2026-07-22_93312ef134257ac2055c3f3a07f5cc19_icedid_luca-stealer_njrat_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-22_93312ef134257ac2055c3f3a07f5cc19_icedid_luca-stealer_njrat_stealc
Size 1.4MB
Sample260722-a2zz1sha86
SHA256 549f2753624667b3a4fbff2d62b06f792639786bb872136ed9a194189dc0600e
MD5 93312ef134257ac2055c3f3a07f5cc19
SHA1 b44782c64065f232a0dcc265a4c44257637fef17
SHA512 84e2c41ca83e8855c3ae05aa41aa05ce9f2231d42d13b21269a9a3088e1855727f77238fdd358a2f07cd0076eafc437eee54e6bd131ed3a9ecf9ee15ed2a8dd8
SSDEEP 24576:TbtigwnF30gQbXjm93RUzKfojKNsVDsqjnhMgeiCl7G0nehbGZpbD:KmgmXjuUyog4HDmg27RnWGj
TLSH
T19065BE2EB7EC11F9D0BBD175CA624516FBB27C15173096AF03A1525A2F37AA04E3E312
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-22_93312ef134257ac2055c3f3a07f5cc19_icedid_luca-stealer_njrat_stealc

File Explorer

2026-07-22_93312ef134257ac2055c3f3a07f5cc19_icedid_luca-stealer_njrat_stealc

.exe 1.4MB

2026-07-22_93312ef134257ac2055c3f3a07f5cc19_icedid_luca-stealer_njrat_stealc

IMPHASH 8f277bb40bff3becd26d90121e144f65
SHA256 549f2753624667b3a4fbff2d62b06f792639786bb872136ed9a194189dc0600e
MD5 93312ef134257ac2055c3f3a07f5cc19
SHA1 b44782c64065f232a0dcc265a4c44257637fef17
SHA512 84e2c41ca83e8855c3ae05aa41aa05ce9f2231d42d13b21269a9a3088e1855727f77238fdd358a2f07cd0076eafc437eee54e6bd131ed3a9ecf9ee15ed2a8dd8
SSDEEP 24576:TbtigwnF30gQbXjm93RUzKfojKNsVDsqjnhMgeiCl7G0nehbGZpbD:KmgmXjuUyog4HDmg27RnWGj
TLSH
T19065BE2EB7EC11F9D0BBD175CA624516FBB27C15173096AF03A1525A2F37AA04E3E312
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

315840

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

MsSense.pdb

kernel32

CompareFileTime FindVolumeClose FindNextVolumeW FindFirstVolumeW CreateFileW DeleteFileW FindClose FindFirstFileW FindNextFileW FlushFileBuffers GetFileAttributesW RemoveDirectoryW SetFileAttributesW SetFilePointerEx WriteFile QueryPerformanceCounter MultiByteToWideChar DeviceIoControl DeleteCriticalSection MoveFileExW InitializeCriticalSectionEx LeaveCriticalSection EnterCriticalSection GetWindowsDirectoryW GetComputerNameExW GetVolumePathNamesForVolumeNameW GetVolumeNameForVolumeMountPointW GlobalAlloc GlobalFree GetTempPathW GetTempFileNameW GetLongPathNameW ExpandEnvironmentStringsW QueryDosDeviceW GetVolumeInformationW VerifyVersionInfoW GetModuleFileNameW CloseThreadpoolTimer WaitForThreadpoolTimerCallbacks SetThreadpoolTimer CreateThreadpoolTimer GetProductInfo GetVersionExW Sleep CompareStringW DecodePointer HeapReAlloc HeapSize AcquireSRWLockShared AcquireSRWLockExclusive ReleaseSRWLockShared ReleaseSRWLockExclusive VerSetConditionMask GetSystemTimeAsFileTime LoadLibraryW FreeLibrary TerminateProcess GetLogicalDrives IsDebuggerPresent GetCurrentProcess InitOnceComplete InitOnceBeginInitialize WideCharToMultiByte FormatMessageW GetProcAddress GetModuleHandleExW GetModuleHandleW GetModuleFileNameA GetCurrentThreadId GetCurrentProcessId WriteConsoleW RaiseException GetSystemInfo VirtualProtect VirtualQuery LoadLibraryExA SetEnvironmentVariableW LoadLibraryExW InitializeCriticalSectionAndSpinCount GetModuleHandleExA CreateSemaphoreExW CreateMutexExW OpenSemaphoreW WaitForSingleObjectEx WaitForSingleObject ReleaseMutex ReleaseSemaphore GetProcessHeap HeapFree HeapAlloc SetLastError GetLastError CloseHandle OutputDebugStringW DebugBreak GetDriveTypeW SetStdHandle FreeEnvironmentStringsW GetEnvironmentStringsW FindFirstFileExW GetConsoleMode GetConsoleOutputCP RtlPcToFileHeader GetStringTypeW WakeAllConditionVariable SleepConditionVariableSRW EncodePointer CompareStringEx GetCPInfo LCMapStringEx InitializeSListHead RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent GetStartupInfoW RtlUnwindEx InterlockedPushEntrySList TlsAlloc TlsGetValue TlsSetValue TlsFree IsValidCodePage GetACP GetOEMCP ExitProcess GetStdHandle GetCommandLineA GetCommandLineW GetFileType FlsAlloc FlsGetValue FlsSetValue FlsFree LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW

