2026-08-03_cc2f3093139bac0d220c71bf731eeb5c_icedid_luca-stealer_njrat_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-03_cc2f3093139bac0d220c71bf731eeb5c_icedid_luca-stealer_njrat_stealc
Size 2.6MB
Sample260803-cmlj7awfle
SHA256 7796c572485c460d249edb831f78de003bcdbba927794d266841545c4813eef6
MD5 cc2f3093139bac0d220c71bf731eeb5c
SHA1 c4a2f018e72176679bca3b65e32c5c1a72e7dfa4
SHA512 865546a4ddb8e5f8cf9927927877adef876b4e9329bf28e312ecc7a4d5a014fb733098a9565497ba77ded8e4ecfa66ae17c285499b8854c6855d8f03feb956d4
SSDEEP 49152:CBp8x+0eQtmvKAGL37EFmLGmB24VevdHyctj+vyDXMULrar/TYbDppPViO5F0ipE:CBKmmqTHyzvyDXMULrar/TYbDHPViG4a
TLSH
T1E6C59E0666A800FCC4BBC1798E4659ABE7B2B40507B9ABEF05A0C5654F73EE05E3D731
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects executables containing artifacts associated with disabling Widnows Defender 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_DisableWinDefender

Detects executables embedding registry key / value combination indicative of disabling Windows Defen 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender

Detects executables referencing many IR and analysis tools 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_References_SecTools

detects Windows exceutables potentially bypassing UAC using eventvwr.exe 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-03_cc2f3093139bac0d220c71bf731eeb5c_icedid_luca-stealer_njrat_stealc

File Explorer

2026-08-03_cc2f3093139bac0d220c71bf731eeb5c_icedid_luca-stealer_njrat_stealc

.exe 2.6MB

2026-08-03_cc2f3093139bac0d220c71bf731eeb5c_icedid_luca-stealer_njrat_stealc

IMPHASH c001ef9552965be681c744786dc20622
SHA256 7796c572485c460d249edb831f78de003bcdbba927794d266841545c4813eef6
MD5 cc2f3093139bac0d220c71bf731eeb5c
SHA1 c4a2f018e72176679bca3b65e32c5c1a72e7dfa4
SHA512 865546a4ddb8e5f8cf9927927877adef876b4e9329bf28e312ecc7a4d5a014fb733098a9565497ba77ded8e4ecfa66ae17c285499b8854c6855d8f03feb956d4
SSDEEP 49152:CBp8x+0eQtmvKAGL37EFmLGmB24VevdHyctj+vyDXMULrar/TYbDppPViO5F0ipE:CBKmmqTHyzvyDXMULrar/TYbDHPViG4a
TLSH
T1E6C59E0666A800FCC4BBC1798E4659ABE7B2B40507B9ABEF05A0C5654F73EE05E3D731
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects executables containing artifacts associated with disabling Widnows Defender
Detects executables embedding registry key / value combination indicative of disabling Windows Defen
Detects executables referencing many IR and analysis tools
detects Windows exceutables potentially bypassing UAC using eventvwr.exe
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1666608

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

ws2_32

ntohl WSAGetLastError bind accept __WSAFDIsSet listen WSASocketW inet_pton inet_addr ntohs getsockopt htonl inet_ntop htons sendto getnameinfo WSAIoctl shutdown send recv setsockopt WSACleanup closesocket select getaddrinfo WSAStartup socket connect freeaddrinfo ioctlsocket WSADuplicateSocketW

