2026-07-23_8bfd96132d1b03c7c921cdf0c2df5161_icedid_luca-stealer_njrat_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-23_8bfd96132d1b03c7c921cdf0c2df5161_icedid_luca-stealer_njrat_stealc
Size 1.6MB
Sample260723-hmrdbshf85
SHA256 950521fd5b9619c7770c00772d07bad2364f22e3779aae19c69ea1309715426e
MD5 8bfd96132d1b03c7c921cdf0c2df5161
SHA1 815da67d42b06ea5c31cf27b9ff3918461b9ff14
SHA512 8961b2f14a7df710b156d89701930c1c319ceaca487e7b425f72896428bbe3710ddf029586fbd79610a900996eb436c683d3998660a3cc27fe60f03e1c22af59
SSDEEP 24576:I2O3SB1mB1Ch2ifWTnnnRIwH6LRgy7iBY5/ryIDxXv:E3SBoBg2aWTnnRIG61tySHD
TLSH
T19D75BE1BE59BC1F9DC76C1B0C9928516EAB3B40983206ADB02A4955C2EFB5F04E3D73D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-23_8bfd96132d1b03c7c921cdf0c2df5161_icedid_luca-stealer_njrat_stealc

File Explorer

2026-07-23_8bfd96132d1b03c7c921cdf0c2df5161_icedid_luca-stealer_njrat_stealc

.exe 1.6MB

2026-07-23_8bfd96132d1b03c7c921cdf0c2df5161_icedid_luca-stealer_njrat_stealc

IMPHASH e0299018f2fdc638d5606d26312d114b
SHA256 950521fd5b9619c7770c00772d07bad2364f22e3779aae19c69ea1309715426e
MD5 8bfd96132d1b03c7c921cdf0c2df5161
SHA1 815da67d42b06ea5c31cf27b9ff3918461b9ff14
SHA512 8961b2f14a7df710b156d89701930c1c319ceaca487e7b425f72896428bbe3710ddf029586fbd79610a900996eb436c683d3998660a3cc27fe60f03e1c22af59
SSDEEP 24576:I2O3SB1mB1Ch2ifWTnnnRIwH6LRgy7iBY5/ryIDxXv:E3SBoBg2aWTnnRIG61tySHD
TLSH
T19D75BE1BE59BC1F9DC76C1B0C9928516EAB3B40983206ADB02A4955C2EFB5F04E3D73D
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

471824

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Jenkins\workspace\ebAdvisor_WABinary_release_4.1.1\build\x64\Release\UIHost.pdb

bcrypt

BCryptCloseAlgorithmProvider BCryptOpenAlgorithmProvider BCryptHashData BCryptGetProperty BCryptGenRandom BCryptCreateHash BCryptDestroyHash BCryptFinishHash

kernel32

ProcessIdToSessionId OpenProcess FormatMessageW GetCurrentProcess CloseHandle CreateToolhelp32Snapshot Process32FirstW Process32NextW K32EnumProcesses QueryFullProcessImageNameW TerminateProcess GetCurrentThreadId FindClose GetModuleFileNameW Sleep MoveFileExW GetFileAttributesW FindNextFileW CreateDirectoryW GetTickCount64 OutputDebugStringW LoadLibraryExW SetLastError ReadDirectoryChangesW GetNativeSystemInfo GetLargePageMinimum GetModuleHandleExW WaitForSingleObject GetSystemDirectoryW VirtualQuery MultiByteToWideChar CreateFileW IsDebuggerPresent RtlCaptureContext InitializeCriticalSectionEx SetUnhandledExceptionFilter DecodePointer IsWow64Process IsWow64Process2 GetFinalPathNameByHandleW LCMapStringEx GetFileInformationByHandleEx SetFileInformationByHandle SetFilePointerEx CancelIoEx GetCommandLineW WideCharToMultiByte ResetEvent WaitNamedPipeW GetNamedPipeServerProcessId GetNamedPipeClientProcessId WriteFile GetOverlappedResult ReadFile CreateMutexA ReleaseMutex HeapAlloc HeapFree HeapReAlloc HeapSize GetProcessHeap GetFileSizeEx GetConsoleMode GetConsoleOutputCP FlushFileBuffers GetTimeZoneInformation EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW FlsFree FlsSetValue FlsGetValue GetCurrentProcessId LocalFree GetModuleHandleW WaitForMultipleObjects SetEvent GetLastError CreateEventW GetProcAddress LoadLibraryExA FreeLibrary WTSGetActiveConsoleSessionId IsProcessorFeaturePresent RtlUnwind DeleteCriticalSection IsValidCodePage GetACP GetOEMCP GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle ReadConsoleW WriteConsoleW SetEndOfFile RaiseFailFastException FlsAlloc GetFileType GetStdHandle ExitProcess FreeLibraryAndExitThread ExitThread CreateThread TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount InterlockedPushEntrySList RtlUnwindEx GetStartupInfoW UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry InitializeSListHead GetCPInfo CompareStringEx GetSystemTimeAsFileTime EncodePointer LeaveCriticalSection EnterCriticalSection AcquireSRWLockShared ReleaseSRWLockShared RtlPcToFileHeader SleepConditionVariableSRW WakeAllConditionVariable InitOnceComplete InitOnceBeginInitialize QueryPerformanceFrequency QueryPerformanceCounter AreFileApisANSI RaiseException GetSystemInfo VirtualProtect FormatMessageA GetStringTypeW ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive WaitForSingleObjectEx GetExitCodeThread GetLocaleInfoEx FindFirstFileExW

user32

LoadStringW DispatchMessageW TranslateMessage PeekMessageW MsgWaitForMultipleObjects

advapi32

RegEnumKeyExW SetNamedSecurityInfoW GetSecurityDescriptorDacl QueryServiceStatusEx OpenServiceW OpenSCManagerW CloseServiceHandle ConvertStringSecurityDescriptorToSecurityDescriptorW RegSetValueExA RegSetValueExW RegQueryValueExW RegQueryValueExA RegOpenKeyExW RegNotifyChangeKeyValue RegCreateKeyExW RegCloseKey

shell32

SHGetSpecialFolderPathW

shlwapi

PathFileExistsW StrRChrW

Name

.text

Size

710KB

Virtual Size

709KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

308KB

Virtual Size

307KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

19KB

Virtual Size

61KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

35KB

Virtual Size

35KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.didat

Size

512B

Virtual Size

144B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1024B

Virtual Size

888B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

572KB

Virtual Size

576KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-23_8bfd96132d1b03c7c921cdf0c2df5161_icedid_luca-stealer_njrat_stealc

bcrypt

kernel32

user32

advapi32

shell32

shlwapi

generic