2026-07-28_ec839a74d385d502271d1206e2e3a7a1_icedid_luca-stealer_njrat_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-28_ec839a74d385d502271d1206e2e3a7a1_icedid_luca-stealer_njrat_stealc
Size 4.1MB
Sample260728-ezlrtsythy
SHA256 5df254ad02c615b18e294022d0f5bfdfb0c25dcacbf25822cb7da5b104bd7eaa
MD5 ec839a74d385d502271d1206e2e3a7a1
SHA1 3ec1fb43c21795d82059c6f566f2eee9db3d0b8f
SHA512 ecd9d239c76023e3249392b1fe21e6af559b2bed27ccd1cd389f55c75081d4bb8cf9045b6a9fa1ddd322ed902384938c9fa4b38b7938937bc0f2a081df6b38ee
SSDEEP 49152:uwaHs/h8kOxivmt6S3L+e1NfgQY3maJ0eQcqU0IymH6m:uhXqe1Nfem5eQc/F
TLSH
T18916901163E903A8F1F39B789ABA56118A73BC598F34D6DF0298515E0F37AD08974B33
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects executables containing URLs to raw contents of a Github gist 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL

File Explorer

2026-07-28_ec839a74d385d502271d1206e2e3a7a1_icedid_luca-stealer_njrat_stealc

.exe 4.1MB

2026-07-28_ec839a74d385d502271d1206e2e3a7a1_icedid_luca-stealer_njrat_stealc

IMPHASH eb21ae6e28ae2cb643b88aadc622080e
SHA256 5df254ad02c615b18e294022d0f5bfdfb0c25dcacbf25822cb7da5b104bd7eaa
MD5 ec839a74d385d502271d1206e2e3a7a1
SHA1 3ec1fb43c21795d82059c6f566f2eee9db3d0b8f
SHA512 ecd9d239c76023e3249392b1fe21e6af559b2bed27ccd1cd389f55c75081d4bb8cf9045b6a9fa1ddd322ed902384938c9fa4b38b7938937bc0f2a081df6b38ee
SSDEEP 49152:uwaHs/h8kOxivmt6S3L+e1NfgQY3maJ0eQcqU0IymH6m:uhXqe1Nfem5eQc/F
TLSH
T18916901163E903A8F1F39B789ABA56118A73BC598F34D6DF0298515E0F37AD08974B33
MD5 SHA1 SHA512 SSDEEP TLSH

Detects executables containing URLs to raw contents of a Github gist

Digest

e7:9b:97:c5:2e:03:11:bb:7c:ea:61:6a:28:e7:f8:b8:93:a2:29:4c:cd:91:7d:6e:87:82:5c:1f:d8:ac:15:6c

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jul 24, 2026

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:02:1d:4d:19:c8:4e:d7:0f:57:48:00:00:00:00:02:1d

Issuer

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 16, 2026 - Apr 15, 2027

Subject

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:39:3b:b6:37:19:bf:06:1d:67:00:00:00:00:00:39

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 8, 2024 - Mar 22, 2036

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:9200-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:02:23:4f:d9:60:24:53:cf:fe:2b:00:01:00:00:02:23

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Feb 19, 2026 - May 17, 2027

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 30, 2021 - Sep 30, 2030

Minor OS version

Major OS version

Entry point

1463168

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\__w\1\s\bin\x64\Release\wsl.pdb

