2026-08-02_1b622dab0a7d11cc7bd3f34461d820eb_icedid_luca-stealer_njrat_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-02_1b622dab0a7d11cc7bd3f34461d820eb_icedid_luca-stealer_njrat_stealc
Size 76.1MB
Sample260802-d3grlstcph
SHA256 1391db96602bff697c1d4341428106252d408dbfb1b50e39549842a044e970cb
MD5 1b622dab0a7d11cc7bd3f34461d820eb
SHA1 1e8296bffe58234cde379b453a1f4be42f6047c8
SHA512 475e7ba1684d243678871e8023ae04dcbce91f2a8660d0ec10dbfa7f24ec328f4a2144e62349bf42d977e03bff0d7c6a1783d0c7871421c467731b69f578f041
SSDEEP 1572864:GQFYHN+7TJm2m85EZ+60axL2FyaYYqAd4hNaEQwoCsILzlgYl:GoWSmf8q+WxLQkYqAKhNPQwoSlgYl
TLSH
T13C08339547B19CF0E6F77A75C49A040BD7EAFC2F4BB8B09E26984D641D3A2E08635307
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-02_1b622dab0a7d11cc7bd3f34461d820eb_icedid_luca-stealer_njrat_stealc

File Explorer

2026-08-02_1b622dab0a7d11cc7bd3f34461d820eb_icedid_luca-stealer_njrat_stealc

.exe 76.1MB

2026-08-02_1b622dab0a7d11cc7bd3f34461d820eb_icedid_luca-stealer_njrat_stealc

IMPHASH 0ce3634580053113cad6738ddf1c9564
SHA256 1391db96602bff697c1d4341428106252d408dbfb1b50e39549842a044e970cb
MD5 1b622dab0a7d11cc7bd3f34461d820eb
SHA1 1e8296bffe58234cde379b453a1f4be42f6047c8
SHA512 475e7ba1684d243678871e8023ae04dcbce91f2a8660d0ec10dbfa7f24ec328f4a2144e62349bf42d977e03bff0d7c6a1783d0c7871421c467731b69f578f041
SSDEEP 1572864:GQFYHN+7TJm2m85EZ+60axL2FyaYYqAd4hNaEQwoCsILzlgYl:GoWSmf8q+WxLQkYqAKhNPQwoSlgYl
TLSH
T13C08339547B19CF0E6F77A75C49A040BD7EAFC2F4BB8B09E26984D641D3A2E08635307
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

172368

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\Projects\WinRAR\rar\build\sfxcon64\Release\sfxcon.pdb

kernel32

GetStdHandle GetFileType WriteFile GetConsoleMode SetConsoleMode ReadConsoleW WriteConsoleW GetLastError SetLastError Sleep LocalFree FormatMessageW SetConsoleCtrlHandler CreateFileW DeleteFileW RemoveDirectoryW SetFileTime CloseHandle DeviceIoControl CreateHardLinkW GetLongPathNameW GetShortPathNameW MoveFileW FlushFileBuffers ReadFile SetEndOfFile SetFilePointer CreateDirectoryW GetDriveTypeW GetFileAttributesW SetFileAttributesW GetCurrentProcessId FindClose FindFirstFileW FindNextFileW GetVersionExW GetCurrentDirectoryW GetModuleFileNameW FoldStringW SetErrorMode FreeLibrary GetProcAddress GetCurrentProcess ExitProcess GetSystemDirectoryW GetModuleHandleW LoadLibraryW SetThreadExecutionState CompareStringW AllocConsole FreeConsole AttachConsole InitializeCriticalSection EnterCriticalSection LeaveCriticalSection DeleteCriticalSection SetEvent ResetEvent ReleaseSemaphore WaitForSingleObject CreateEventW CreateSemaphoreW CreateThread SetThreadPriority GetProcessAffinityMask FileTimeToLocalFileTime GetSystemTime SystemTimeToTzSpecificLocalTime FileTimeToSystemTime SystemTimeToFileTime MultiByteToWideChar WideCharToMultiByte GetCPInfo IsDBCSLeadByte HeapSize SetFilePointerEx GetStringTypeW GetProcessHeap SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW RaiseException GetSystemInfo VirtualProtect VirtualQuery LoadLibraryExA RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW IsDebuggerPresent GetStartupInfoW QueryPerformanceCounter GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead RtlPcToFileHeader RtlUnwindEx EncodePointer InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW GetModuleHandleExW QueryPerformanceFrequency GetCommandLineA GetCommandLineW HeapFree HeapAlloc FlsAlloc FlsGetValue FlsSetValue FlsFree InitializeCriticalSectionEx LCMapStringW GetConsoleOutputCP SetStdHandle HeapReAlloc FindFirstFileExW IsValidCodePage GetACP GetOEMCP

ole32

CoCreateInstance CoSetProxyBlanket

oleaut32

VariantClear SysFreeString SysAllocString

Name

.text

Size

271KB

Virtual Size

270KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

82KB

Virtual Size

82KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

10KB

Virtual Size

59KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

12KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.didat

Size

512B

Virtual Size

104B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

34KB

Virtual Size

33KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-02_1b622dab0a7d11cc7bd3f34461d820eb_icedid_luca-stealer_njrat_stealc

kernel32

ole32

oleaut32

generic