2026-07-22_0c6b77f947e3bb71516d93c0378cb850_icedid_luca-stealer_njrat_qakbot_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-22_0c6b77f947e3bb71516d93c0378cb850_icedid_luca-stealer_njrat_qakbot_stealc
Size 3.0MB
Sample260723-arn5rsed54
SHA256 f06994704749a85f287020d836cffcbab3e2da2160b2cd5aae204eefda6e84b0
MD5 0c6b77f947e3bb71516d93c0378cb850
SHA1 5817de4007fd84668dd75aa7ee908841ad69068c
SHA512 fb03e9ce6c4b6576c1aa7b0db3288f1494f5f81ee11e524e1a59b91c8949cb3087c7984b207b40fb08d94c25f22a2b26ef724fe79bdcf6da4e54996ddb1409c6
SSDEEP 98304:YemayLuC6dtaCXAQb84gi4zgcBvCHVaoj+:YeLHXAQb8TNEcBvCHVaoj+
TLSH
T14CE5E11AE76400ECD0ABC1B8C91A5A07E775744523306BDF56D096E67FA3BE12E7E320
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_Binary_References_Browsers

Detects executables containing SQL queries to confidential data stores. Observed in infostealers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-22_0c6b77f947e3bb71516d93c0378cb850_icedid_luca-stealer_njrat_qakbot_stealc

File Explorer

2026-07-22_0c6b77f947e3bb71516d93c0378cb850_icedid_luca-stealer_njrat_qakbot_stealc

.exe 3.0MB

2026-07-22_0c6b77f947e3bb71516d93c0378cb850_icedid_luca-stealer_njrat_qakbot_stealc

IMPHASH 34dbfccf6ce3d99b527d9b6d0668caa3
SHA256 f06994704749a85f287020d836cffcbab3e2da2160b2cd5aae204eefda6e84b0
MD5 0c6b77f947e3bb71516d93c0378cb850
SHA1 5817de4007fd84668dd75aa7ee908841ad69068c
SHA512 fb03e9ce6c4b6576c1aa7b0db3288f1494f5f81ee11e524e1a59b91c8949cb3087c7984b207b40fb08d94c25f22a2b26ef724fe79bdcf6da4e54996ddb1409c6
SSDEEP 98304:YemayLuC6dtaCXAQb84gi4zgcBvCHVaoj+:YeLHXAQb8TNEcBvCHVaoj+
TLSH
T14CE5E11AE76400ECD0ABC1B8C91A5A07E775744523306BDF56D096E67FA3BE12E7E320
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers
Detects executables containing SQL queries to confidential data stores. Observed in infostealers
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1170968

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

bcrypt

BCryptGenerateSymmetricKey BCryptSetProperty BCryptCloseAlgorithmProvider BCryptOpenAlgorithmProvider BCryptDecrypt BCryptDestroyKey

wininet

InternetOpenUrlA InternetConnectA HttpSendRequestA InternetSetOptionA HttpOpenRequestA InternetReadFile InternetCloseHandle InternetOpenA

kernel32

Sleep GetTempPathA GetSystemInfo SetFileAttributesA GetTickCount ReadFile CreateFileW CloseHandle GetFileSize LoadLibraryA DeleteFileA GetProcAddress LocalFree FreeLibrary CopyFileW SizeofResource Process32First WriteFile TerminateProcess FindResourceA WaitForSingleObject GetModuleHandleA OpenProcess CreateToolhelp32Snapshot CopyFileA CreateFileA LockResource Process32Next LoadResource CreateProcessA GlobalAlloc GlobalFree GlobalLock GlobalMemoryStatusEx GlobalUnlock GetComputerNameA LoadLibraryExA GetModuleFileNameA GetCurrentProcess GetEnvironmentVariableA CreateMutexA GetLastError ExitProcess GetDiskFreeSpaceExA IsDebuggerPresent CheckRemoteDebuggerPresent ExpandEnvironmentStringsA GetLocalTime FlushFileBuffers QueryPerformanceCounter MapViewOfFile CreateFileMappingW FormatMessageA GetSystemTime GetUserDefaultLCID WideCharToMultiByte GetModuleHandleW SystemTimeToFileTime GetProcessHeap GetCurrentProcessId LockFileEx UnlockFile HeapDestroy HeapCompact HeapAlloc LoadLibraryW HeapReAlloc DeleteFileW WaitForSingleObjectEx FlushViewOfFile OutputDebugStringW GetFileAttributesExW GetFileAttributesA GetDiskFreeSpaceA FormatMessageW MultiByteToWideChar HeapSize HeapValidate UnmapViewOfFile GetFileAttributesW CreateMutexW GetTempPathW UnlockFileEx SetEndOfFile GetFullPathNameA SetFilePointer LockFile OutputDebugStringA GetDiskFreeSpaceW GetFullPathNameW HeapFree HeapCreate AreFileApisANSI RaiseException InitializeCriticalSection EnterCriticalSection LeaveCriticalSection TryEnterCriticalSection DeleteCriticalSection GetCurrentThreadId LCMapStringW CompareStringW VirtualProtect FlsFree FlsSetValue IsValidLocale EnumSystemLocalesW ReadConsoleW GetTimeZoneInformation SetStdHandle IsValidCodePage GetACP GetCommandLineA GetOEMCP GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW WriteConsoleW GetSystemTimeAsFileTime RtlUnwind FlsGetValue FlsAlloc GetConsoleMode GetLocaleInfoEx CreateDirectoryW FindClose FindFirstFileW FindFirstFileExW FindNextFileW GetFileInformationByHandle SetFileInformationByHandle GetFileInformationByHandleEx InitializeCriticalSectionEx EncodePointer DecodePointer LCMapStringEx CompareStringEx GetCPInfo GetStringTypeW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent InitializeSListHead GetStartupInfoW RtlUnwindEx RtlPcToFileHeader SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW GetFileType CreateThread ExitThread FreeLibraryAndExitThread GetModuleHandleExW GetStdHandle GetModuleFileNameW GetFileSizeEx SetFilePointerEx GetConsoleOutputCP GetLocaleInfoW

user32

EnumDisplayDevicesA GetDesktopWindow ReleaseDC PeekMessageA GetSystemMetrics GetDC

gdi32

CreateCompatibleBitmap SelectObject CreateCompatibleDC GetDIBits DeleteDC DeleteObject GetObjectA BitBlt

advapi32

RegCloseKey GetCurrentHwProfileA RegQueryValueExA GetUserNameA RegOpenKeyExA RegSetValueExA

shell32

ShellExecuteA SHGetFolderPathA

Name

.text

Size

1.3MB

Virtual Size

1.3MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

238KB

Virtual Size

238KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

21KB

Virtual Size

27KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

58KB

Virtual Size

57KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1.4MB

Virtual Size

1.4MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-22_0c6b77f947e3bb71516d93c0378cb850_icedid_luca-stealer_njrat_qakbot_stealc

bcrypt

wininet

kernel32

user32

gdi32

advapi32

shell32

generic