user32

FindWindowA OpenInputDesktop FindWindowW SetProcessDPIAware OpenDesktopW SwapMouseButton ShowCursor OpenWindowStationW SetProcessWindowStation GetWindowTextLengthW GetMessageW DefWindowProcW GetSystemMenu CallWindowProcW PostMessageW MapVirtualKeyW FindWindowExW GetWindowRect SendMessageTimeoutW DestroyWindow GetDC IsWindowVisible SetWindowPos keybd_event SetActiveWindow SetWindowLongPtrW FillRect CreateWindowExW ScreenToClient SetWindowTextW RealGetWindowClassW RegisterClassExW WindowFromPoint GetWindowPlacement SetKeyboardState GetThreadDesktop GetKeyboardState wsprintfA IsWindow ChangeDisplaySettingsW OpenClipboard DispatchMessageW CloseClipboard GetKeyboardLayout AttachThreadInput CreateDesktopW ToUnicodeEx GetTopWindow MoveWindow EnumWindows SetFocus BringWindowToTop TranslateMessage GetClipboardData EnumDesktopWindows GetClassNameW mouse_event DrawMenuBar ToUnicode wsprintfW PrintWindow RemoveMenu GetClientRect GetDlgItem GetDesktopWindow EnumDisplaySettingsW MenuItemFromPoint SystemParametersInfoW GetProcessWindowStation GetParent PtInRect UpdateWindow SetForegroundWindow GetAncestor IsIconic SetCursorPos ChildWindowFromPoint ReleaseDC CreateWindowStationW BeginPaint EndPaint SendInput GetWindowTextW GetWindowThreadProcessId GetWindow GetLastInputInfo CloseWindowStation MessageBoxW SendMessageW GetSystemMetrics MessageBeep GetClassNameA GetShellWindow SetThreadDesktop ShowWindow CloseDesktop ExitWindowsEx GetWindowTextA LockWorkStation

gdi32

BitBlt CreateCompatibleBitmap SelectObject CreateDIBSection CreateCompatibleDC PatBlt StretchBlt CreateFontW GetStockObject GetDeviceCaps DeleteDC SetStretchBltMode DeleteObject

advapi32

RegEnumValueW RegQueryValueExW DuplicateTokenEx GetUserNameW OpenServiceW RegDeleteValueW ChangeServiceConfigW ConvertSidToStringSidW StartServiceCtrlDispatcherW SetSecurityInfo CreateProcessAsUserW RegOpenKeyExW InitializeSecurityDescriptor CheckTokenMembership FreeSid LsaFreeMemory QueryServiceStatus CredEnumerateW GetSidSubAuthorityCount GetSidSubAuthority CredFree CloseEventLog SetNamedSecurityInfoW ControlService CreateProcessWithTokenW RegEnumKeyExW OpenProcessToken RegSetValueExW StartServiceW OpenEventLogW EnumServicesStatusExW InitializeAcl QueryServiceConfigW LsaRetrievePrivateData ConvertStringSecurityDescriptorToSecurityDescriptorW LsaOpenPolicy LsaClose OpenThreadToken GetTokenInformation LookupPrivilegeValueW RegisterServiceCtrlHandlerExW SetSecurityDescriptorDacl AdjustTokenPrivileges RevertToSelf CreateServiceW RegCloseKey RegQueryInfoKeyW EqualSid CloseServiceHandle OpenSCManagerW RegDeleteKeyW AllocateAndInitializeSid SetServiceStatus ChangeServiceConfig2W SetEntriesInAclW RegFlushKey RegCreateKeyExW DeleteService ImpersonateLoggedOnUser RegDeleteTreeW

shell32

ord680 ShellExecuteW ShellExecuteExW SHGetFolderPathW SHAppBarMessage SHCreateDirectoryExW SHEmptyRecycleBinW

ole32

CoTaskMemFree StringFromGUID2 GetHGlobalFromStream CreateStreamOnHGlobal CoInitializeEx CoSetProxyBlanket CoCreateInstance CoUninitialize CoGetObject

oleaut32

VariantInit SysFreeString SysAllocString VariantClear

gdiplus

GdipSaveImageToStream GdipGetImageEncodersSize GdipFree GdipDisposeImage GdipCreateBitmapFromHBITMAP GdipAlloc GdipCloneImage GdiplusStartup GdipGetImageEncoders GdipImageRotateFlip GdipCreateBitmapFromScan0

