E4
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1023308

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\kajko\Documents\loader\x64\Release\loader.pdb

vmprotectsdk64

VMProtectDecryptStringA VMProtectIsVirtualMachinePresent VMProtectIsDebuggerPresent VMProtectIsValidImageCRC VMProtectBeginUltra VMProtectBeginMutation VMProtectEnd

kernel32

GlobalAlloc GlobalFree GlobalLock WideCharToMultiByte GlobalUnlock GetLocaleInfoA LoadLibraryA QueryPerformanceFrequency IsDBCSLeadByte FreeLibrary QueryPerformanceCounter GetVolumeInformationW ExitProcess WriteProcessMemory GetCurrentThreadId VirtualProtectEx VirtualAllocEx ReadProcessMemory CreateRemoteThread GetSystemTimeAsFileTime VirtualFreeEx GetTickCount TerminateProcess GetCurrentProcessId ReadFile GetVolumeInformationA CreateFileA GlobalMemoryStatusEx GetComputerNameA GetTickCount64 MultiByteToWideChar OutputDebugStringA SetEndOfFile WriteConsoleW GetProcessHeap SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP GetACP IsValidCodePage HeapSize HeapReAlloc GetFileSizeEx ReadConsoleW SetFilePointerEx GetConsoleOutputCP FlushFileBuffers EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW FlsFree FlsSetValue FlsGetValue FlsAlloc HeapAlloc HeapFree GetCommandLineW GetCommandLineA GetFileType SetStdHandle FreeLibraryAndExitThread ExitThread TlsFree TlsSetValue GetLocalTime GetConsoleMode GetStdHandle GetProcAddress Process32Next Sleep CreateToolhelp32Snapshot GetModuleHandleA GetFileAttributesW GetCurrentProcess Process32First TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount SetLastError RtlUnwindEx InitializeSListHead GetStartupInfoW SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext OutputDebugStringW IsDebuggerPresent OpenThread GetThreadTimes SuspendThread LoadLibraryW OpenProcess GetProcessId Thread32First Thread32Next CreateThread TerminateThread CreateNamedPipeW ResetEvent GetCurrentThread DuplicateHandle WaitForSingleObject VirtualQueryEx IsWow64Process SetThreadContext GetThreadContext GetWindowsDirectoryW Module32FirstW GetSystemWow64DirectoryW DeactivateActCtx GetSystemDirectoryW GetEnvironmentVariableW ActivateActCtx MapViewOfFile ReleaseActCtx CreateFileMappingW GetTempFileNameW DeleteFileW UnmapViewOfFile CreateActCtxW GetModuleFileNameW ResumeThread Wow64RevertWow64FsRedirection Wow64DisableWow64FsRedirection InitializeCriticalSection GetCPInfo GetModuleHandleW GetSystemInfo VirtualAlloc VirtualFree VirtualProtect DeleteCriticalSection DecodePointer LCMapStringEx LeaveCriticalSection EnterCriticalSection GetStringTypeW EncodePointer CloseHandle GetLastError CreateFileW InitializeCriticalSectionEx RtlUnwind K32GetModuleFileNameExW WriteFile WakeAllConditionVariable RemoveVectoredExceptionHandler LoadLibraryExW InitOnceBeginInitialize InitOnceComplete GetLocaleInfoEx LocalFree GetModuleHandleExW CloseThreadpoolWork SubmitThreadpoolWork CreateThreadpoolWork ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive SleepConditionVariableSRW WaitForSingleObjectEx GetExitCodeThread GetNativeSystemInfo FormatMessageA GetCurrentDirectoryW CreateDirectoryW FindClose FindFirstFileW FindFirstFileExW FindNextFileW GetFileAttributesExW SetFileInformationByHandle GetTempPathW AreFileApisANSI DeviceIoControl GetFileInformationByHandleEx RtlPcToFileHeader RaiseException IsProcessorFeaturePresent FreeLibraryWhenCallbackReturns

user32

RegisterClassExW ShowWindow DispatchMessageW PeekMessageW SetLayeredWindowAttributes SetFocus TranslateMessage PostQuitMessage UpdateWindow SetForegroundWindow GetSystemMetrics DefWindowProcW CreateWindowExW GetKeyState GetMessageExtraInfo LoadCursorA ScreenToClient GetCapture DestroyWindow wsprintfW SetClipboardData GetClipboardData EmptyClipboard CloseClipboard UnregisterClassW OpenClipboard GetCursorPos SetCursorPos ReleaseCapture IsWindowUnicode GetClientRect SetCursor SetCapture GetForegroundWindow GetKeyboardLayout TrackMouseEvent ClientToScreen

