2026-07-28_9f8cbc30365f191aa2dab450a5871592_icedid_luca-stealer_njrat_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-28_9f8cbc30365f191aa2dab450a5871592_icedid_luca-stealer_njrat_stealc
Size 6.5MB
Sample260728-eafvaaam8v
SHA256 6776647368b5a6eef4ebdef7199ffa594066a51f56fcd6521895d54e0b326a65
MD5 9f8cbc30365f191aa2dab450a5871592
SHA1 18040d160ce2e911c217dcf620b4d4a9cbfe2187
SHA512 14f43b8cc761ebeea9bd2e3db643891f9527e17008d09642767cd111bfeda076adc8af09823735cabe626c9411d60799d1129c6c18466f23bc0c662271570a77
SSDEEP 98304:nSKuwjVMxdYGTZ3beZEeruIFvhKjZEeruIFvhK:nSKueVIdYGBbuhr7FvkFhr7Fvk
TLSH
T190660146B1934268DFB2A73888616267C1B1BCC547B083DB1A9F8E719F679F08E7D701
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-28_9f8cbc30365f191aa2dab450a5871592_icedid_luca-stealer_njrat_stealc

File Explorer

2026-07-28_9f8cbc30365f191aa2dab450a5871592_icedid_luca-stealer_njrat_stealc

.exe 6.5MB

2026-07-28_9f8cbc30365f191aa2dab450a5871592_icedid_luca-stealer_njrat_stealc

IMPHASH 89647688c854f7f82af7021922089180
SHA256 6776647368b5a6eef4ebdef7199ffa594066a51f56fcd6521895d54e0b326a65
MD5 9f8cbc30365f191aa2dab450a5871592
SHA1 18040d160ce2e911c217dcf620b4d4a9cbfe2187
SHA512 14f43b8cc761ebeea9bd2e3db643891f9527e17008d09642767cd111bfeda076adc8af09823735cabe626c9411d60799d1129c6c18466f23bc0c662271570a77
SSDEEP 98304:nSKuwjVMxdYGTZ3beZEeruIFvhKjZEeruIFvhK:nSKueVIdYGBbuhr7FvkFhr7Fvk
TLSH
T190660146B1934268DFB2A73888616267C1B1BCC547B083DB1A9F8E719F679F08E7D701
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

847596

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

d3d11

D3D11CreateDeviceAndSwapChain

d3dx11_43

D3DX11CreateShaderResourceViewFromFileA D3DX11GetImageInfoFromFileA D3DX11CreateShaderResourceViewFromMemory

wininet

InternetReadFile InternetOpenA InternetCloseHandle InternetOpenUrlA

crypt32

CryptStringToBinaryA CryptBinaryToStringA

kernel32

CreateEventA MapViewOfFile WriteProcessMemory OpenProcess CreateToolhelp32Snapshot Process32NextW Process32FirstW Module32FirstW Module32NextW GetExitCodeProcess CreateDirectoryW FindFirstFileW GetFileSizeEx VirtualProtect FindNextFileW GetCurrentProcess WriteFile DeviceIoControl RemoveDirectoryW GetEnvironmentVariableW SetEndOfFile GetTempPathW FindClose GetFileAttributesW ExitThread DeleteFileW FreeConsole SetFilePointerEx MoveFileExW GetCurrentProcessId CreateProcessW AllocConsole MoveFileW FlushFileBuffers GetModuleFileNameA MoveFileA CreateMutexA GetVolumeInformationA GetFileAttributesA DeleteFileA LocalFree GetConsoleWindow CreateDirectoryA FormatMessageA IsDebuggerPresent GetComputerNameA CheckRemoteDebuggerPresent IsValidCodePage GetTimeZoneInformation GetConsoleOutputCP ReadConsoleW GetConsoleMode CreateFileA OutputDebugStringW EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW FlsFree FlsSetValue FlsGetValue FlsAlloc HeapFree HeapAlloc GetModuleHandleW WriteConsoleW GetFileType GetStdHandle GetModuleHandleExW FreeLibraryAndExitThread CreateThread LoadLibraryExW TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount SetLastError RaiseException RtlPcToFileHeader RtlUnwindEx InitializeSListHead GetStartupInfoW IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext GetStringTypeW GetCPInfo CompareStringEx WakeAllConditionVariable LCMapStringEx CreateFileMappingA SetEvent GetLastError UnmapViewOfFile SetFileInformationByHandle CreateFileW WaitForSingleObject GetModuleFileNameW SetFileTime TerminateProcess CreateProcessA QueryPerformanceCounter FreeLibrary GetProcAddress QueryPerformanceFrequency LoadLibraryA GetLocaleInfoA GetModuleHandleA GlobalUnlock WideCharToMultiByte GlobalLock RtlUnwind GlobalFree GlobalAlloc MultiByteToWideChar GetTickCount64 GetTickCount Sleep ExitProcess GetACP GetOEMCP GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetProcessHeap SetStdHandle DecodePointer EncodePointer DeleteCriticalSection LeaveCriticalSection EnterCriticalSection GetSystemTime SystemTimeToFileTime GetLocalTime ReadFile CloseHandle HeapSize HeapReAlloc GetSystemTimeAsFileTime InitializeCriticalSectionEx GetFileInformationByHandleEx AreFileApisANSI GetFileAttributesExW FindFirstFileExW GetLocaleInfoEx SleepConditionVariableSRW ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive GetCurrentThreadId