wininet

FindCloseUrlCache InternetOpenW InternetCloseHandle InternetSetOptionW InternetReadFile FindFirstUrlCacheEntryW FindNextUrlCacheEntryW InternetOpenUrlW

iphlpapi

GetIfTable GetExtendedUdpTable GetAdaptersInfo IcmpParseReplies GetExtendedTcpTable

crypt32

CertFreeCertificateContext CryptHashCertificate CertDeleteCertificateFromStore CryptDecodeObjectEx CertAddCertificateContextToStore CertEnumCertificatesInStore CryptQueryObject CertDuplicateCertificateContext CertCloseStore CertOpenStore CertCompareCertificateName CryptUnprotectData CertFindExtension

bcrypt

BCryptFinishHash BCryptCloseAlgorithmProvider BCryptDestroyHash BCryptOpenAlgorithmProvider BCryptGenRandom BCryptHashData BCryptCreateHash BCryptGenerateSymmetricKey BCryptSecretAgreement BCryptSetProperty BCryptImportKeyPair BCryptDestroySecret BCryptDeriveKey BCryptExportKey BCryptGenerateKeyPair BCryptDecrypt BCryptFinalizeKeyPair BCryptDestroyKey BCryptEncrypt

ntdll

RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext RtlAddFunctionTable RtlPcToFileHeader RtlUnwindEx

winmm

waveInStart waveOutUnprepareHeader waveOutClose waveOutReset waveInOpen waveOutOpen waveInAddBuffer mciSendStringW waveOutPrepareHeader waveInClose waveInPrepareHeader waveInUnprepareHeader waveInReset waveOutWrite waveInStop

