2026-08-06_09d6f34262c4aadbc356c5eb1f1a28ca_icedid_luca-stealer_njrat_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-06_09d6f34262c4aadbc356c5eb1f1a28ca_icedid_luca-stealer_njrat_stealc
Size 4.5MB
Sample260806-tdjsnseq2x
SHA256 ee59db359dade956ba309ceb05f72d5c853a3a5591fa3d8c34dc091893d31cb0
MD5 09d6f34262c4aadbc356c5eb1f1a28ca
SHA1 41bfd474fb43f03b3e1ed7d5528b19b4d096f2ab
SHA512 82740012897fbe17209dea5109fa10aa5ffdffa7405ac3f88d9da4623626f921405e71d403b61a027dab5728f38068ea24c9864d84121606571974b91517adef
SSDEEP 98304:nrWBR+Mo/Y7mgTm05AwJHE6hQlZqL9PlF:rEKg7PAmklZqL1lF
TLSH
T1FD26BE06F382C69DD2659938CD51D3A6E332BC145F2243E7B2947E2EBDB62E04E35781
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects executables referencing many IR and analysis tools 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_References_SecTools

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-06_09d6f34262c4aadbc356c5eb1f1a28ca_icedid_luca-stealer_njrat_stealc

File Explorer

2026-08-06_09d6f34262c4aadbc356c5eb1f1a28ca_icedid_luca-stealer_njrat_stealc

.exe 4.5MB

2026-08-06_09d6f34262c4aadbc356c5eb1f1a28ca_icedid_luca-stealer_njrat_stealc

IMPHASH a6deac3b06168ed881d81b4d85e13ccd
SHA256 ee59db359dade956ba309ceb05f72d5c853a3a5591fa3d8c34dc091893d31cb0
MD5 09d6f34262c4aadbc356c5eb1f1a28ca
SHA1 41bfd474fb43f03b3e1ed7d5528b19b4d096f2ab
SHA512 82740012897fbe17209dea5109fa10aa5ffdffa7405ac3f88d9da4623626f921405e71d403b61a027dab5728f38068ea24c9864d84121606571974b91517adef
SSDEEP 98304:nrWBR+Mo/Y7mgTm05AwJHE6hQlZqL9PlF:rEKg7PAmklZqL1lF
TLSH
T1FD26BE06F382C69DD2659938CD51D3A6E332BC145F2243E7B2947E2EBDB62E04E35781
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects executables referencing many IR and analysis tools
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

805944

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

d:\REBRANDS\Phantom Roblox External\Roblox External\release\release.pdb

d3d9

Direct3DCreate9

winmm

timeBeginPeriod PlaySoundA

kernel32

VerSetConditionMask FreeLibrary QueryPerformanceCounter ReadProcessMemory WriteProcessMemory Sleep GetWindowsDirectoryA GetVolumeInformationA GetComputerNameA SetConsoleTitleA GetCurrentProcess GetStdHandle WriteConsoleA SetConsoleMode SetCurrentConsoleFontEx TerminateProcess OpenProcess CreateToolhelp32Snapshot GetConsoleMode Process32NextW ReadConsoleInputW GetCurrentThread Process32FirstW CloseHandle CreateThread GetThreadContext LocalFree ExitProcess SetConsoleCP GetConsoleWindow SetConsoleOutputCP GetTickCount IsDebuggerPresent CheckRemoteDebuggerPresent K32EnumProcessModulesEx K32GetModuleInformation SetThreadPriority Process32First Module32Next GetProcessId Module32First Process32Next SwitchToThread GetACP IsValidCodePage HeapReAlloc CreateProcessW GetExitCodeProcess WaitForSingleObject GetTimeZoneInformation GetFileSizeEx GetConsoleOutputCP GetProcAddress EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW GlobalAlloc GetTimeFormatW GetDateFormatW VirtualProtect FlsFree FlsSetValue FlsGetValue FlsAlloc HeapFree HeapAlloc GetFileType ReadConsoleW SetFilePointerEx GetCommandLineW GetCommandLineA WriteFile GetModuleFileNameW GetModuleHandleExW FreeLibraryAndExitThread ExitThread ReadFile LoadLibraryExW TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount SetLastError RtlUnwindEx GetCPInfo GetStringTypeW LCMapStringEx DecodePointer EncodePointer DeleteCriticalSection LeaveCriticalSection QueryPerformanceFrequency LoadLibraryA GetLocaleInfoA GetModuleHandleA MultiByteToWideChar SetStdHandle HeapSize WriteConsoleW EnterCriticalSection GlobalUnlock WideCharToMultiByte GlobalLock FlushFileBuffers GlobalFree GetProcessHeap SetEnvironmentVariableW FreeEnvironmentStringsW GetOEMCP GetEnvironmentStringsW SetEndOfFile CompareStringW RtlUnwind RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW GetStartupInfoW GetModuleHandleW GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead TryAcquireSRWLockExclusive ReleaseSRWLockShared AcquireSRWLockShared FormatMessageA GetCurrentDirectoryW CreateDirectoryW CreateFileW FindClose FindFirstFileW FindFirstFileExW FindNextFileW GetFileAttributesExW SetFileInformationByHandle AreFileApisANSI GetLastError GetFileInformationByHandleEx GetLocaleInfoEx WaitForSingleObjectEx GetExitCodeThread RtlPcToFileHeader RaiseException InitializeCriticalSectionEx

user32

OpenClipboard GetClipboardData ReleaseDC SetCursorPos CloseClipboard EmptyClipboard SetClipboardData GetCursorPos ReleaseCapture MonitorFromPoint DispatchMessageA GetWindowRect DestroyWindow SetWindowPos GetSystemMetrics ShowWindow SetWindowDisplayAffinity MessageBoxA DefWindowProcA CreateWindowExA TranslateMessage PeekMessageA UnregisterClassA PostQuitMessage SetWindowLongPtrA RegisterClassExA UpdateWindow GetWindowThreadProcessId IsWindow EnumWindows SetWindowLongA GetWindowLongA SetLayeredWindowAttributes GetKeyNameTextA MapVirtualKeyA GetAsyncKeyState FindWindowA SendInput GetKeyState GetMessageExtraInfo LoadCursorA GetDC ScreenToClient GetCapture ClientToScreen TrackMouseEvent GetKeyboardLayout GetForegroundWindow SetCapture SetCursor GetClientRect IsWindowUnicode

gdi32

GetDeviceCaps

advapi32

RegQueryValueExA RegCloseKey RegOpenKeyExA

shell32

SHGetFolderPathW ShellExecuteW

imm32

ImmSetCandidateWindow ImmSetCompositionWindow ImmReleaseContext ImmGetContext

dwmapi

DwmExtendFrameIntoClientArea

winhttp

WinHttpQueryDataAvailable WinHttpConnect WinHttpSendRequest WinHttpOpenRequest WinHttpReadData WinHttpOpen WinHttpReceiveResponse WinHttpSetTimeouts WinHttpQueryHeaders WinHttpCloseHandle

crypt32

CryptUnprotectData CryptProtectData

Name

.text

Size

1024KB

Virtual Size

1023KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.3MB

Virtual Size

1.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

2.2MB

Virtual Size

2.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

40KB

Virtual Size

40KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-06_09d6f34262c4aadbc356c5eb1f1a28ca_icedid_luca-stealer_njrat_stealc

d3d9

winmm

kernel32

user32

gdi32

advapi32

shell32

imm32

dwmapi

winhttp

crypt32

generic