2026-08-08_5f250e33f15ff47fd4722b8bad3ce79d_icedid_luca-stealer_njrat_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-08_5f250e33f15ff47fd4722b8bad3ce79d_icedid_luca-stealer_njrat_stealc
Size 2.4MB
Sample260808-l1cc4svarf
SHA256 55aeef2e2eb22e56e91d859f14aec323f02415baf89af7b3b395d0b4c7ab310c
MD5 5f250e33f15ff47fd4722b8bad3ce79d
SHA1 7f1fe2eb1c3b6c8e069655ad6cf93a6f1a0e7217
SHA512 df375ddd2e34c22e153ed7b3a1275aafd72a6e75cac78d3dcdc95d7d380068b4a8d971f4b7c138389459702e7f07483e4d02d9fd1a56272bd5d2e390b530f542
SSDEEP 49152:ApJahr+3XO1TYh00Or2VnEkh0LOkNNtUsLX/C7+85bClt27amlFJ:JmXO1Q+iMf7/CJGt2Wml
TLSH
T1E8C5DF07B6E541E8D06AE138C9527E1BEA72381907215BFF23D049596FA37E04E7FB12
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects executables Discord URL observed in first stage droppers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_DiscordURL

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-08_5f250e33f15ff47fd4722b8bad3ce79d_icedid_luca-stealer_njrat_stealc

File Explorer

2026-08-08_5f250e33f15ff47fd4722b8bad3ce79d_icedid_luca-stealer_njrat_stealc

.exe 2.4MB

2026-08-08_5f250e33f15ff47fd4722b8bad3ce79d_icedid_luca-stealer_njrat_stealc

IMPHASH 4e99bf72462c2675a0c18223fae29652
SHA256 55aeef2e2eb22e56e91d859f14aec323f02415baf89af7b3b395d0b4c7ab310c
MD5 5f250e33f15ff47fd4722b8bad3ce79d
SHA1 7f1fe2eb1c3b6c8e069655ad6cf93a6f1a0e7217
SHA512 df375ddd2e34c22e153ed7b3a1275aafd72a6e75cac78d3dcdc95d7d380068b4a8d971f4b7c138389459702e7f07483e4d02d9fd1a56272bd5d2e390b530f542
SSDEEP 49152:ApJahr+3XO1TYh00Or2VnEkh0LOkNNtUsLX/C7+85bClt27amlFJ:JmXO1Q+iMf7/CJGt2Wml
TLSH
T1E8C5DF07B6E541E8D06AE138C9527E1BEA72381907215BFF23D049596FA37E04E7FB12
MD5 SHA1 SHA512 SSDEEP TLSH

Detects executables Discord URL observed in first stage droppers
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

834100

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

c:\Users\yerow\OneDrive\Documents\Projects\DeepwokenCheat\Pollus\build\pollus.pdb

d3d11

D3D11CreateDeviceAndSwapChain

dwmapi

DwmExtendFrameIntoClientArea

version

VerQueryValueA GetFileVersionInfoA GetFileVersionInfoSizeA

winhttp

WinHttpOpen WinHttpQueryHeaders WinHttpReceiveResponse WinHttpOpenRequest WinHttpCloseHandle WinHttpSendRequest WinHttpConnect WinHttpCrackUrl WinHttpReadData WinHttpQueryDataAvailable

winmm

PlaySoundW

kernel32

HeapReAlloc GetTimeZoneInformation CreateProcessW GetExitCodeProcess WaitForSingleObject GetFileSizeEx GetConsoleOutputCP FlushFileBuffers EnumSystemLocalesW GetUserDefaultLCID GetModuleHandleA GetLocaleInfoA MultiByteToWideChar LoadLibraryA QueryPerformanceFrequency GetProcAddress VerSetConditionMask FreeLibrary QueryPerformanceCounter GlobalAlloc GlobalFree GlobalLock WideCharToMultiByte GlobalUnlock Process32First SetConsoleTitleA Module32First OpenProcess CreateToolhelp32Snapshot Process32Next CloseHandle GetModuleFileNameA GetEnvironmentVariableA K32GetModuleFileNameExA FreeConsole GetConsoleWindow AllocConsole GetSystemTime GetComputerNameA SizeofResource FindResourceA LockResource LoadResource GetCurrentProcess IsDebuggerPresent CheckRemoteDebuggerPresent Sleep IsValidLocale GetLocaleInfoW LCMapStringW GetTimeFormatW GetDateFormatW VirtualProtect FlsFree FlsSetValue FlsGetValue FlsAlloc HeapFree HeapAlloc GetFileType ReadConsoleW GetConsoleMode SetFilePointerEx GetCommandLineW GetCommandLineA ExitProcess GetModuleFileNameW WriteFile GetStdHandle GetModuleHandleExW FreeLibraryAndExitThread ExitThread CreateThread ReadFile LoadLibraryExW TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount SetLastError RaiseException RtlPcToFileHeader RtlUnwindEx GetStartupInfoW InitializeSListHead GetCurrentProcessId IsProcessorFeaturePresent TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext GetCPInfo IsValidCodePage GetACP GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle GetProcessHeap HeapSize WriteConsoleW SetEndOfFile CompareStringW WaitForSingleObjectEx ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive GetCurrentThreadId SleepConditionVariableSRW RtlUnwind GetExitCodeThread LocalFree FormatMessageA GetLocaleInfoEx CreateDirectoryW CreateFileW FindClose FindFirstFileW FindFirstFileExW FindNextFileW GetFileAttributesW GetFileAttributesExW SetFileInformationByHandle GetTempPathW AreFileApisANSI GetLastError GetModuleHandleW GetFileInformationByHandleEx WakeConditionVariable WakeAllConditionVariable InitializeCriticalSectionEx GetSystemTimeAsFileTime EnterCriticalSection LeaveCriticalSection DeleteCriticalSection EncodePointer DecodePointer LCMapStringEx GetStringTypeW

user32

MonitorFromPoint DispatchMessageA DestroyWindow SetWindowRgn GetSystemMetrics ShowWindow SetWindowLongA SetWindowDisplayAffinity MoveWindow DefWindowProcA CreateWindowExA SetLayeredWindowAttributes TranslateMessage SendMessageA LoadIconA PeekMessageA UnregisterClassA PostQuitMessage RegisterClassExA UpdateWindow GetWindowRgn GetAsyncKeyState SetWindowPos MessageBoxA FindWindowA OpenClipboard CloseClipboard EmptyClipboard GetClipboardData SetClipboardData GetKeyState GetMessageExtraInfo LoadCursorA GetDC ScreenToClient GetCursorPos ClientToScreen TrackMouseEvent GetKeyboardLayout GetForegroundWindow SetCapture SetCursor GetClientRect SetProcessDPIAware IsWindowUnicode ReleaseCapture SetCursorPos ReleaseDC GetCapture

gdi32

CreateSolidBrush DeleteObject GetDeviceCaps CreateRectRgn

advapi32

GetUserNameA

d3dcompiler_47

D3DCompile

imm32

ImmSetCompositionWindow ImmReleaseContext ImmGetContext ImmSetCandidateWindow

Name

.text

Size

1.0MB

Virtual Size

1.0MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

385KB

Virtual Size

384KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

301KB

Virtual Size

308KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

42KB

Virtual Size

42KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

678KB

Virtual Size

677KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

9KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-08_5f250e33f15ff47fd4722b8bad3ce79d_icedid_luca-stealer_njrat_stealc

d3d11

dwmapi

version

winhttp

winmm

kernel32

user32

gdi32

advapi32

d3dcompiler_47

imm32

generic