2026-07-30_e95e7c9f9adddbccac3dd70ea518f3b1_icedid_luca-stealer_njrat_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-30_e95e7c9f9adddbccac3dd70ea518f3b1_icedid_luca-stealer_njrat_stealc
Size 4.2MB
Sample260730-vbf5face33
SHA256 747540e77f82d81b5b09dda5acb65fb5128f5bd3dcef47e4cce108137b9eb64b
MD5 e95e7c9f9adddbccac3dd70ea518f3b1
SHA1 3a2c221cf64c54b3e941fe6e4f2fa16cff43dd29
SHA512 7071eb40433706e6a268c389ce51fe033e68799d9afcbd1e1784d2a82871ecce0a1e520e8d78244f30bf02c90d274b8946e4d83efa3a2de2665ae015c24f1b42
SSDEEP 24576:pfevRX76+bINZCAS/Xq9uYqZL8K2IDLub1huulkFX5TbiN28w97kCUQhsy3xo8eT:pWv56+kNZsjmhCFerew7Biu2sVFh+3M
TLSH
T17626B54BEA7641E5C4FAC03A9553612FF871349AC33097CBA6819A175B23BF5E93E340
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-30_e95e7c9f9adddbccac3dd70ea518f3b1_icedid_luca-stealer_njrat_stealc

File Explorer

2026-07-30_e95e7c9f9adddbccac3dd70ea518f3b1_icedid_luca-stealer_njrat_stealc

.exe 4.2MB

2026-07-30_e95e7c9f9adddbccac3dd70ea518f3b1_icedid_luca-stealer_njrat_stealc

IMPHASH 43471428b3fe0f09d5adc6bbdb580245
SHA256 747540e77f82d81b5b09dda5acb65fb5128f5bd3dcef47e4cce108137b9eb64b
MD5 e95e7c9f9adddbccac3dd70ea518f3b1
SHA1 3a2c221cf64c54b3e941fe6e4f2fa16cff43dd29
SHA512 7071eb40433706e6a268c389ce51fe033e68799d9afcbd1e1784d2a82871ecce0a1e520e8d78244f30bf02c90d274b8946e4d83efa3a2de2665ae015c24f1b42
SSDEEP 24576:pfevRX76+bINZCAS/Xq9uYqZL8K2IDLub1huulkFX5TbiN28w97kCUQhsy3xo8eT:pWv56+kNZsjmhCFerew7Biu2sVFh+3M
TLSH
T17626B54BEA7641E5C4FAC03A9553612FF871349AC33097CBA6819A175B23BF5E93E340
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

3018216

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Build\Build_2021u_D20251014T165550\fa_rss\engine\Release\PCAppStore.pdb

