2026-08-04_fc9e6f64622a65434e9bf0d048a619ee_icedid_luca-stealer_njrat

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-04_fc9e6f64622a65434e9bf0d048a619ee_icedid_luca-stealer_njrat
Size 3.0MB
Sample260804-fd8vxadb73
SHA256 c543cb88c866e85cc25193de4a5f27889c4b1deabeeaf2cf1f96baa905b61618
MD5 fc9e6f64622a65434e9bf0d048a619ee
SHA1 fc0a09c5a0cb7f4493baabd32c1810fdd6c0fa4d
SHA512 44058027f778b863fb4e04a25f5feed555e2aae12c843b4a90eb7652ada5fa5cfd9d3a75ca6394023dd919bcb15c17d64b8364245056ca55062162403d9b5927
SSDEEP 49152:QMoiwnPpNniz7PACNTxjx1C9Gx827lOrZY8qtkUTWqRinaLqvyApLzs9/4JmOpPL:kBiPtxj0qrma8S2UIyC3acPL
TLSH
T197E52365F3D404F6E17791368A61CA5AD6B2B85B0B30E6CB03AC42B12F237E15D3E725
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-04_fc9e6f64622a65434e9bf0d048a619ee_icedid_luca-stealer_njrat

File Explorer

2026-08-04_fc9e6f64622a65434e9bf0d048a619ee_icedid_luca-stealer_njrat

.exe 3.0MB

2026-08-04_fc9e6f64622a65434e9bf0d048a619ee_icedid_luca-stealer_njrat

IMPHASH fe3f478300c9bd0b0235a1acd1696f97
SHA256 c543cb88c866e85cc25193de4a5f27889c4b1deabeeaf2cf1f96baa905b61618
MD5 fc9e6f64622a65434e9bf0d048a619ee
SHA1 fc0a09c5a0cb7f4493baabd32c1810fdd6c0fa4d
SHA512 44058027f778b863fb4e04a25f5feed555e2aae12c843b4a90eb7652ada5fa5cfd9d3a75ca6394023dd919bcb15c17d64b8364245056ca55062162403d9b5927
SSDEEP 49152:QMoiwnPpNniz7PACNTxjx1C9Gx827lOrZY8qtkUTWqRinaLqvyApLzs9/4JmOpPL:kBiPtxj0qrma8S2UIyC3acPL
TLSH
T197E52365F3D404F6E17791368A61CA5AD6B2B85B0B30E6CB03AC42B12F237E15D3E725
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

11424

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

GetFileSizeEx ReadFile GetTempPathW CloseHandle SetErrorMode HeapCreate HeapDestroy HeapAlloc HeapFree GetProcessHeap SetEvent ResetEvent CreateEventW Sleep GetCurrentProcessId SwitchToThread GetCurrentThreadId GlobalMemoryStatusEx GetSystemInfo CreateFileW GetTickCount GetWindowsDirectoryW VirtualAlloc VirtualProtect VirtualFree GetModuleFileNameA GetModuleFileNameW GetModuleHandleA GetProcAddress LoadLibraryA GetComputerNameW SystemTimeToFileTime WriteConsoleW ReadConsoleW GetConsoleMode GetConsoleOutputCP FlushFileBuffers HeapReAlloc HeapSize CreateFileA SetEnvironmentVariableA GetEnvironmentVariableW GetLocalTime GetCommandLineA SetFilePointerEx SetConsoleCtrlHandler LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW InitializeCriticalSectionEx IsThreadAFiber FlsFree FlsSetValue FlsGetValue FlsAlloc EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW GetModuleHandleW RtlUnwindEx InterlockedPushEntrySList InterlockedFlushSList GetLastError SetLastError EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW EncodePointer RaiseException RtlPcToFileHeader GetStdHandle WriteFile ExitProcess GetModuleHandleExW GetCurrentThread GetFileType OutputDebugStringW FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineW MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle GetStringTypeW RtlUnwind

user32

SystemParametersInfoW GetDesktopWindow wsprintfW GetSystemMetrics GetForegroundWindow

advapi32

RegOpenKeyExW RegCloseKey GetUserNameW RegQueryValueExW

shell32

SHGetFolderPathW

ole32

CoCreateGuid CoInitializeEx CoUninitialize

wininet

InternetOpenW InternetCloseHandle

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

bcrypt

BCryptCloseAlgorithmProvider BCryptOpenAlgorithmProvider

Name

.text

Size

305KB

Virtual Size

305KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

62KB

Virtual Size

62KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

15KB

Virtual Size

14KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-04_fc9e6f64622a65434e9bf0d048a619ee_icedid_luca-stealer_njrat

kernel32

user32

advapi32

shell32

ole32

wininet

version

bcrypt

generic