2026-08-08_5462c431a0e9cb602341f3723c968ebe_icedid_luca-stealer_njrat_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-08_5462c431a0e9cb602341f3723c968ebe_icedid_luca-stealer_njrat_stealc
Size 1.6MB
Sample260808-nz2byswdld
SHA256 b1baad34f9e242d54700b98fec125c68ab91d4b8b462072ecb89bc015a22eadf
MD5 5462c431a0e9cb602341f3723c968ebe
SHA1 89b665d0274ba13f82ff05e7b0b6dbb3aefcaf0f
SHA512 e41235b8af49037addf2d80e39bc33adc68f1eb33baa572ac98f93959186881ab5babf2e8ceb3af031b6fe6c8621831c42bd174c7ba39be3d50604cf8d8a5fa8
SSDEEP 12288:/r3hNV7gASHVFcCLYKExuEsYPfEXI7vgbrWVQhTCYHvRktx/aICF9flefuKaO0Vq:/rV7gASH/cXK5EsYPn743TvRk6NwG
TLSH
T1B78559826EA83168E5B37AB8D8BF45019A77BC915F32868FB25075591E33580CD3E733
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-08_5462c431a0e9cb602341f3723c968ebe_icedid_luca-stealer_njrat_stealc

File Explorer

2026-08-08_5462c431a0e9cb602341f3723c968ebe_icedid_luca-stealer_njrat_stealc

.exe 1.6MB

2026-08-08_5462c431a0e9cb602341f3723c968ebe_icedid_luca-stealer_njrat_stealc

IMPHASH 21408e07e3ff99fc3a97ccabf87d2b7e
SHA256 b1baad34f9e242d54700b98fec125c68ab91d4b8b462072ecb89bc015a22eadf
MD5 5462c431a0e9cb602341f3723c968ebe
SHA1 89b665d0274ba13f82ff05e7b0b6dbb3aefcaf0f
SHA512 e41235b8af49037addf2d80e39bc33adc68f1eb33baa572ac98f93959186881ab5babf2e8ceb3af031b6fe6c8621831c42bd174c7ba39be3d50604cf8d8a5fa8
SSDEEP 12288:/r3hNV7gASHVFcCLYKExuEsYPfEXI7vgbrWVQhTCYHvRktx/aICF9flefuKaO0Vq:/rV7gASH/cXK5EsYPn743TvRk6NwG
TLSH
T1B78559826EA83168E5B37AB8D8BF45019A77BC915F32868FB25075591E33580CD3E733
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

39984

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\agent\_work\20\s\x64\Release\HPAudioAnalytics.pdb

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-errorhandling-l1-1-0

SetUnhandledExceptionFilter RaiseException SetLastError GetLastError UnhandledExceptionFilter

api-ms-win-core-processthreads-l1-1-0

TlsAlloc OpenThreadToken ExitProcess TlsGetValue TerminateProcess GetCurrentThread GetCurrentProcessId GetCurrentThreadId CreateThread GetCurrentProcess TlsSetValue TlsFree GetStartupInfoW OpenProcessToken CreateProcessW ExitThread

api-ms-win-security-base-l1-1-0

AddAce CopySid AddAccessAllowedAce CreateWellKnownSid SetSecurityDescriptorOwner SetSecurityDescriptorGroup SetSecurityDescriptorDacl IsValidSid InitializeSecurityDescriptor InitializeAcl GetTokenInformation GetLengthSid GetAclInformation GetAce ImpersonateLoggedOnUser RevertToSelf

api-ms-win-core-heap-l2-1-0

LocalAlloc LocalFree

api-ms-win-core-com-l1-1-0

CoUninitialize CoInitializeEx CoInitializeSecurity

api-ms-win-core-synch-l1-1-0

AcquireSRWLockExclusive LeaveCriticalSection EnterCriticalSection InitializeCriticalSectionAndSpinCount CreateMutexW CreateEventW WaitForSingleObject ReleaseMutex DeleteCriticalSection InitializeCriticalSection ReleaseSRWLockExclusive InitializeCriticalSectionEx