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

urlmon

CreateUri URLDownloadToFileW

kernel32

ResetEvent CreateEventW OpenEventW WaitForMultipleObjects GetModuleFileNameW LocalFree CreateFileW GetOverlappedResult ReadDirectoryChangesW CreateDirectoryW GetFileAttributesW FreeLibrary LoadLibraryW ExpandEnvironmentStringsW GetTickCount64 VerSetConditionMask FindClose FindFirstFileExW FindNextFileW ReadFile RemoveDirectoryW OpenProcess VerifyVersionInfoW LCIDToLocaleName GetUserDefaultUILanguage GetLocaleInfoEx GetConsoleOutputCP K32EnumProcessModules K32GetModuleBaseNameW Sleep GetStartupInfoW GetTickCount CopyFileA TerminateProcess IsProcessCritical GlobalAlloc GlobalFree QueryFullProcessImageNameW CreateToolhelp32Snapshot Process32FirstW Process32NextW K32EnumProcesses K32GetModuleFileNameExW GetTempPathW GetExitCodeProcess GetProcessId OpenMutexW OpenFileMappingW MapViewOfFile GetStdHandle GetEnvironmentVariableA SetCurrentDirectoryW FindFirstFileW GetCurrentProcess GetSystemTime SystemTimeToFileTime FileTimeToLocalFileTime lstrcmpA FileTimeToSystemTime FlushFileBuffers QueryPerformanceCounter CreateFileMappingW FormatMessageA GetSystemTimeAsFileTime GetFileSize LockFileEx UnlockFile HeapCompact GetSystemInfo DeleteFileA LoadLibraryA CreateFileA FlushViewOfFile GetFileAttributesExW GetFileAttributesA GetDiskFreeSpaceA GetTempPathA HeapValidate UnmapViewOfFile CreateMutexW UnlockFileEx SetEndOfFile GetFullPathNameA SetFilePointer LockFile OutputDebugStringA GetDiskFreeSpaceW WriteFile GetFullPathNameW HeapCreate AreFileApisANSI SetEnvironmentVariableW HeapReAlloc LeaveCriticalSection TryEnterCriticalSection DeleteCriticalSection DecodePointer InitializeCriticalSectionEx GlobalUnlock GlobalLock LoadLibraryExW GetEnvironmentVariableW IsValidCodePage GetConsoleMode GetACP GetOEMCP GetCommandLineA RaiseException GetExitCodeThread QueryPerformanceFrequency ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive SleepConditionVariableSRW GetCurrentDirectoryW GetFileInformationByHandle SetFileInformationByHandle GetFileInformationByHandleEx GetStringTypeW InitOnceBeginInitialize InitOnceComplete WakeAllConditionVariable EncodePointer LCMapStringEx CompareStringEx GetCPInfo InitializeSListHead RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter GetCommandLineW SetUnhandledExceptionFilter IsProcessorFeaturePresent RtlPcToFileHeader RtlUnwindEx WideCharToMultiByte InterlockedPushEntrySList SetEvent MultiByteToWideChar FormatMessageW InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue GetEnvironmentStringsW TlsFree CreateThread ExitThread FreeLibraryAndExitThread ExitProcess GetDriveTypeW GetFileType PeekNamedPipe SystemTimeToTzSpecificLocalTime FindResourceW SizeofResource LockResource LoadResource GetProcAddress GetModuleHandleExW GetModuleHandleW GetModuleFileNameA FindResourceExW GetCurrentThreadId GetCurrentProcessId CreateSemaphoreExW CreateMutexExW FlsAlloc FlsGetValue FlsSetValue FlsFree VirtualProtect GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW OpenSemaphoreW WaitForSingleObjectEx WaitForSingleObject ReleaseMutex ReleaseSemaphore GetProcessHeap HeapSize InitializeCriticalSection WriteConsoleW FreeEnvironmentStringsW HeapAlloc HeapDestroy SetLastError GetLastError CloseHandle OutputDebugStringW DebugBreak IsDebuggerPresent DeleteFileW SetStdHandle GetTimeZoneInformation HeapFree ReadConsoleW RtlUnwind SetFilePointerEx GetFileSizeEx EnterCriticalSection EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW

user32

AppendMenuW InsertMenuW GetMenuItemCount DestroyMenu CreatePopupMenu GetClassInfoExW RegisterClassExW AttachThreadInput SendMessageTimeoutW RegisterWindowMessageW UpdateWindow GetWindowLongPtrW SetWindowLongW SetRectEmpty TrackPopupMenu CloseClipboard LoadIconW ChangeWindowMessageFilterEx TrackMouseEvent GetCapture SetCapture PtInRect SetClassLongPtrW FillRect AdjustWindowRectEx GetClientRect IsZoomed GetWindowPlacement UnregisterClassW MonitorFromWindow LoadCursorW EqualRect InvalidateRect EndPaint BeginPaint PostMessageW DestroyWindow RemoveMenu CreateWindowExW RegisterClassW SetClipboardData EmptyClipboard ReleaseCapture OpenIcon SetWindowPlacement IsIconic SetWindowLongPtrW OpenClipboard PostQuitMessage DefWindowProcW FindWindowExW UnhookWinEvent GetForegroundWindow keybd_event SetCursorPos GetWindowTextW SetWindowPos wsprintfW GetPhysicalCursorPos GetSystemMetrics GetAsyncKeyState CallNextHookEx UnhookWindowsHookEx SetWindowsHookExW EnumChildWindows WindowFromPoint ScreenToClient GetCursorPos IsChild PostThreadMessageW SendMessageW GetMessageW GetThreadDpiAwarenessContext SetThreadDpiAwarenessContext EnumDisplayMonitors FindWindowW IntersectRect GetMonitorInfoW MonitorFromRect DialogBoxParamW MonitorFromPoint SystemParametersInfoW GetWindow GetWindowThreadProcessId GetClassNameW EnumWindows GetDesktopWindow ReleaseDC GetDC SendInput EndDialog IsWindowVisible SetWinEventHook PeekMessageW DispatchMessageW TranslateMessage KillTimer SetTimer SetForegroundWindow SetFocus ShowWindow IsWindow GetWindowRect SetWindowTextW

gdi32

BitBlt CreateCompatibleBitmap CreateCompatibleDC DeleteDC CreateSolidBrush DeleteObject SelectObject

winspool.drv

EnumPrintersW

advapi32

EventRegister RegGetValueW EventUnregister EventWriteTransfer EventSetInformation RegCreateKeyExW RegNotifyChangeKeyValue RegSetKeyValueW RegDeleteValueW RegCreateKeyW GetUserNameW RegSetValueExW RegQueryValueExW RegOpenKeyExW RegCloseKey