kernel32

FreeConsole AttachConsole GetConsoleMode FlushConsoleInputBuffer K32GetModuleFileNameExW CompareStringOrdinal MultiByteToWideChar SetHandleInformation ConnectNamedPipe CreateNamedPipeW GetOverlappedResult CancelIoEx WaitForMultipleObjects InitializeProcThreadAttributeList DeleteProcThreadAttributeList GetSystemDirectoryW GetDynamicTimeZoneInformation GetUserDefaultGeoName AllocConsole SetConsoleTitleW GetPackagesByPackageFamily FindClose FindFirstFileW FindNextFileW GetDriveTypeW GetFileAttributesW GetFinalPathNameByHandleW GetFullPathNameW GetLogicalDrives GetTempFileNameW SetFileAttributesW SetFileInformationByHandle GetTempPathW GetComputerNameExA FindStringOrdinal LocalAlloc CopyFileW GetFileInformationByHandleEx GetUserPreferredUILanguages SetFilePointer UpdateProcThreadAttribute ReadFile CreatePipe DuplicateHandle SetThreadDescription GetLogicalProcessorInformationEx FreeLibrary LoadLibraryExW LoadLibraryW GetCurrentPackageId GetPackageFamilyName K32EnumProcesses GetConsoleCP VerifyVersionInfoW SetConsoleMode SetConsoleCP SetConsoleOutputCP GetConsoleScreenBufferInfoEx SetFilePointerEx ResetEvent GetEnvironmentStringsW FreeEnvironmentStringsW ExpandEnvironmentStringsW GetCurrentDirectoryW PeekConsoleInputW SetProcessMitigationPolicy GetFileSizeEx SetEndOfFile CancelSynchronousIo CreateMutexW ExitProcess GetWindowsDirectoryW CreateJobObjectW AssignProcessToJobObject SetInformationJobObject SetConsoleCtrlHandler Sleep RaiseException WriteConsoleW GetConsoleScreenBufferInfo SetConsoleCursorPosition TerminateProcess ReadProcessMemory CreatePseudoConsole ResizePseudoConsole ClosePseudoConsole EnterCriticalSection LeaveCriticalSection CreateEventW LoadLibraryExA VirtualQuery GetSystemInfo SetEnvironmentVariableW GetTimeZoneInformation HeapSize GetOEMCP GetACP IsValidCodePage HeapReAlloc FlushFileBuffers EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW LocalFree GetModuleFileNameW GetCurrentThread GetExitCodeProcess GetCurrentProcess CreateEventExW SetEvent WriteFile RemoveDirectoryW GetFileType DeleteFileW CreateFileW CreateDirectoryW SetCurrentDirectoryW GetStdHandle VerSetConditionMask GetCommandLineW WideCharToMultiByte FormatMessageW GetProcAddress GetModuleHandleExW GetModuleHandleW GetModuleFileNameA GetCurrentThreadId GetCurrentProcessId CreateSemaphoreExW CreateMutexExW OpenSemaphoreW WaitForSingleObjectEx WaitForSingleObject ReleaseMutex ReleaseSemaphore DeleteCriticalSection InitializeCriticalSectionEx GetProcessHeap HeapFree HeapAlloc IsDebuggerPresent SetLastError GetLastError CloseHandle DecodePointer OutputDebugStringW DebugBreak GetConsoleOutputCP GetDateFormatW VirtualProtect IsThreadAFiber FlsFree FlsSetValue FlsGetValue FlsAlloc ReadConsoleW PeekConsoleInputA ReadConsoleInputW GetNumberOfConsoleInputEvents GetCommandLineA SetStdHandle FreeLibraryAndExitThread ResumeThread ExitThread CreateThread TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount InterlockedFlushSList InterlockedPushEntrySList InitializeSListHead GetStartupInfoW IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter GetCPInfo CompareStringEx CloseThreadpoolWait SetThreadpoolWait CreateThreadpoolWait CloseThreadpoolTimer WaitForThreadpoolTimerCallbacks SetThreadpoolTimer CreateThreadpoolTimer FreeLibraryWhenCallbackReturns GetSystemTimeAsFileTime GetCurrentProcessorNumber FlushProcessWriteBuffers InitOnceExecuteOnce LCMapStringEx EncodePointer WakeAllConditionVariable WakeConditionVariable GetTickCount64 SleepConditionVariableSRW TryAcquireSRWLockShared TryAcquireSRWLockExclusive AcquireSRWLockShared AcquireSRWLockExclusive ReleaseSRWLockShared ReleaseSRWLockExclusive QueryPerformanceFrequency QueryPerformanceCounter InitOnceComplete InitOnceBeginInitialize CreateSymbolicLinkW CreateHardLinkW MoveFileExW CreateDirectoryExW DeviceIoControl AreFileApisANSI SetFileTime GetFileInformationByHandle GetFileAttributesExW GetDiskFreeSpaceExW FindFirstFileExW GetStringTypeW GetLocaleInfoEx FormatMessageA GetNativeSystemInfo GetExitCodeThread SwitchToThread