advapi32

RegGetValueW RegDeleteKeyValueW RegOpenKeyExW RegCreateKeyExW ChangeServiceConfigW ControlService QueryServiceConfigW StartServiceW OpenServiceW OpenSCManagerW CloseServiceHandle StartServiceCtrlDispatcherW EventRegister EventUnregister EventSetInformation EventWriteTransfer RegSetValueExW RegCloseKey DestroyPrivateObjectSecurity GetSecurityDescriptorSacl ConvertStringSecurityDescriptorToSecurityDescriptorW SetNamedSecurityInfoW GetSecurityDescriptorOwner GetSecurityDescriptorGroup GetSecurityDescriptorDacl LookupPrivilegeValueW AdjustTokenPrivileges OpenProcessToken

version

VerQueryValueW GetFileVersionInfoW GetFileVersionInfoSizeW

api-ms-win-core-featurestaging-l1-1-0

UnsubscribeFeatureStateChangeNotification RecordFeatureError GetFeatureEnabledState RecordFeatureUsage SubscribeFeatureStateChangeNotification

api-ms-win-core-featurestaging-l1-1-1

GetFeatureVariant

api-ms-win-core-path-l1-1-0

PathCchCombine

userenv

GetAllUsersProfileDirectoryW

ws2_32

InetNtopW

iphlpapi

GetUnicastIpAddressEntry GetIfEntry2 GetUnicastIpAddressTable FreeMibTable

setupapi

SetupInstallFromInfSectionW SetupDiEnumDeviceInfo SetupDiDestroyDeviceInfoList SetupInstallServicesFromInfSectionW SetupDiGetDevicePropertyW SetupOpenInfFileW SetupDiGetDeviceRegistryPropertyW SetupDiGetClassDevsW SetupDiGetDeviceInterfaceDetailW SetupDiEnumDeviceInterfaces

bcrypt

BCryptDestroyHash BCryptCloseAlgorithmProvider

ntdll

RtlInitUnicodeString

Name

.text

Size

520KB

Virtual Size

517KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

208KB

Virtual Size

205KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

20KB

Virtual Size

31KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

28KB

Virtual Size

25KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.didat

Size

4KB

Virtual Size

32B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.fptable

Size

4KB

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

44KB

Virtual Size

40KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

576KB

Virtual Size

580KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-22_93312ef134257ac2055c3f3a07f5cc19_icedid_luca-stealer_njrat_stealc

kernel32

advapi32

version

api-ms-win-core-featurestaging-l1-1-0

api-ms-win-core-featurestaging-l1-1-1

api-ms-win-core-path-l1-1-0

userenv

ws2_32

iphlpapi

setupapi

bcrypt

ntdll

generic