2026-07-23_93d3d0bac7c2080f340325a00f468e6d_icedid_luca-stealer_njrat_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-23_93d3d0bac7c2080f340325a00f468e6d_icedid_luca-stealer_njrat_stealc
Size 11.2MB
Sample260723-sjz66seq61
SHA256 e7a8af8e8ff3630362b53f4c1b948863282334ed7473b33495231567fcff9809
MD5 93d3d0bac7c2080f340325a00f468e6d
SHA1 4d03514dbbbed7edc150786b4db78bab65f56e12
SHA512 2a29230c4ff03d4448db6c9b6a3f7b8e701b415b2746fbc848fac2ea034bb2515fa415d754be92978e7016b48318e1abcaa097421ae2b6ad1cd4adbd8d652083
SSDEEP 98304:8rcklSwCL478UwppALdmIXYUiEConbw7KGCG3:8QJC78jAL/XtiECEs7KG
TLSH
T100C66C1AE2102D95F0A59C39586AB31128F339574DA8BC4AF31D8F0D9F3D27C197AB4B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-23_93d3d0bac7c2080f340325a00f468e6d_icedid_luca-stealer_njrat_stealc

File Explorer

2026-07-23_93d3d0bac7c2080f340325a00f468e6d_icedid_luca-stealer_njrat_stealc

.exe 11.2MB

2026-07-23_93d3d0bac7c2080f340325a00f468e6d_icedid_luca-stealer_njrat_stealc

IMPHASH ced6fcecba7b01a81252b9bba45428af
SHA256 e7a8af8e8ff3630362b53f4c1b948863282334ed7473b33495231567fcff9809
MD5 93d3d0bac7c2080f340325a00f468e6d
SHA1 4d03514dbbbed7edc150786b4db78bab65f56e12
SHA512 2a29230c4ff03d4448db6c9b6a3f7b8e701b415b2746fbc848fac2ea034bb2515fa415d754be92978e7016b48318e1abcaa097421ae2b6ad1cd4adbd8d652083
SSDEEP 98304:8rcklSwCL478UwppALdmIXYUiEConbw7KGCG3:8QJC78jAL/XtiECEs7KG
TLSH
T100C66C1AE2102D95F0A59C39586AB31128F339574DA8BC4AF31D8F0D9F3D27C197AB4B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

734532

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

wininet

HttpSendRequestA HttpOpenRequestA InternetSetOptionA InternetQueryOptionA InternetReadFile InternetOpenUrlA InternetConnectA InternetCloseHandle InternetOpenA

ws2_32

closesocket inet_pton WSACleanup WSAStartup socket setsockopt send recv htons connect

user32

PeekMessageW PostMessageW DefWindowProcW PostQuitMessage RegisterClassW UnregisterClassW CreateWindowExW IsWindow TranslateMessage DestroyWindow LoadCursorA ScreenToClient GetCursorPos SetCursor SetCursorPos IsWindowUnicode ReleaseCapture SetCapture GetCapture GetWindowLongW GetKeyState GetMessageExtraInfo TrackMouseEvent EmptyClipboard GetClipboardData SetClipboardData CloseClipboard OpenClipboard LoadIconW LoadCursorW GetWindow GetWindowThreadProcessId GetClassNameW EnumWindows SetWindowLongPtrW GetWindowLongPtrW SetWindowLongW ShowWindow ClientToScreen MessageBoxW MessageBoxA GetClientRect GetWindowTextW SetForegroundWindow GetForegroundWindow SetActiveWindow UpdateWindow GetAsyncKeyState IsWindowVisible SetWindowDisplayAffinity SetWindowPos SetLayeredWindowAttributes DispatchMessageW

gdi32

CreateSolidBrush

d3dcompiler_47

D3DCompile

comdlg32

GetOpenFileNameW GetSaveFileNameA GetOpenFileNameA

iphlpapi

GetAdaptersInfo

advapi32

RegOpenKeyExA RegCloseKey GetUserNameA RegQueryValueExA

dwmapi

DwmExtendFrameIntoClientArea

shell32

SHGetFolderPathW SHGetFolderPathA

d3d11

D3D11CreateDeviceAndSwapChain

kernel32

FlsFree FlsSetValue FlsGetValue FlsAlloc GetTimeZoneInformation HeapReAlloc HeapFree HeapAlloc GetCommandLineW GetCommandLineA WriteConsoleW GetFileType FreeLibraryAndExitThread ExitThread CreateThread GetModuleHandleExW LoadLibraryExW TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount VirtualProtect RtlUnwindEx RaiseException RtlPcToFileHeader GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW InitializeSListHead GetCurrentProcessId GetStartupInfoW IsDebuggerPresent IsProcessorFeaturePresent TerminateProcess GetCurrentProcess UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext GetCPInfo GetStringTypeW LCMapStringEx DecodePointer EncodePointer IsValidLocale GetUserDefaultLCID EnumSystemLocalesW FlushFileBuffers GetConsoleOutputCP GetFileSizeEx SetFilePointerEx ReadConsoleW OutputDebugStringW FindFirstFileExW FindNextFileW IsValidCodePage WakeAllConditionVariable GetACP GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW GetProcessHeap SetEnvironmentVariableW SetStdHandle HeapSize SetEndOfFile SetLastError GetModuleFileNameW GetStdHandle CreateDirectoryA CreateDirectoryW CreateFileW DeleteFileW FindClose FindFirstFileA FindNextFileA GetFileSize ReadFile RemoveDirectoryW WriteFile GetTempPathW GetVolumeInformationA CloseHandle SetUnhandledExceptionFilter GetLastError WaitForSingleObject ExitProcess GetExitCodeProcess CreateRemoteThread GetExitCodeThread OpenProcess GetLocalTime GetTickCount GetTickCount64 VirtualAllocEx WriteProcessMemory VirtualFreeEx RtlUnwind GetModuleHandleA GetModuleHandleW GetProcAddress WinExec WideCharToMultiByte FreeConsole GetConsoleMode SetConsoleMode SetConsoleTextAttribute SetConsoleTitleW CreateToolhelp32Snapshot Process32FirstW Process32NextW Sleep ReadProcessMemory Module32FirstW Module32NextW GlobalAlloc GlobalUnlock GlobalLock GlobalFree MultiByteToWideChar QueryPerformanceCounter QueryPerformanceFrequency FreeLibrary LoadLibraryA OutputDebugStringA WaitForSingleObjectEx GetCurrentThreadId ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive SleepConditionVariableSRW EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection GetSystemTimeAsFileTime

imm32

ImmSetCandidateWindow ImmGetContext ImmReleaseContext ImmSetCompositionWindow

Name

.text

Size

996KB

Virtual Size

995KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

5.4MB

Virtual Size

5.4MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4.8MB

Virtual Size

6.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

36KB

Virtual Size

35KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

26KB

Virtual Size

25KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-23_93d3d0bac7c2080f340325a00f468e6d_icedid_luca-stealer_njrat_stealc

wininet

ws2_32

user32

gdi32

d3dcompiler_47

comdlg32

iphlpapi

advapi32

dwmapi

shell32

d3d11

kernel32

imm32

generic