2026-08-03_148e84a3dc4e26f74d21808b56671cf9_icedid_luca-stealer_njrat_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-03_148e84a3dc4e26f74d21808b56671cf9_icedid_luca-stealer_njrat_stealc
Size 2.2MB
Sample260804-p8fbhsfj9x
SHA256 1a8b8bf85b4974ab7fefad7dce3bcd1a89bcba1f6d60675008e3a592ccb7c77e
MD5 148e84a3dc4e26f74d21808b56671cf9
SHA1 173b83d8b43a039d0e47e23ec6ca220d37ba162d
SHA512 183932f21985b0ddfdaf0341e0548921df456654a251b9aff0d6961ebe65e4d5125b4197031e17eadb54e209bde5e6de66b364b8f77bcd3cdf637e72af3fb604
SSDEEP 49152:/ORd2+D0XDGGlsiOtUB4ulwCTDmg27RnWGj:9XDGCVTD527BWG
TLSH
T1C5B5C05562D402A8F4B3D279C9768A65EE72BC0943EC96C713EC76E51F137E04A3E322
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-03_148e84a3dc4e26f74d21808b56671cf9_icedid_luca-stealer_njrat_stealc

File Explorer

2026-08-03_148e84a3dc4e26f74d21808b56671cf9_icedid_luca-stealer_njrat_stealc

.exe 2.2MB

2026-08-03_148e84a3dc4e26f74d21808b56671cf9_icedid_luca-stealer_njrat_stealc

IMPHASH 1719eb5c3e6e2fffb76d25c51dcf62a3
SHA256 1a8b8bf85b4974ab7fefad7dce3bcd1a89bcba1f6d60675008e3a592ccb7c77e
MD5 148e84a3dc4e26f74d21808b56671cf9
SHA1 173b83d8b43a039d0e47e23ec6ca220d37ba162d
SHA512 183932f21985b0ddfdaf0341e0548921df456654a251b9aff0d6961ebe65e4d5125b4197031e17eadb54e209bde5e6de66b364b8f77bcd3cdf637e72af3fb604
SSDEEP 49152:/ORd2+D0XDGGlsiOtUB4ulwCTDmg27RnWGj:9XDGCVTD527BWG
TLSH
T1C5B5C05562D402A8F4B3D279C9768A65EE72BC0943EC96C713EC76E51F137E04A3E322
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

524496

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\installer\Build\x64\UnicodeRelease\SamanLauncher\SamanLauncher.pdb

kernel32

MoveFileW MoveFileExW MultiByteToWideChar VerSetConditionMask GetStdHandle GetEnvironmentVariableW GetCurrentDirectoryW CreateFileW DeleteFileW FindClose FindFirstFileW FindNextFileW GetDiskFreeSpaceExW GetFileAttributesW GetFinalPathNameByHandleW GetLogicalDriveStringsW QueryDosDeviceW RemoveDirectoryW SetFileAttributesW WriteFile DecodePointer InitializeCriticalSectionEx DeleteCriticalSection CreateMutexW GetCurrentProcessId TerminateProcess GetCurrentThreadId GetSystemDirectoryW GetVersionExW GetModuleFileNameW LoadResource LockResource FormatMessageW FindResourceW lstrlenW VerifyVersionInfoW WideCharToMultiByte AllocConsole CreateToolhelp32Snapshot Process32FirstW Process32NextW K32EnumProcessModules K32GetModuleFileNameExW K32GetProcessImageFileNameW WaitForMultipleObjects SetDllDirectoryW GetUserDefaultUILanguage HeapAlloc GetProcessHeap CreateDirectoryW LocalFileTimeToFileTime ReadFile SetFilePointer SetFileTime SystemTimeToFileTime LoadLibraryExA VirtualQuery GetSystemInfo WriteConsoleW SetEndOfFile HeapSize SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW LocalFree LoadLibraryExW GetProcAddress GetModuleHandleW OpenProcess CreateProcessW GetExitCodeProcess GetCurrentProcess CreateEventW WaitForSingleObject SetEvent GetLastError SizeofResource CloseHandle GetCommandLineA GetOEMCP GetACP IsValidCodePage FindFirstFileExW SetConsoleCtrlHandler HeapReAlloc ReadConsoleW SetFilePointerEx GetFileSizeEx GetConsoleMode GetConsoleOutputCP RtlUnwind FlushFileBuffers EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW VirtualProtect IsThreadAFiber FlsFree FlsSetValue FlsGetValue FlsAlloc GetTempPathW HeapFree GetCurrentThread FormatMessageA EnterCriticalSection LeaveCriticalSection GetLocaleInfoEx EncodePointer LCMapStringEx GetStringTypeW CompareStringEx GetCPInfo ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW QueryPerformanceCounter GetSystemTimeAsFileTime InitializeSListHead OutputDebugStringW RaiseException RtlPcToFileHeader RtlUnwindEx InterlockedPushEntrySList InterlockedFlushSList SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary SetStdHandle GetFileType GetTimeZoneInformation ExitProcess GetModuleHandleExW

