2026-07-31_bb5ceee8bda2be2ddf6ff6a12ded9fd7_icedid_luca-stealer_njrat_stealc

General

Target
2026-07-31_bb5ceee8bda2be2ddf6ff6a12ded9fd7_icedid_luca-stealer_njrat_stealc
Size 18.0MB
Sample260731-vf2xpsdf39
SHA256 8994bbf025b7db11446dc0d01bdb956d248c88e3d9ee15d0652e3c0eb85eb399
MD5 bb5ceee8bda2be2ddf6ff6a12ded9fd7
SHA1 ce40ca66363e303d37fb30b0fff52e16b0c07032
SHA512 fe725a451fd48b1c5f84debdba866453aa35391c1309fab399cd34189bb2ec8211a3a7f57df472eb24ed2a170dcc9357bc245e2e4af3b9d3cc923c690bffaff5
SSDEEP 393216:LhH9r2VH5+fETVDztzYJwRCMqslt2Y1ZDL:LhHsVZrJ2uZqs4Y1JL
TLSH
T1C5173335AF1A44E0E7BA43364EFA2D09D77375A357587E2F051890C23EA37824A17F26
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-07-31_bb5ceee8bda2be2ddf6ff6a12ded9fd7_icedid_luca-stealer_njrat_stealc

File Explorer

2026-07-31_bb5ceee8bda2be2ddf6ff6a12ded9fd7_icedid_luca-stealer_njrat_stealc

.exe 18.0MB

2026-07-31_bb5ceee8bda2be2ddf6ff6a12ded9fd7_icedid_luca-stealer_njrat_stealc

IMPHASH 90725a9a4b1782eb2337ce7e8d49c0dd
SHA256 8994bbf025b7db11446dc0d01bdb956d248c88e3d9ee15d0652e3c0eb85eb399
MD5 bb5ceee8bda2be2ddf6ff6a12ded9fd7
SHA1 ce40ca66363e303d37fb30b0fff52e16b0c07032
SHA512 fe725a451fd48b1c5f84debdba866453aa35391c1309fab399cd34189bb2ec8211a3a7f57df472eb24ed2a170dcc9357bc245e2e4af3b9d3cc923c690bffaff5
SSDEEP 393216:LhH9r2VH5+fETVDztzYJwRCMqslt2Y1ZDL:LhHsVZrJ2uZqs4Y1JL
TLSH
T1C5173335AF1A44E0E7BA43364EFA2D09D77375A357587E2F051890C23EA37824A17F26
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

ee:f9:cd:e9:d3:cd:fa:44:44:d6:61:7e:80:88:2e:d2:47:0b:81:06

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=LENOVO,O=LENOVO,L=Morrisville,ST=North Carolina,C=US

Chains

Aug 12, 2015

CN=LENOVO,O=LENOVO,L=Morrisville,ST=North Carolina,C=US

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Minor OS version

0

Major OS version

6

Entry point

17632

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

GetModuleFileNameA VirtualProtect EnterCriticalSection GetCurrentProcess WriteFile VirtualAlloc LeaveCriticalSection InitializeCriticalSection SetFilePointer GetCurrentThreadId GetModuleHandleA GetTempPathA CopyFileA CreateFileA LoadLibraryA CloseHandle GetProcAddress GetCurrentProcessId GetTickCount WriteConsoleW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW GetModuleHandleW QueryPerformanceCounter GetSystemTimeAsFileTime InitializeSListHead RtlUnwindEx RtlPcToFileHeader RaiseException GetLastError SetLastError EncodePointer DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW ExitProcess GetModuleHandleExW GetModuleFileNameW GetStdHandle HeapFree HeapAlloc GetFileType FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW FlsAlloc FlsGetValue FlsSetValue FlsFree InitializeCriticalSectionEx LCMapStringW GetProcessHeap SetStdHandle GetStringTypeW SetFilePointerEx HeapSize HeapReAlloc FlushFileBuffers GetConsoleOutputCP GetConsoleMode CreateFileW

Name

.text

Size

100KB

Virtual Size

99KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

45KB

Virtual Size

45KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

499KB

Virtual Size

498KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-31_bb5ceee8bda2be2ddf6ff6a12ded9fd7_icedid_luca-stealer_njrat_stealc

PE Signature issue

kernel32

generic