user32

ShowWindow SetWindowPos SendInput SetClipboardData GetClipboardData EmptyClipboard CloseClipboard OpenClipboard GetCursorPos DispatchMessageW SetCursorPos ReleaseCapture IsWindowUnicode SetWindowDisplayAffinity SetCapture LoadCursorW GetForegroundWindow GetKeyboardLayout GetAsyncKeyState TrackMouseEvent ClientToScreen GetCapture ScreenToClient TranslateMessage GetMessageExtraInfo SetForegroundWindow UpdateWindow GetClientRect PeekMessageW SetCursor RegisterClassExW GetKeyState GetWindowLongW SetWindowLongA GetWindowRect GetWindowThreadProcessId GetWindowTextLengthW EnumWindows GetWindowTextW DefWindowProcW DestroyWindow CreateWindowExW GetSystemMetrics UnregisterClassW MessageBoxA MapWindowPoints MoveWindow SetLayeredWindowAttributes LoadIconW GetParent SetWindowLongW

comdlg32

GetOpenFileNameA

advapi32

AdjustTokenPrivileges RegQueryValueExW RegEnumValueW CryptAcquireContextW ConvertSidToStringSidA GetUserNameA CryptCreateHash CryptHashData CryptDestroyHash CryptGetHashParam CryptReleaseContext AddAccessAllowedAce GetLengthSid RegDeleteValueW GetTokenInformation RegCreateKeyExA RegSetValueExA RegOpenKeyExA RegDeleteValueA LookupPrivilegeValueW SetSecurityDescriptorDacl RegCloseKey SetSecurityDescriptorOwner AllocateAndInitializeSid RegEnumKeyExW RegSetKeySecurity RegSetValueExW OpenProcessToken FreeSid InitializeSecurityDescriptor InitializeAcl RegOpenKeyExW

shell32

SHGetFolderPathA ShellExecuteW

ole32

CoCreateInstance CoInitialize

winmm

mciSendStringA

imm32

ImmSetCandidateWindow ImmSetCompositionWindow ImmReleaseContext ImmGetContext

d3dcompiler_43

D3DCompile

dwmapi

DwmExtendFrameIntoClientArea DwmFlush

shlwapi

PathFileExistsW

ws2_32

WSACleanup ntohl getaddrinfo WSAStartup freeaddrinfo

winhttp

WinHttpReceiveResponse WinHttpOpen WinHttpQueryHeaders WinHttpReadData WinHttpOpenRequest WinHttpCloseHandle WinHttpSendRequest WinHttpConnect WinHttpQueryDataAvailable

bcrypt

BCryptGetProperty BCryptOpenAlgorithmProvider BCryptGenRandom BCryptFinishHash BCryptCloseAlgorithmProvider BCryptDestroyHash BCryptHashData BCryptCreateHash

Name

.text

Size

1.0MB

Virtual Size

1.0MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

3.9MB

Virtual Size

3.9MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

1.3MB

Virtual Size

1.4MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

40KB

Virtual Size

40KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

102KB

Virtual Size

102KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-28_9f8cbc30365f191aa2dab450a5871592_icedid_luca-stealer_njrat_stealc

d3d11

d3dx11_43

wininet

crypt32

kernel32

user32

comdlg32

advapi32

shell32

ole32

winmm

imm32

d3dcompiler_43

dwmapi

shlwapi

ws2_32

winhttp

bcrypt

generic