gdi32

CreateSolidBrush

advapi32

RegCreateKeyW LookupPrivilegeValueW AdjustTokenPrivileges OpenProcessToken RegOpenKeyExW OpenThreadToken RegQueryValueExW RegSetValueExW ConvertStringSecurityDescriptorToSecurityDescriptorW RegOpenKeyW RegCloseKey RegOpenKeyExA RegQueryValueExA LookupPrivilegeValueA CryptAcquireContextW RegEnumValueW CryptReleaseContext CryptGenRandom

shell32

ShellExecuteW ShellExecuteA SHGetKnownFolderPath

ole32

CoInitialize CoTaskMemFree CoUninitialize CoCreateInstance

libcrypto-3-x64

PKCS5_PBKDF2_HMAC EVP_DigestFinal_ex EVP_DigestInit_ex EVP_MD_CTX_free EVP_DigestUpdate EVP_MD_CTX_new HMAC EVP_aes_256_cbc EVP_CIPHER_CTX_new EVP_DecryptUpdate EVP_DecryptFinal_ex EVP_EncodeBlock EVP_CIPHER_CTX_free EVP_DecodeBlock EVP_DecryptInit_ex EVP_sha256

shlwapi

SHDeleteKeyW

bcrypt

BCryptGetProperty BCryptFinishHash BCryptCloseAlgorithmProvider BCryptDestroyHash BCryptHashData BCryptCreateHash BCryptGenRandom BCryptOpenAlgorithmProvider

imm32

ImmReleaseContext ImmGetContext ImmSetCandidateWindow ImmSetCompositionWindow

d3dcompiler_47

D3DCompile

dwmapi

DwmExtendFrameIntoClientArea

d3d11

D3D11CreateDeviceAndSwapChain

crypt32

CryptEncodeObjectEx CryptHashCertificate2 CertFreeCertificateContext

winhttp

WinHttpQueryOption WinHttpSendRequest WinHttpCloseHandle WinHttpSetOption WinHttpOpenRequest WinHttpReadData WinHttpQueryDataAvailable WinHttpAddRequestHeaders WinHttpOpen WinHttpReceiveResponse WinHttpQueryHeaders WinHttpConnect