userenv

CreateEnvironmentBlock DestroyEnvironmentBlock

mpr

WNetEnumResourceW WNetCloseEnum WNetOpenEnumW

kernel32

SetFilePointer Thread32Next DeleteTimerQueueEx GetSystemTimes CreateNamedPipeW DeleteFiber DeviceIoControl ExpandEnvironmentStringsW GetFullPathNameW HeapCreate CreateTimerQueueTimer GetFileSizeEx CancelIo CreateDirectoryW DeleteCriticalSection K32GetModuleFileNameExW GetExitCodeProcess FlushFileBuffers SetUnhandledExceptionFilter CheckRemoteDebuggerPresent LoadLibraryExW VirtualQuery GetTickCount OpenMutexW MapViewOfFile CreateFileMappingW GetSystemTime GetTempFileNameW QueryFullProcessImageNameW lstrcpyW WideCharToMultiByte FlushInstructionCache CopyFileW FreeLibrary GetModuleHandleW GetTimeZoneInformation GetFileAttributesExW K32GetProcessMemoryInfo GlobalSize FileTimeToSystemTime TerminateThread QueryPerformanceFrequency ResetEvent GetOverlappedResult HeapDestroy SubmitThreadpoolWork Beep GlobalLock SetEndOfFile SetFilePointerEx GetFileSize GetComputerNameW CreateSymbolicLinkW SleepEx GetSystemTimeAsFileTime DeleteTimerQueueTimer lstrcmpiW QueryPerformanceCounter GlobalUnlock ConvertThreadToFiber MulDiv MoveFileW CreateFiber GetProcessTimes GetDriveTypeW GetFileTime OpenThread ConnectNamedPipe GetComputerNameA CreateTimerQueue CreateThreadpoolWork AreFileApisANSI GetDiskFreeSpaceW OutputDebugStringA LockFile GetFullPathNameA Thread32First GetVersionExW HeapValidate HeapSize GetTempPathA FormatMessageW GetDiskFreeSpaceA GetFileAttributesA OutputDebugStringW FlushViewOfFile CreateFileA WaitForSingleObjectEx GetVersionExA DeleteFileA HeapReAlloc RaiseException HeapCompact UnlockFile WriteConsoleW CreateFileMappingA LockFileEx FormatMessageA LoadLibraryExA InitOnceComplete InitOnceBeginInitialize ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive ReleaseSRWLockShared CreateProcessW GlobalMemoryStatusEx SystemTimeToFileTime GetProcessHeap GetCurrentProcessId SetEnvironmentVariableA ExitProcess WTSGetActiveConsoleSessionId ReadConsoleW GetConsoleMode GetConsoleOutputCP GetStringTypeW SetStdHandle FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetCPInfo GetOEMCP GetThreadId MoveFileExW LocalFree GetProcAddress GetWindowsDirectoryW GetACP IsValidCodePage FindFirstFileExW LCMapStringW CompareStringW GetLocalTime HeapAlloc DeleteProcThreadAttributeList CreateThread LoadLibraryW GetSystemInfo CloseHandle Process32FirstW DeleteFileW GetPrivateProfileSectionNamesW IsProcessInJob SwitchToFiber GetLogicalDriveStringsW UnlockFileEx GetPrivateProfileStringW AcquireSRWLockShared SleepConditionVariableSRW InitializeCriticalSectionEx TlsSetValue FlsFree FlsSetValue FlsGetValue FlsAlloc GetFileType GetModuleHandleExW GetStdHandle TlsFree TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount EncodePointer GetStartupInfoW IsDebuggerPresent InitializeSListHead IsProcessorFeaturePresent UnhandledExceptionFilter WakeAllConditionVariable lstrcatW LoadLibraryA GetCurrentThread GetDiskFreeSpaceExW SetEvent Process32NextW UpdateProcThreadAttribute GetLastError GetTickCount64 GetFileInformationByHandle Sleep ProcessIdToSessionId MultiByteToWideChar CreateEventW SetFileAttributesW QueueUserWorkItem GetSystemDefaultLangID GetModuleHandleA DuplicateHandle UnmapViewOfFile GetSystemDirectoryW ReleaseMutex GetCurrentThreadId ReadFile FindFirstFileW InitOnceExecuteOnce SetHandleInformation VirtualProtect HeapFree SetLastError EnterCriticalSection VirtualFree GetCommandLineW FindNextFileW GetCurrentProcess lstrlenW WriteFile GetShortPathNameW VirtualAlloc TerminateProcess RemoveDirectoryW SetFileTime GetModuleFileNameW WaitForMultipleObjects InitializeProcThreadAttributeList SetEnvironmentVariableW GetProcessId LeaveCriticalSection CreatePipe InitializeCriticalSection SetErrorMode GetEnvironmentVariableW GetSystemPowerStatus GetTempPathW CreateMutexW TrySubmitThreadpoolCallback GetEnvironmentVariableA FindClose WaitForSingleObject CreateFileW GetFileAttributesW

secur32

DecryptMessage FreeCredentialsHandle QueryContextAttributesW DeleteSecurityContext InitializeSecurityContextW AcquireCredentialsHandleA FreeContextBuffer EncryptMessage

winhttp

WinHttpOpenRequest WinHttpOpen WinHttpCloseHandle WinHttpSendRequest WinHttpReadData WinHttpAddRequestHeaders WinHttpReceiveResponse WinHttpSetOption WinHttpConnect WinHttpQueryDataAvailable

avicap32

capGetDriverDescriptionW

setupapi

SetupDiSetClassInstallParamsW SetupDiGetClassDevsW SetupDiEnumDeviceInfo SetupDiCallClassInstaller SetupDiDestroyDeviceInfoList

Name

.text

Size

1.8MB

Virtual Size

1.8MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.ndata

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

721KB

Virtual Size

721KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

57KB

Virtual Size

1019KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

62KB

Virtual Size

61KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.cfg

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.ndata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

10KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-03_cc2f3093139bac0d220c71bf731eeb5c_icedid_luca-stealer_njrat_stealc

ws2_32

user32

gdi32

advapi32

shell32

ole32

oleaut32

gdiplus

wininet

iphlpapi

crypt32

bcrypt

ntdll

winmm

userenv

mpr

kernel32

secur32

winhttp

avicap32

setupapi

generic