shell32

Shell_NotifyIconW ShellExecuteExW SHGetFolderPathW SHEmptyRecycleBinW SHQueryRecycleBinW CommandLineToArgvW SHGetKnownFolderPath SHAppBarMessage ShellExecuteW

ole32

RevokeDragDrop CoTaskMemAlloc CoAllowSetForegroundWindow OleRun CoInitialize CoCreateInstance OleInitialize CoInitializeSecurity RegisterDragDrop CoInitializeEx CoTaskMemFree CoUninitialize CoCreateFreeThreadedMarshaler CoSetProxyBlanket

oleaut32

VariantInit SysFreeString SysAllocString VariantChangeType SysStringLen GetErrorInfo VariantClear SetErrorInfo

iphlpapi

IcmpCreateFile IcmpCloseHandle

winhttp

WinHttpSendRequest WinHttpOpenRequest WinHttpSetTimeouts WinHttpConnect WinHttpCloseHandle WinHttpOpen WinHttpQueryDataAvailable WinHttpReadData WinHttpQueryHeaders WinHttpReceiveResponse

crypt32

CryptMsgClose CryptQueryObject CertGetNameStringW CertFreeCertificateContext CertFindCertificateInStore CertCloseStore CertOpenStore CryptMsgGetParam CryptMsgUpdate CryptDecodeObjectEx CryptDecodeObject CryptMsgOpenToDecode

ws2_32

closesocket recv send shutdown socket WSAStartup WSACleanup WSAGetLastError WSAConnectByNameW

sspicli

QueryContextAttributesW DecryptMessage EncryptMessage FreeContextBuffer FreeCredentialsHandle ApplyControlToken DeleteSecurityContext InitializeSecurityContextW AcquireCredentialsHandleW

ext-ms-win-networking-wlanapi-l1-1-0

WlanOpenHandle WlanEnumInterfaces WlanCloseHandle WlanGetAvailableNetworkList WlanFreeMemory

wlanapi

WlanRegisterNotification WlanScan WlanAllocateMemory

shlwapi

PathCreateFromUrlW PathFindFileNameW AssocCreate PathRenameExtensionW SHCreateStreamOnFileEx UrlCreateFromPathW PathAddBackslashW

api-ms-win-shcore-scaling-l1-1-1

GetDpiForMonitor

dwmapi

DwmSetWindowAttribute DwmGetWindowAttribute

wtsapi32

WTSRegisterSessionNotification WTSUnRegisterSessionNotification

gdiplus

GdipCloneImage GdiplusStartup GdiplusShutdown GdipAlloc GdipFlush GdipDisposeImage GdipCreateBitmapFromHBITMAP GdipCreateFromHDC GdipDeleteGraphics GdipFree GdipCreateMatrix GdipDeleteMatrix GdipSetStringFormatAlign GdipCloneBrush GdipDeleteBrush GdipCreateSolidFill GdipSetSmoothingMode GdipSetWorldTransform GdipTranslateWorldTransform GdipScaleWorldTransform GdipFillEllipse GdipDrawImageI GdipCreateFontFamilyFromName GdipDeleteFontFamily GdipCreateFont GdipDeleteFont GdipDrawString GdipCreateStringFormat GdipDeleteStringFormat

msi

ord70 ord8 ord32 ord159 ord160 ord92 ord118 ord45

wininet

InternetOpenUrlW InternetReadFile HttpQueryInfoW InternetCheckConnectionW InternetCloseHandle InternetOpenW

setupapi

SetupDiEnumDeviceInfo SetupDiGetClassDevsW SetupDiGetDeviceRegistryPropertyW SetupDiDestroyDeviceInfoList

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory

api-ms-win-core-winrt-error-l1-1-1

RoOriginateLanguageException

Name

.text

Size

3.2MB

Virtual Size

3.2MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

546KB

Virtual Size

545KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

157KB

Virtual Size

227KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

207KB

Virtual Size

206KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

96KB

Virtual Size

96KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

13KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-30_e95e7c9f9adddbccac3dd70ea518f3b1_icedid_luca-stealer_njrat_stealc

version

urlmon

kernel32

user32

gdi32

winspool.drv

advapi32

shell32

ole32

oleaut32

iphlpapi

winhttp

crypt32

ws2_32

sspicli

ext-ms-win-networking-wlanapi-l1-1-0

wlanapi

shlwapi

api-ms-win-shcore-scaling-l1-1-1

dwmapi

wtsapi32

gdiplus

msi

wininet

setupapi

api-ms-win-core-winrt-l1-1-0

api-ms-win-core-winrt-error-l1-1-1

generic