2026-07-22_f3cee4ffda1efafecd36a3b789c8ace4_icedid_luca-stealer_njrat_stealc

General

Target
2026-07-22_f3cee4ffda1efafecd36a3b789c8ace4_icedid_luca-stealer_njrat_stealc
Size 1.4MB
Sample260722-a1empatsfv
SHA256 e008595c509e2b82ad903ae0526498b0511dd08fd896941096e18f16adfcc737
MD5 f3cee4ffda1efafecd36a3b789c8ace4
SHA1 98247fd027c896361f0745f4556d86c7c4b0e0a1
SHA512 882b0e9b6f3d24ca5cd4d1838ae1e44be59d0c2a51b40461563b3d41dec508cb5942daa5eff8ffee43dccb335b964480c8cbfc9dfb5e1ca5edc2ff622371c17a
SSDEEP 12288:sNfBOaFtfxFbs3Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DB9:ypOY9TYsqjnhMgeiCl7G0nehbGZpbD
TLSH
T14D65F25677940CFAE977C57DC9428909ED627C464760EACB03A04AE75F336D08E3E722
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-22_f3cee4ffda1efafecd36a3b789c8ace4_icedid_luca-stealer_njrat_stealc

File Explorer

2026-07-22_f3cee4ffda1efafecd36a3b789c8ace4_icedid_luca-stealer_njrat_stealc

.exe 1.4MB

2026-07-22_f3cee4ffda1efafecd36a3b789c8ace4_icedid_luca-stealer_njrat_stealc

IMPHASH 3fc8b49e26e4a34957deb27305c9e89c
SHA256 e008595c509e2b82ad903ae0526498b0511dd08fd896941096e18f16adfcc737
MD5 f3cee4ffda1efafecd36a3b789c8ace4
SHA1 98247fd027c896361f0745f4556d86c7c4b0e0a1
SHA512 882b0e9b6f3d24ca5cd4d1838ae1e44be59d0c2a51b40461563b3d41dec508cb5942daa5eff8ffee43dccb335b964480c8cbfc9dfb5e1ca5edc2ff622371c17a
SSDEEP 12288:sNfBOaFtfxFbs3Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DB9:ypOY9TYsqjnhMgeiCl7G0nehbGZpbD
TLSH
T14D65F25677940CFAE977C57DC9428909ED627C464760EACB03A04AE75F336D08E3E722
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

35152

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\a\_work\1\s\src\debugpy\_vendored\pydevd\pydevd_attach_to_process\windows\inject_dll_amd64.pdb

kernel32

CloseHandle GetLastError WaitForSingleObject CreateRemoteThread OpenProcess VirtualAllocEx WriteProcessMemory VirtualFreeEx GetModuleHandleA GetProcAddress WideCharToMultiByte EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer MultiByteToWideChar LCMapStringEx GetStringTypeW GetCPInfo WriteConsoleW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW GetModuleHandleW RtlPcToFileHeader RaiseException RtlUnwindEx SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW GetStdHandle WriteFile GetModuleFileNameW ExitProcess GetModuleHandleExW GetCommandLineA GetCommandLineW HeapAlloc HeapFree GetFileType FlsAlloc FlsGetValue FlsSetValue FlsFree VirtualProtect CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW FlushFileBuffers GetConsoleOutputCP GetConsoleMode ReadFile GetFileSizeEx SetFilePointerEx ReadConsoleW HeapReAlloc FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle GetProcessHeap HeapSize CreateFileW RtlUnwind

Name

.text

Size

161KB

Virtual Size

161KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

81KB

Virtual Size

80KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

9KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

1.2MB

Virtual Size

1.8MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-22_f3cee4ffda1efafecd36a3b789c8ace4_icedid_luca-stealer_njrat_stealc

kernel32

generic