2026-07-20_9fc62cb7334023ec39d2849530662f23_icedid_luca-stealer_njrat

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-20_9fc62cb7334023ec39d2849530662f23_icedid_luca-stealer_njrat
Size 38.6MB
Sample260720-vsn7dahs5p
SHA256 b403a0360037bde8a789f0bcc865a35cc0fcfe4a53de21962d416282f740637d
MD5 9fc62cb7334023ec39d2849530662f23
SHA1 53cbf4ccd43cac22d66e09738bc0410495c64928
SHA512 61ffd1c54fd398646c3cac1492bceb03f3887b1ea18c774cabbf75bc0ea112fa922ae9ba1239b5aa1d4d1fc5f3456a435937229cfd77868e97a9910fb0cedfe6
SSDEEP 786432:w8Ydl/8WkNo8z5H/fPivFR+sXFoUdtiourzZmivJu7I3gie4Y48:87kNoq5/yvFo+TfIkixu0git
TLSH
T1449733D3A8D31CA0E59BA7B40D3E683CF31636305341894E3F376E052F2AB46A975A57
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects executables packed with Themida 1 IoCs

resource	yara_rule
sample	INDICATOR_EXE_Packed_Themida

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-20_9fc62cb7334023ec39d2849530662f23_icedid_luca-stealer_njrat

File Explorer

2026-07-20_9fc62cb7334023ec39d2849530662f23_icedid_luca-stealer_njrat

.exe 38.6MB

2026-07-20_9fc62cb7334023ec39d2849530662f23_icedid_luca-stealer_njrat

IMPHASH ee693609ff4b70a6db033c734540c7b1
SHA256 b403a0360037bde8a789f0bcc865a35cc0fcfe4a53de21962d416282f740637d
MD5 9fc62cb7334023ec39d2849530662f23
SHA1 53cbf4ccd43cac22d66e09738bc0410495c64928
SHA512 61ffd1c54fd398646c3cac1492bceb03f3887b1ea18c774cabbf75bc0ea112fa922ae9ba1239b5aa1d4d1fc5f3456a435937229cfd77868e97a9910fb0cedfe6
SSDEEP 786432:w8Ydl/8WkNo8z5H/fPivFR+sXFoUdtiourzZmivJu7I3gie4Y48:87kNoq5/yvFo+TfIkixu0git
TLSH
T1449733D3A8D31CA0E59BA7B40D3E683CF31636305341894E3F376E052F2AB46A975A57
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects executables packed with Themida
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

13160

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

winhttp

WinHttpSendRequest WinHttpCloseHandle WinHttpConnect WinHttpSetOption WinHttpOpenRequest WinHttpReceiveResponse WinHttpOpen

advapi32

RegCloseKey OpenServiceA OpenSCManagerA DeleteService ControlService CloseServiceHandle RegQueryValueExA RegOpenKeyExW AllocateAndInitializeSid CheckTokenMembership FreeSid RegDeleteValueW RegOpenKeyExA

user32

MessageBoxW

kernel32

HeapReAlloc FlushFileBuffers GetConsoleOutputCP GetConsoleMode WriteConsoleW GetModuleHandleW HeapSize SetFilePointerEx CreateDirectoryW CreateFileW DeleteFileW GetFileAttributesW ReadFile WriteFile GetTempPathW CloseHandle DeviceIoControl WaitForSingleObject Sleep GetCurrentProcessId TerminateProcess CreateProcessW ProcessIdToSessionId GetTickCount GetModuleFileNameW LoadResource LockResource SizeofResource FindResourceW WTSGetActiveConsoleSessionId WideCharToMultiByte GetProcessHeap LCMapStringW VirtualProtect InitializeCriticalSectionEx RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW RtlUnwindEx GetLastError SetLastError EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary GetProcAddress LoadLibraryExW EncodePointer RaiseException RtlPcToFileHeader GetStdHandle ExitProcess GetModuleHandleExW HeapFree HeapAlloc GetFileType FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW MultiByteToWideChar GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle GetStringTypeW FlsAlloc FlsGetValue FlsSetValue FlsFree

shell32

SHGetFolderPathW

wtsapi32

WTSFreeMemory WTSSendMessageW WTSQuerySessionInformationW

userenv

GetProfilesDirectoryW

Name

.text

Size

96KB

Virtual Size

95KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

47KB

Virtual Size

47KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

38.5MB

Virtual Size

38.5MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-20_9fc62cb7334023ec39d2849530662f23_icedid_luca-stealer_njrat

winhttp

advapi32

user32

kernel32

shell32

wtsapi32

userenv

generic