user32

MessageBoxW GetSystemMetrics MessageBoxIndirectW EnumWindows UnregisterClassW SendMessageW GetWindowThreadProcessId GetShellWindow

advapi32

GetUserNameW RegSetValueExW RegOpenKeyExW RegCloseKey GetTokenInformation FreeSid EqualSid CheckTokenMembership AllocateAndInitializeSid LookupPrivilegeValueW DuplicateTokenEx AdjustTokenPrivileges OpenProcessToken

shell32

ShellExecuteW SHGetSpecialFolderLocation SHCreateDirectoryExW SHGetSpecialFolderPathW SHChangeNotify

ole32

CoCreateInstance CoTaskMemAlloc CoTaskMemFree CoInitialize CoCreateGuid CoUninitialize CoInitializeSecurity

oleaut32

SysAllocString VariantClear SysFreeString CreateErrorInfo GetErrorInfo VariantChangeType SetErrorInfo VariantInit

shlwapi

PathFileExistsW PathFindExtensionW PathIsNetworkPathW PathIsDirectoryW PathFindFileNameW PathIsRelativeW SHDeleteKeyW SHDeleteValueW StrStrIW SHGetValueW SHSetValueW

cJSON_AddArrayToObject cJSON_AddBoolToObject cJSON_AddFalseToObject cJSON_AddItemReferenceToArray cJSON_AddItemReferenceToObject cJSON_AddItemToArray cJSON_AddItemToObject cJSON_AddItemToObjectCS cJSON_AddNullToObject cJSON_AddNumberToObject cJSON_AddObjectToObject cJSON_AddRawToObject cJSON_AddStringToObject cJSON_AddTrueToObject cJSON_Compare cJSON_CreateArray cJSON_CreateArrayReference cJSON_CreateBool cJSON_CreateDoubleArray cJSON_CreateFalse cJSON_CreateFloatArray cJSON_CreateIntArray cJSON_CreateNull cJSON_CreateNumber cJSON_CreateObject cJSON_CreateObjectReference cJSON_CreateRaw cJSON_CreateString cJSON_CreateStringArray cJSON_CreateStringReference cJSON_CreateTrue cJSON_Delete cJSON_DeleteItemFromArray cJSON_DeleteItemFromObject cJSON_DeleteItemFromObjectCaseSensitive cJSON_DetachItemFromArray cJSON_DetachItemFromObject cJSON_DetachItemFromObjectCaseSensitive cJSON_DetachItemViaPointer cJSON_Duplicate cJSON_GetArrayItem cJSON_GetArraySize cJSON_GetErrorPtr cJSON_GetObjectItem cJSON_GetObjectItemCaseSensitive cJSON_GetStringValue cJSON_HasObjectItem cJSON_InitHooks cJSON_InsertItemInArray cJSON_IsArray cJSON_IsBool cJSON_IsFalse cJSON_IsInvalid cJSON_IsNull cJSON_IsNumber cJSON_IsObject cJSON_IsRaw cJSON_IsString cJSON_IsTrue cJSON_Minify cJSON_Parse cJSON_ParseWithOpts cJSON_Print cJSON_PrintBuffered cJSON_PrintPreallocated cJSON_PrintUnformatted cJSON_ReplaceItemInArray cJSON_ReplaceItemInObject cJSON_ReplaceItemInObjectCaseSensitive cJSON_ReplaceItemViaPointer cJSON_SetNumberHelper cJSON_Version cJSON_free cJSON_malloc

Name

.text

Size

1.0MB

Virtual Size

1.0MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

246KB

Virtual Size

246KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

11KB

Virtual Size

19KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

47KB

Virtual Size

47KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.didat

Size

512B

Virtual Size

200B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

296KB

Virtual Size

296KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

572KB

Virtual Size

576KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-03_148e84a3dc4e26f74d21808b56671cf9_icedid_luca-stealer_njrat_stealc

kernel32

user32

advapi32

shell32

ole32

oleaut32

shlwapi

generic