hermes_stealer | 2026-08-04_2f5492ece9559b83ed9136640c866fa7_icedid_luca-stealer_njrat_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-04_2f5492ece9559b83ed9136640c866fa7_icedid_luca-stealer_njrat_stealc
Size 129.1MB
Sample260804-tree4saj7w
SHA256 c8346caac436c1deae52517679e4682811a26e721888b800d6d21ceb042476b5
MD5 2f5492ece9559b83ed9136640c866fa7
SHA1 f717ebd63327c12c1d8cfbc73dd4a3222a25ae15
SHA512 7a7ff27a9b3631fa23eb3bde9fab44da04409203424b2d2106e89801bda48fbe2af72a551523ffcb9411a87a4a5ec389d7d885fe44e705d3b28f6532facdcc36
SSDEEP 24576:qPqSZX6LfpAZYtth1+VszndApmGv5NOriQWTdvvmi6p:kqSZX6LfVEVJV50l
TLSH
T19A589E57B6A800E8D0A7C178CE565607E7B2780513709BDF16D48AEA6F23EE11F7E720
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

stealer hermes_stealer

Malware Config

Signatures

Family: HermesStealer
HermesStealer is a Windows stealer written in C.
stealer hermes_stealer

Detects HermesStealer 1 IoCs

resource	yara_rule
sample	family_hermes_stealer

Detects executables containing SQL queries to confidential data stores. Observed in infostealers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-04_2f5492ece9559b83ed9136640c866fa7_icedid_luca-stealer_njrat_stealc

File Explorer

2026-08-04_2f5492ece9559b83ed9136640c866fa7_icedid_luca-stealer_njrat_stealc

.exe 129.1MB

2026-08-04_2f5492ece9559b83ed9136640c866fa7_icedid_luca-stealer_njrat_stealc

IMPHASH b10af303940e990c41fb6535e4e68148
SHA256 c8346caac436c1deae52517679e4682811a26e721888b800d6d21ceb042476b5
MD5 2f5492ece9559b83ed9136640c866fa7
SHA1 f717ebd63327c12c1d8cfbc73dd4a3222a25ae15
SHA512 7a7ff27a9b3631fa23eb3bde9fab44da04409203424b2d2106e89801bda48fbe2af72a551523ffcb9411a87a4a5ec389d7d885fe44e705d3b28f6532facdcc36
SSDEEP 24576:qPqSZX6LfpAZYtth1+VszndApmGv5NOriQWTdvvmi6p:kqSZX6LfVEVJV50l
TLSH
T19A589E57B6A800E8D0A7C178CE565607E7B2780513709BDF16D48AEA6F23EE11F7E720
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects HermesStealer
Detects executables containing SQL queries to confidential data stores. Observed in infostealers
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1234764

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

crypt32

CryptUnprotectData CryptStringToBinaryA

ole32

CreateStreamOnHGlobal

shell32

ShellExecuteW SHGetFolderPathW

user32

OpenClipboard CloseClipboard GetClipboardData GetSystemMetrics GetForegroundWindow GetDC ReleaseDC GetWindowTextW GetDesktopWindow MessageBoxW

kernel32

GetFileAttributesW GetFileSize ReadFile SetFileAttributesW WriteFile GetTempPathW IsDebuggerPresent CheckRemoteDebuggerPresent CloseHandle GetLastError CreatePipe WaitForSingleObject CreateMutexW Sleep GetCurrentProcess ExitProcess TerminateProcess GetExitCodeProcess CreateProcessW OpenProcess GlobalMemoryStatusEx GetSystemInfo GetTickCount GetTickCount64 GetModuleFileNameW GetModuleHandleA GetProcAddress GlobalUnlock GlobalLock LocalFree BackupRead CopyFileW GetComputerNameW WideCharToMultiByte CreateToolhelp32Snapshot Process32FirstW Process32NextW FlushFileBuffers QueryPerformanceCounter MapViewOfFile CreateFileMappingW FormatMessageA GetSystemTime GetSystemTimeAsFileTime FreeLibrary SystemTimeToFileTime GetProcessHeap GetDiskFreeSpaceExW LockFileEx UnlockFile HeapDestroy HeapCompact HeapAlloc LoadLibraryW HeapReAlloc DeleteFileA WaitForSingleObjectEx LoadLibraryA CreateFileA FlushViewOfFile OutputDebugStringW GetFileAttributesExW GetFileAttributesA GetDiskFreeSpaceA FormatMessageW GetTempPathA MultiByteToWideChar HeapSize HeapValidate UnmapViewOfFile UnlockFileEx SetEndOfFile GetFullPathNameA SetFilePointer LockFile OutputDebugStringA GetDiskFreeSpaceW GetFullPathNameW HeapFree HeapCreate AreFileApisANSI RaiseException InitializeCriticalSection EnterCriticalSection LeaveCriticalSection TryEnterCriticalSection DeleteCriticalSection GetCurrentThreadId RtlUnwind FindNextFileW FindFirstFileW FindClose DeleteFileW CreateFileW CreateDirectoryW GetConsoleMode GetFileSizeEx SetFilePointerEx ReadConsoleW GetTimeZoneInformation IsValidCodePage GetACP GetConsoleOutputCP GetFileType EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW VirtualProtect GetOEMCP GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle WriteConsoleW GetCurrentProcessId GetLocaleInfoEx FindFirstFileExW GetModuleHandleW GetFileInformationByHandleEx InitializeCriticalSectionEx EncodePointer DecodePointer CompareStringEx GetCPInfo LCMapStringEx GetStringTypeW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent GetStartupInfoW InitializeSListHead RtlPcToFileHeader RtlUnwindEx SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW CreateThread ExitThread FreeLibraryAndExitThread GetModuleHandleExW GetStdHandle FlsAlloc FlsGetValue FlsSetValue FlsFree

advapi32

RegSetValueExW AdjustTokenPrivileges AllocateAndInitializeSid CheckTokenMembership DuplicateTokenEx FreeSid ImpersonateLoggedOnUser RevertToSelf LookupPrivilegeValueW GetUserNameW RegCloseKey RegCreateKeyExW OpenProcessToken

gdiplus

GdipAlloc GdipFree GdiplusStartup GdiplusShutdown GdipCloneImage GdipDisposeImage GdipSaveImageToStream GdipCreateBitmapFromHBITMAP GdipGetImageEncodersSize GdipGetImageEncoders

gdi32

DeleteObject CreateCompatibleBitmap SelectObject BitBlt DeleteDC CreateCompatibleDC

iphlpapi

GetAdaptersInfo

Name

.text

Size

1.3MB

Virtual Size

1.3MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

239KB

Virtual Size

238KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

55.0MB

Virtual Size

55.0MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

56KB

Virtual Size

55KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

72.5MB

Virtual Size

72.5MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-04_2f5492ece9559b83ed9136640c866fa7_icedid_luca-stealer_njrat_stealc

crypt32

ole32

shell32

user32

kernel32

advapi32

gdiplus

gdi32

iphlpapi

generic