2026-08-06_bf1d61605d0ceb86d8424b4ec3f43612_icedid_luca-stealer_njrat_stealc

General

Target
2026-08-06_bf1d61605d0ceb86d8424b4ec3f43612_icedid_luca-stealer_njrat_stealc
Size 1.8MB
Sample260807-almpradb27
SHA256 0eb0fd0064111f68b3c42b43854b11d795045eb5333390a0929b719822e8d456
MD5 bf1d61605d0ceb86d8424b4ec3f43612
SHA1 ac07bccf54172a34a202ff019ddb4a42e9778835
SHA512 e11d372258d616ecd45219b9fa6129ae0ad5615f02a123f74e095db6d25262a4218d25920b7d8524486fcacae5f2e5ec354a55288023d191c6e70a9299e682a2
SSDEEP 24576:OCNkEG/CVI5G90nQ/tbw/2Mkjy6Fr7g0o:OC2Ev390Q/lFTjN4
TLSH
T13595E0A9A2A843F5E167D178C9424503EBB1BC4A5761A7CF03E04AB62F376E14E7F311
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-06_bf1d61605d0ceb86d8424b4ec3f43612_icedid_luca-stealer_njrat_stealc

File Explorer

2026-08-06_bf1d61605d0ceb86d8424b4ec3f43612_icedid_luca-stealer_njrat_stealc

.exe 1.8MB

2026-08-06_bf1d61605d0ceb86d8424b4ec3f43612_icedid_luca-stealer_njrat_stealc

IMPHASH 926e7b60301ae423416e4e2a21c8dace
SHA256 0eb0fd0064111f68b3c42b43854b11d795045eb5333390a0929b719822e8d456
MD5 bf1d61605d0ceb86d8424b4ec3f43612
SHA1 ac07bccf54172a34a202ff019ddb4a42e9778835
SHA512 e11d372258d616ecd45219b9fa6129ae0ad5615f02a123f74e095db6d25262a4218d25920b7d8524486fcacae5f2e5ec354a55288023d191c6e70a9299e682a2
SSDEEP 24576:OCNkEG/CVI5G90nQ/tbw/2Mkjy6Fr7g0o:OC2Ev390Q/lFTjN4
TLSH
T13595E0A9A2A843F5E167D178C9424503EBB1BC4A5761A7CF03E04AB62F376E14E7F311
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

221628

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\gitlab\builds\dev_138\src\out\PublicRelease.x64\obj\third_party\aloha\vpn\aloha_service.pdb

kernel32

FormatMessageA GetExitCodeProcess ReadFile WriteFile CreateNamedPipeW WaitForMultipleObjects GetNamedPipeClientProcessId DisconnectNamedPipe CreateToolhelp32Snapshot CreateEventW WideCharToMultiByte SetEvent Process32FirstW CancelIoEx GetOverlappedResult ConnectNamedPipe Sleep GetTickCount64 CreateFileW SetEndOfFile CreateProcessW LocalFree CloseHandle MultiByteToWideChar OpenProcess GetModuleFileNameW GetCurrentProcess FreeLibrary GetProcAddress LoadLibraryW GetLastError Process32NextW GetFileAttributesW WriteConsoleW HeapSize SetStdHandle GetProcessHeap GetLocaleInfoEx FindClose FindFirstFileW FindFirstFileExW FindNextFileW GetFileAttributesExW SetFileInformationByHandle GetTempPathW AreFileApisANSI GetModuleHandleW MoveFileExW GetFileInformationByHandleEx GetCurrentThreadId QueryPerformanceCounter EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer LCMapStringEx ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW GetSystemTimeAsFileTime GetStringTypeW CompareStringEx GetCPInfo UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW GetCurrentProcessId InitializeSListHead RtlUnwindEx RtlPcToFileHeader RaiseException SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW GetModuleHandleExW ExitProcess GetStdHandle GetCommandLineA GetCommandLineW GetFileSizeEx SetFilePointerEx GetFileType HeapAlloc FlushFileBuffers GetConsoleOutputCP GetConsoleMode HeapFree FlsAlloc FlsGetValue FlsSetValue FlsFree VirtualProtect GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetTimeZoneInformation ReadConsoleW HeapReAlloc IsValidCodePage GetACP GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW RtlUnwind

advapi32

CreateServiceW CloseServiceHandle OpenSCManagerW SetServiceStatus DeleteService RegisterServiceCtrlHandlerW ControlService StartServiceW StartServiceCtrlDispatcherW OpenServiceW QueryServiceStatusEx SetSecurityDescriptorDacl InitializeSecurityDescriptor

ntdll

RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind

Name

.text

Size

386KB

Virtual Size

386KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

105KB

Virtual Size

105KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

8KB

Virtual Size

143KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

17KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

488B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

1.3MB

Virtual Size

1.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-06_bf1d61605d0ceb86d8424b4ec3f43612_icedid_luca-stealer_njrat_stealc

kernel32

advapi32

ntdll

generic