2026-08-04_0fff5ff83daef654ae78c79b2e1f3cdf_icedid_luca-stealer_njrat_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-04_0fff5ff83daef654ae78c79b2e1f3cdf_icedid_luca-stealer_njrat_stealc
Size 1.2MB
Sample260804-j9rhaaga93
SHA256 e4f5339358ee8e07a566f2faf90ce2955e49a9631a07cd357702c2a24c197990
MD5 0fff5ff83daef654ae78c79b2e1f3cdf
SHA1 5032e0fcbedd7f33c0244dde035c1b5f3503015b
SHA512 d8fba19988e9b0a8eb0aabda4611e172c12bbb8ebe8e3d9b9b0139fb779b55082ad8e9869b10fa69c8cf68f3863f1ba84d7c05094733523459f9d188281ffd3c
SSDEEP 24576:kzERlTx6aG6wUsmb57GBiOl6a8JTth/RWZvR6wQQ92pN3x:kzEQr6wub5+Pl6bJTIZ5jdgpX
TLSH
T12F45AD4EEAB621E8D0BBC0358A529132F9713C894738A7DB53506A671F33BE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-04_0fff5ff83daef654ae78c79b2e1f3cdf_icedid_luca-stealer_njrat_stealc

File Explorer

2026-08-04_0fff5ff83daef654ae78c79b2e1f3cdf_icedid_luca-stealer_njrat_stealc

.exe 1.2MB

2026-08-04_0fff5ff83daef654ae78c79b2e1f3cdf_icedid_luca-stealer_njrat_stealc

IMPHASH ba720254f854db1ac7e20b3d1b11c0d6
SHA256 e4f5339358ee8e07a566f2faf90ce2955e49a9631a07cd357702c2a24c197990
MD5 0fff5ff83daef654ae78c79b2e1f3cdf
SHA1 5032e0fcbedd7f33c0244dde035c1b5f3503015b
SHA512 d8fba19988e9b0a8eb0aabda4611e172c12bbb8ebe8e3d9b9b0139fb779b55082ad8e9869b10fa69c8cf68f3863f1ba84d7c05094733523459f9d188281ffd3c
SSDEEP 24576:kzERlTx6aG6wUsmb57GBiOl6a8JTth/RWZvR6wQQ92pN3x:kzEQr6wub5+Pl6bJTIZ5jdgpX
TLSH
T12F45AD4EEAB621E8D0BBC0358A529132F9713C894738A7DB53506A671F33BE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

326612

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\dev\projs\ProcessSupervisor\output\ParkControl.pdb

kernel32

TerminateThread CreateThread DeleteCriticalSection ReadFile GetFileSize GetSystemDirectoryW CreateEventW SetEvent GetTickCount GetSystemPowerStatus WaitForMultipleObjects OpenEventW GetLastError MultiByteToWideChar GetSystemInfo IsBadWritePtr GetExitCodeProcess GetFileAttributesW CreateFileW GetSystemTimeAsFileTime WaitForSingleObject InitializeCriticalSection GetModuleHandleW ExitProcess GetProcessHeap HeapAlloc CreateDirectoryW DeleteFileW Sleep CreateProcessW WriteFile IsBadReadPtr GetTempPathW LeaveCriticalSection TryEnterCriticalSection GetSystemTime InitializeCriticalSectionEx SystemTimeToTzSpecificLocalTime WriteConsoleW GetConsoleOutputCP FlushFileBuffers GetStringTypeW SetStdHandle FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetCPInfo GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW FindClose SystemTimeToFileTime CreateMutexW GetCurrentProcessId SetUnhandledExceptionFilter GetCurrentDirectoryW ReleaseMutex GetCommandLineW CloseHandle HeapFree HeapReAlloc HeapSize HeapDestroy FindResourceExW FindResourceW LoadResource LockResource GetConsoleMode SetFilePointerEx LCMapStringW SizeofResource LoadLibraryW FlsFree FlsSetValue FlsGetValue FlsAlloc GetFileType GetStdHandle GetModuleHandleExW FreeLibraryAndExitThread ExitThread TlsFree TlsSetValue TlsGetValue TlsAlloc EncodePointer RtlPcToFileHeader RtlUnwindEx InitializeSListHead IsProcessorFeaturePresent UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext RaiseException OutputDebugStringW IsDebuggerPresent LocalFree WideCharToMultiByte GetProcAddress VerifyVersionInfoW VerSetConditionMask GetCurrentProcess CompareStringOrdinal LoadLibraryExW VirtualProtect OpenProcess CreateToolhelp32Snapshot Thread32First OpenThread Thread32Next GetActiveProcessorGroupCount TerminateProcess GetLogicalProcessorInformationEx GetActiveProcessorCount GetNumaHighestNodeNumber GetUserDefaultUILanguage FreeLibrary GetModuleFileNameW GetStartupInfoW SetLastError WinExec GetSystemWow64DirectoryW GlobalAlloc GlobalLock GlobalUnlock EnterCriticalSection LocalAlloc GetCurrentThreadId SuspendThread ResumeThread GetExitCodeThread GetVersionExW MulDiv LocalLock LocalUnlock InitializeCriticalSectionAndSpinCount GetProcessTimes ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive WaitForSingleObjectEx QueryPerformanceCounter QueryPerformanceFrequency WakeAllConditionVariable SleepConditionVariableSRW