user32

UnregisterClassW MessageBoxW

shell32

ShellExecuteExW SHGetKnownFolderPath CommandLineToArgvW

ole32

CoInitializeEx CoTaskMemFree CoCreateGuid CoTaskMemAlloc CoImpersonateClient CoUninitialize CoCreateFreeThreadedMarshaler CoInitializeSecurity CoGetCallContext CoCreateInstance CoRevertToSelf

advapi32

GetLengthSid LookupPrivilegeValueW SetTokenInformation SetSecurityDescriptorOwner InitializeSecurityDescriptor GetSidSubAuthorityCount GetSidSubAuthority DuplicateTokenEx CreateRestrictedToken CheckTokenMembership RegDeleteTreeW RegSetKeyValueW RegDeleteKeyValueW RegSetValueExW RegQueryInfoKeyW RegEnumValueW RegEnumKeyExW RegDeleteValueW RegCreateKeyExW ConvertSidToStringSidW CryptDestroyHash CryptHashData CryptCreateHash CryptGetHashParam CryptReleaseContext CryptAcquireContextW RegOpenCurrentUser ReportEventW CreateProcessAsUserW AdjustTokenPrivileges OpenServiceW OpenSCManagerW CloseServiceHandle SetThreadToken EventSetInformation EventUnregister EventRegister EventWriteTransfer RegGetValueW RegOpenKeyExW RegCloseKey GetTokenInformation OpenThreadToken OpenProcessToken

ws2_32

WSAGetLastError WSAGetOverlappedResult shutdown setsockopt WSARecv WSASend bind listen WSAIoctl WSASocketW WSAStartup closesocket InetNtopW ioctlsocket

userenv

CreateEnvironmentBlock GetUserProfileDirectoryW DestroyEnvironmentBlock

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory RoActivateInstance

api-ms-win-core-winrt-string-l1-1-0

WindowsCreateStringReference

api-ms-win-core-path-l1-1-0

PathCchSkipRoot PathAllocCombine PathCchRemoveFileSpec

ntdll

NtQueryInformationFile NtSetInformationFile ZwQueryEaFile NtQueryDirectoryFile ZwSetEaFile NtOpenFile NtSetInformationThread ZwQueryKey RtlInitializeSidEx NtQueryInformationProcess NtClose NtWaitForSingleObject ZwCreateEvent NtReadFile NtWriteFile NtCancelIoFileEx RtlPcToFileHeader RtlCaptureContext RtlInitUnicodeString NtQueryInformationThread NtDeviceIoControlFile RtlIpv4AddressToStringA RtlIpv6AddressToStringA RtlIpv4AddressToStringW RtlIpv6AddressToStringW RtlUnwind RtlIpv4StringToAddressW RtlIpv6StringToAddressW NtCreateNamedPipeFile RtlLookupFunctionEntry RtlVirtualUnwind RtlUnwindEx NtCreateFile

rpcrt4

RpcRevertToSelf RpcImpersonateClient

mswsock

AcceptEx

shlwapi

PathUnquoteSpacesW PathIsRelativeW

bcrypt

BCryptCreateHash BCryptHashData BCryptFinishHash BCryptDestroyHash

icu

u_UCharsToChars u_errorName ucal_getTimeZoneIDForWindowsID

api-ms-win-core-winrt-error-l1-1-1

RoOriginateLanguageException

oleaut32

SetErrorInfo GetErrorInfo SysFreeString SysStringLen

Name

.text

Size

2.0MB

Virtual Size

2.0MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.8MB

Virtual Size

1.8MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

89KB

Virtual Size

107KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

93KB

Virtual Size

93KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.didat

Size

512B

Virtual Size

64B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

65KB

Virtual Size

64KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

13KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-28_ec839a74d385d502271d1206e2e3a7a1_icedid_luca-stealer_njrat_stealc

kernel32

user32

shell32

ole32

advapi32

ws2_32

userenv

api-ms-win-core-winrt-l1-1-0

api-ms-win-core-winrt-string-l1-1-0

api-ms-win-core-path-l1-1-0

ntdll

rpcrt4

mswsock

shlwapi

bcrypt

icu

api-ms-win-core-winrt-error-l1-1-1

oleaut32

generic