iphlpapi

GetAdaptersAddresses

oleaut32

SysFreeString

??0Assembler@asmjit@@QEAA@PEAURuntime@1@@Z ??0CodeGen@asmjit@@QEAA@PEAURuntime@1@@Z ??0HostRuntime@asmjit@@QEAA@XZ ??0JitRuntime@asmjit@@QEAA@XZ ??0Runtime@asmjit@@QEAA@XZ ??0StaticRuntime@asmjit@@QEAA@PEAX_K@Z ??0VMemMgr@asmjit@@QEAA@PEAX@Z ??0X86Assembler@asmjit@@QEAA@PEAURuntime@1@I@Z ??0Zone@asmjit@@QEAA@_K@Z ??1Assembler@asmjit@@UEAA@XZ ??1CodeGen@asmjit@@UEAA@XZ ??1HostRuntime@asmjit@@UEAA@XZ ??1JitRuntime@asmjit@@UEAA@XZ ??1Runtime@asmjit@@UEAA@XZ ??1StaticRuntime@asmjit@@UEAA@XZ ??1VMemMgr@asmjit@@QEAA@XZ ??1X86Assembler@asmjit@@UEAA@XZ ??1Zone@asmjit@@QEAA@XZ ??_FVMemMgr@asmjit@@QEAAXXZ ?_alloc@Zone@asmjit@@QEAAPEAX_K@Z ?_emit@X86Assembler@asmjit@@UEAAIIAEBUOperand@2@000@Z ?_grow@Assembler@asmjit@@QEAAI_K@Z ?_grow@PodVectorBase@asmjit@@IEAAI_K0@Z ?_newLabel@Assembler@asmjit@@QEAAIPEAULabel@2@@Z ?_newLabelLink@Assembler@asmjit@@QEAAPEAULabelLink@2@XZ ?_nullData@PodVectorBase@asmjit@@2UPodVectorData@2@B ?_registerIndexedLabels@Assembler@asmjit@@QEAAI_K@Z ?_relocCode@X86Assembler@asmjit@@UEBA_KPEAX_K@Z ?_reserve@Assembler@asmjit@@QEAAI_K@Z ?_reserve@PodVectorBase@asmjit@@IEAAI_K0@Z ?_x86CondToCmovcc@asmjit@@3QBIB ?_x86CondToJcc@asmjit@@3QBIB ?_x86CondToSetcc@asmjit@@3QBIB ?_x86InstExtendedInfo@asmjit@@3QBUX86InstExtendedInfo@1@B ?_x86InstInfo@asmjit@@3QBUX86InstInfo@1@B ?_x86ReverseCond@asmjit@@3QBIB ?add@JitRuntime@asmjit@@UEAAIPEAPEAXPEAUAssembler@2@@Z ?add@StaticRuntime@asmjit@@UEAAIPEAPEAXPEAUAssembler@2@@Z ?align@X86Assembler@asmjit@@UEAAIII@Z ?alloc@VMemMgr@asmjit@@QEAAPEAX_KI@Z ?alloc@VMemUtil@asmjit@@SAPEAX_KPEA_KI@Z ?allocProcessMemory@VMemUtil@asmjit@@SAPEAXPEAX_KPEA_KI@Z ?allocZeroed@Zone@asmjit@@QEAAPEAX_K@Z ?bind@Assembler@asmjit@@UEAAIAEBULabel@2@@Z ?callCpuId@X86CpuUtil@asmjit@@SAXIIPEATX86CpuId@2@@Z ?detect@X86CpuUtil@asmjit@@SAXPEAUX86CpuInfo@2@@Z ?detectHwThreadsCount@CpuInfo@asmjit@@SAIXZ ?dup@Zone@asmjit@@QEAAPEAXPEBX_K@Z ?embed@Assembler@asmjit@@UEAAIPEBXI@Z ?embedLabel@X86Assembler@asmjit@@QEAAIAEBULabel@2@@Z ?emit@Assembler@asmjit@@QEAAII@Z ?emit@Assembler@asmjit@@QEAAIIAEBUOperand@2@00@Z ?emit@Assembler@asmjit@@QEAAIIAEBUOperand@2@00H@Z ?emit@Assembler@asmjit@@QEAAIIAEBUOperand@2@00_K@Z ?emit@Assembler@asmjit@@QEAAIIAEBUOperand@2@0@Z ?emit@Assembler@asmjit@@QEAAIIAEBUOperand@2@0H@Z ?emit@Assembler@asmjit@@QEAAIIAEBUOperand@2@0_K@Z ?emit@Assembler@asmjit@@QEAAIIAEBUOperand@2@@Z ?emit@Assembler@asmjit@@QEAAIIAEBUOperand@2@H@Z ?emit@Assembler@asmjit@@QEAAIIAEBUOperand@2@_K@Z ?emit@Assembler@asmjit@@QEAAIIH@Z ?emit@Assembler@asmjit@@QEAAII_K@Z ?flush@HostRuntime@asmjit@@UEAAXPEAX_K@Z ?getCpuInfo@HostRuntime@asmjit@@UEAAPEBUCpuInfo@2@XZ ?getHost@CpuInfo@asmjit@@SAPEBU12@XZ ?getPageGranularity@VMemUtil@asmjit@@SA_KXZ ?getPageSize@VMemUtil@asmjit@@SA_KXZ ?getStackAlignment@HostRuntime@asmjit@@UEAAIXZ ?make@Assembler@asmjit@@UEAAPEAXXZ ?noOperand@asmjit@@3UOperand@1@B ?ptr_abs@x86@asmjit@@YA?AUX86Mem@2@_KAEBUX86Reg@2@IHI@Z ?ptr_abs@x86@asmjit@@YA?AUX86Mem@2@_KHI@Z ?release@JitRuntime@asmjit@@UEAAIPEAX@Z ?release@StaticRuntime@asmjit@@UEAAIPEAX@Z ?release@VMemMgr@asmjit@@QEAAIPEAX@Z ?release@VMemUtil@asmjit@@SAIPEAX_K@Z ?releaseProcessMemory@VMemUtil@asmjit@@SAIPEAX0_K@Z ?relocCode@Assembler@asmjit@@QEBA_KPEAX_K@Z ?reset@Assembler@asmjit@@QEAAX_N@Z ?reset@PodVectorBase@asmjit@@QEAAX_N@Z ?reset@VMemMgr@asmjit@@QEAAXXZ ?reset@Zone@asmjit@@QEAAX_N@Z ?sdup@Zone@asmjit@@QEAAPEADPEBD@Z ?setArch@X86Assembler@asmjit@@QEAAII@Z ?setError@CodeGen@asmjit@@QEAAIIPEBD@Z ?setErrorHandler@CodeGen@asmjit@@QEAAIPEAUErrorHandler@2@@Z ?sformat@Zone@asmjit@@QEAAPEADPEBDZZ ?shrink@VMemMgr@asmjit@@QEAAIPEAX_K@Z ?x86RegData@asmjit@@3UX86RegData@1@B

Name

.text

Size

1.2MB

Virtual Size

1.2MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

3.0MB

Virtual Size

3.0MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

353KB

Virtual Size

364KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

54KB

Virtual Size

53KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.acdata

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

488B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-20_f7b8b870d75015be5ce869d189cc6313_icedid_luca-stealer_njrat_stealc

vmprotectsdk64

kernel32

user32

gdi32

advapi32

shell32

ole32

libcrypto-3-x64

shlwapi

bcrypt

imm32

d3dcompiler_47

dwmapi

d3d11

crypt32

winhttp

iphlpapi

oleaut32

generic