user32

SendMessageW GetDlgItem SetWindowTextW ShowWindow SetDlgItemTextW EndDialog DialogBoxParamW CreateWindowExW EnableWindow GetLastInputInfo GetClientRect SetDlgItemInt IsDlgButtonChecked GetDlgItemInt GetWindowTextW LoadCursorW RegisterClassExW SetWindowPos GetDC ReleaseDC RedrawWindow GetMenu CheckDlgButton LoadStringW MessageBoxW IsWindowEnabled CloseClipboard IsWindowVisible DefWindowProcW DestroyMenu TrackPopupMenu GetCursorPos RegisterWindowMessageW KillTimer AppendMenuW DeleteMenu GetSubMenu DispatchMessageW TranslateMessage GetMessageW LoadIconW FindWindowW GetDlgItemTextW GetClassNameW GetWindowLongW GetSystemMetrics SetPropW BeginPaint FillRect FrameRect EndPaint GetMenuBarInfo OffsetRect GetMenuItemInfoW DrawTextW GetWindow SetWindowLongPtrW GetClassLongPtrW GetWindowLongPtrW GetSysColor SetClassLongPtrW IsWindow OpenClipboard EmptyClipboard SetClipboardData DestroyWindow SetRect GetActiveWindow GetLastActivePopup MessageBeep DrawIcon GetDialogBaseUnits DestroyIcon EnableMenuItem GetSystemMenu SetFocus MoveWindow GetParent WinHelpW GetAsyncKeyState CreateDialogIndirectParamW PeekMessageW IsDialogMessageW WaitMessage UpdateWindow SetForegroundWindow PostMessageW MapWindowPoints SystemParametersInfoW SetTimer ScreenToClient GetWindowRect LoadImageW EnumChildWindows SetMenuItemInfoW SetMenu LoadMenuW CheckMenuItem PostQuitMessage

gdi32

CreateBitmap GetTextExtentPoint32W SetBkColor SetTextColor CreateFontIndirectW SelectObject CreateSolidBrush DeleteObject GetObjectW CreateCompatibleDC CreateCompatibleBitmap BitBlt DeleteDC SetBkMode GetStockObject Ellipse GetTextMetricsW CreateDCW

advapi32

GetUserNameW ControlService RegDeleteTreeW RegEnumValueW RegQueryValueExW RegOpenKeyExW RegCloseKey RegSetValueExW RegCreateKeyExW RegDeleteValueW QueryServiceStatus RegDeleteKeyW RegQueryInfoKeyW RegEnumKeyExW OpenSCManagerW OpenServiceW CloseServiceHandle StartServiceW ChangeServiceConfigW QueryServiceConfigW NotifyBootConfigStatus

shell32

SHGetKnownFolderPath SHGetSpecialFolderPathW Shell_NotifyIconW SHChangeNotify ShellExecuteW

ole32

CoInitializeEx CoUninitialize CoTaskMemFree StringFromCLSID CoCreateInstance IIDFromString StringFromGUID2

oleaut32

SysFreeString SysAllocString VariantInit VariantClear

comctl32

InitCommonControlsEx ord413 ord410

pdh

PdhAddEnglishCounterW PdhCollectQueryData PdhCloseQuery PdhRemoveCounter PdhGetFormattedCounterValue PdhOpenQueryW

wininet

InternetReadFile InternetOpenUrlW InternetCloseHandle InternetOpenW InternetCanonicalizeUrlW

version

VerQueryValueW GetFileVersionInfoW GetFileVersionInfoSizeW

shlwapi

SHDeleteKeyW

dbghelp

MiniDumpWriteDump

uxtheme

OpenThemeData SetWindowTheme CloseThemeData DrawThemeText DrawThemeBackground

dwmapi

DwmSetWindowAttribute

wevtapi

EvtClose EvtNext EvtQuery EvtRender

powrprof

PowerRestoreIndividualDefaultPowerScheme

wintrust

WinVerifyTrust

rpcrt4

UuidFromStringW

Name

.text

Size

468KB

Virtual Size

467KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

115KB

Virtual Size

115KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

18KB

Virtual Size

32KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

20KB

Virtual Size

20KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

26KB

Virtual Size

26KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

568KB

Virtual Size

572KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-04_0fff5ff83daef654ae78c79b2e1f3cdf_icedid_luca-stealer_njrat_stealc

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

comctl32

pdh

wininet

version

shlwapi

dbghelp

uxtheme

dwmapi

wevtapi

powrprof

wintrust

rpcrt4

generic