2026-07-30_1a7aa30a63fbbd2c358dbd2142992ad4_icedid_luca-stealer_njrat_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-30_1a7aa30a63fbbd2c358dbd2142992ad4_icedid_luca-stealer_njrat_stealc
Size 1.8MB
Sample260730-2mlbvsyeld
SHA256 d2125fae5c707dc00c4d8c939896aa7b8027082175970efd888c71eb219b4f4f
MD5 1a7aa30a63fbbd2c358dbd2142992ad4
SHA1 a80340bf1e824b03cc42dfd3d9ebb0e2fc74f426
SHA512 b79cd74605b85f27f0a2c78177c48ac2e98d2cc0ebce90a7afab621ef29e3b73a58d3734a67b3637693c6c84d8fc503e43e4996fb0c39b354beea5ed300dbac8
SSDEEP 24576:hHolsnJbclb8JM/KobAssFRrRRswzgKPZNAJJodtgVGT/348QzchBm4NpGB4M7la:dJWEMjir5lbjAVGjFhM4rGSMZPwKU
TLSH
T1D485AE17BAB400FDC097C1798A16590FEB7678191374AACB5AD086666F73FE01A7E330
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-30_1a7aa30a63fbbd2c358dbd2142992ad4_icedid_luca-stealer_njrat_stealc

File Explorer

2026-07-30_1a7aa30a63fbbd2c358dbd2142992ad4_icedid_luca-stealer_njrat_stealc

.exe 1.8MB

2026-07-30_1a7aa30a63fbbd2c358dbd2142992ad4_icedid_luca-stealer_njrat_stealc

IMPHASH 90c1e498b512f7e5f0fbdaaf7bce5edf
SHA256 d2125fae5c707dc00c4d8c939896aa7b8027082175970efd888c71eb219b4f4f
MD5 1a7aa30a63fbbd2c358dbd2142992ad4
SHA1 a80340bf1e824b03cc42dfd3d9ebb0e2fc74f426
SHA512 b79cd74605b85f27f0a2c78177c48ac2e98d2cc0ebce90a7afab621ef29e3b73a58d3734a67b3637693c6c84d8fc503e43e4996fb0c39b354beea5ed300dbac8
SSDEEP 24576:hHolsnJbclb8JM/KobAssFRrRRswzgKPZNAJJodtgVGT/348QzchBm4NpGB4M7la:dJWEMjir5lbjAVGjFhM4rGSMZPwKU
TLSH
T1D485AE17BAB400FDC097C1798A16590FEB7678191374AACB5AD086666F73FE01A7E330
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1888640

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

shell32

SHGetKnownFolderPath SHGetFolderPathW

ole32

CoUninitialize CoTaskMemFree CoInitializeEx CoCreateInstance CoSetProxyBlanket

oleaut32

SysFreeString SysAllocStringByteLen SysStringByteLen

advapi32

CredEnumerateW CredFree RegQueryValueExW RegCloseKey RegEnumKeyW RegOpenKeyExW RegEnumValueW RevertToSelf ImpersonateSelf GetUserNameW

kernel32

ReadConsoleW GetUserDefaultLCID IsValidCodePage GetACP GetOEMCP GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle WriteConsoleW EnumSystemLocalesW Process32NextW AreFileApisANSI ReadFile HeapCreate HeapFree GetFullPathNameW WriteFile GetDiskFreeSpaceW OutputDebugStringA LockFile SetFilePointer GetFullPathNameA SetEndOfFile UnlockFileEx GetTempPathW CreateMutexW WaitForSingleObject CreateFileW GetFileAttributesW UnmapViewOfFile HeapValidate HeapSize MultiByteToWideChar Sleep GetTempPathA FormatMessageW GetDiskFreeSpaceA GetLastError GetFileAttributesA GetFileAttributesExW OutputDebugStringW FlushViewOfFile CreateFileA WaitForSingleObjectEx DeleteFileA DeleteFileW HeapReAlloc CloseHandle GetNativeSystemInfo RaiseException GetSystemInfo HeapAlloc HeapCompact HeapDestroy UnlockFile LocalFree LockFileEx GetFileSize GetCurrentProcessId GetProcessHeap SystemTimeToFileTime GetModuleHandleW WideCharToMultiByte GetSystemTimeAsFileTime GetSystemTime FormatMessageA CreateFileMappingW MapViewOfFile QueryPerformanceCounter GetTickCount FlushFileBuffers GetFileSizeEx SetEnvironmentVariableW GetEnvironmentVariableW GetSystemDirectoryW GetTickCount64 GetCurrentThread LoadLibraryW ExitProcess WriteProcessMemory VirtualProtect GetCurrentProcess VirtualAlloc TerminateProcess GetModuleHandleA OpenProcess CreateThread QueueUserAPC GetProcAddress GetThreadId FlushInstructionCache GetVolumeInformationW GetComputerNameW ExpandEnvironmentStringsW InitializeProcThreadAttributeList ResumeThread UpdateProcThreadAttribute LoadLibraryA lstrcatW DeleteProcThreadAttributeList lstrcpyW lstrcmpiW GetCommandLineW WaitForMultipleObjects GetTempFileNameW FreeLibrary SetDllDirectoryW LoadLibraryExW FindFirstFileW FindNextFileW FindClose CreateToolhelp32Snapshot RtlUnwind Process32FirstW QueryFullProcessImageNameW GetLocaleInfoEx GetTimeZoneInformation GetLogicalProcessorInformation GlobalMemoryStatusEx EnterCriticalSection LeaveCriticalSection InitializeCriticalSection GlobalLock GlobalUnlock IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW FlsFree FlsSetValue FlsGetValue FlsAlloc GetConsoleMode GetConsoleOutputCP GetFileType SetFilePointerEx GetStdHandle GetModuleFileNameW GetModuleHandleExW TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount SetLastError RtlPcToFileHeader RtlUnwindEx GetStringTypeW GetCPInfo CompareStringEx DecodePointer EncodePointer DeleteCriticalSection InitializeCriticalSectionEx LCMapStringEx GetFileInformationByHandleEx RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW IsDebuggerPresent GetStartupInfoW GetCurrentThreadId InitializeSListHead FindFirstFileExW GetFinalPathNameByHandleW

user32

GetSystemMetrics PostQuitMessage AddClipboardFormatListener RemoveClipboardFormatListener GetClipboardData TranslateMessage CloseClipboard DispatchMessageW OpenClipboard RegisterClassExW CreateWindowExW DestroyWindow GetMessageW DefWindowProcW

bcrypt

BCryptDestroyKey BCryptCloseAlgorithmProvider BCryptEncrypt BCryptGetProperty BCryptOpenAlgorithmProvider BCryptGenRandom BCryptFinishHash BCryptDestroyHash BCryptHashData BCryptSetProperty BCryptCreateHash BCryptGenerateSymmetricKey BCryptFinalizeKeyPair BCryptGenerateKeyPair BCryptExportKey BCryptDeriveKey BCryptDestroySecret BCryptSecretAgreement BCryptImportKeyPair

Name

.text

Size

1.5MB

Virtual Size

1.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

218KB

Virtual Size

220KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.data

Size

20KB

Virtual Size

48KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

53KB

Virtual Size

56KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.textb

Size

1024B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

5KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-30_1a7aa30a63fbbd2c358dbd2142992ad4_icedid_luca-stealer_njrat_stealc

shell32

ole32

oleaut32

advapi32

kernel32

user32

bcrypt

generic