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent OpenProcess

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleExW GetProcAddress GetModuleHandleW FreeLibraryAndExitThread GetModuleFileNameW LoadLibraryExW FreeLibrary

api-ms-win-security-lsalookup-l2-1-0

LookupPrivilegeValueW

api-ms-win-core-kernel32-legacy-l1-1-0

WTSGetActiveConsoleSessionId MoveFileW

api-ms-win-core-version-l1-1-1

GetFileVersionInfoSizeW GetFileVersionInfoW

api-ms-win-core-version-l1-1-0

VerQueryValueW

oleaut32

SysFreeString

api-ms-win-service-management-l2-1-0

QueryServiceConfigW QueryServiceStatusEx ChangeServiceConfig2W

api-ms-win-service-management-l1-1-0

OpenServiceW DeleteService CloseServiceHandle CreateServiceW OpenSCManagerW

api-ms-win-security-sddl-l1-1-0

ConvertSidToStringSidW

api-ms-win-eventlog-legacy-l1-1-0

ReportEventW RegisterEventSourceW DeregisterEventSource

api-ms-win-service-core-l1-1-0

StartServiceCtrlDispatcherW SetServiceStatus RegisterServiceCtrlHandlerExW

api-ms-win-core-synch-l1-2-0

Sleep WakeAllConditionVariable SleepConditionVariableSRW

api-ms-win-service-winsvc-l1-1-0

QueryServiceStatus ControlService

api-ms-win-core-util-l1-1-0

EncodePointer DecodePointer

api-ms-win-core-heap-l1-1-0

GetProcessHeap HeapSize HeapReAlloc HeapAlloc HeapFree

user32

MsgWaitForMultipleObjectsEx

hpaudioanalyticclientlib

?RegisterAllAudioSessions@CAudioAnalyticsManager@Analytics@HotkeyAudio@@QEAAXXZ ?UnRegisterAllAudioSessions@CAudioAnalyticsManager@Analytics@HotkeyAudio@@QEAAXXZ ?RegisterDataClass@CAudioAnalyticsManager@Analytics@HotkeyAudio@@QEAA?AW4AnalyticsResult@Emitters@2HP@@XZ ?InitializeAnalyticsSession@CAudioAnalyticsManager@Analytics@HotkeyAudio@@QEAAXXZ ?ReleaseAnalyticsManager@CAudioAnalyticsManager@Analytics@HotkeyAudio@@SAXXZ ?GetInstance@CAudioAnalyticsManager@Analytics@HotkeyAudio@@SAPEAV123@XZ

wtsapi32

WTSEnumerateSessionsW WTSQueryUserToken WTSEnumerateProcessesW WTSFreeMemory

api-ms-win-core-debug-l1-1-0

OutputDebugStringW IsDebuggerPresent

api-ms-win-core-rtlsupport-l1-1-0

RtlCaptureContext RtlVirtualUnwind RtlPcToFileHeader RtlUnwindEx RtlLookupFunctionEntry

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetLocalTime GetSystemTimeAsFileTime

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

api-ms-win-core-file-l1-1-0

GetTempFileNameW FindNextFileW CreateDirectoryW DeleteFileW FindClose GetFullPathNameW GetFileAttributesExW FindFirstFileW GetFileType FindFirstFileExW FlushFileBuffers ReadFile GetFileSizeEx SetFilePointerEx CreateFileW SetEndOfFile WriteFile

api-ms-win-core-realtime-l1-1-0

QueryUnbiasedInterruptTime

api-ms-win-core-registry-l1-1-0

RegQueryValueExW RegCloseKey RegOpenKeyExW

api-ms-win-shell-shdirectory-l1-1-0

ord290

ext-ms-win-shell32-shellfolders-l1-1-0

SHGetFolderPathW

api-ms-win-core-processenvironment-l1-1-0

GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetStdHandle SetStdHandle GetCommandLineW GetCommandLineA

api-ms-win-core-fibers-l1-1-0

FlsSetValue FlsGetValue FlsAlloc FlsFree

api-ms-win-core-memory-l1-1-0

VirtualProtect

api-ms-win-core-string-l1-1-0

CompareStringW WideCharToMultiByte MultiByteToWideChar GetStringTypeW

api-ms-win-core-localization-l1-2-0

IsValidCodePage GetACP GetCPInfo GetOEMCP LCMapStringW

api-ms-win-core-console-l1-1-0

GetConsoleOutputCP ReadConsoleW WriteConsoleW GetConsoleMode

??0AnalyticsSession@@QEAA@$$QEAV0@@Z ??0AnalyticsSession@@QEAA@AEBV0@@Z ??0AppSession@Session@Analytics@HP@@QEAA@$$QEAV0123@@Z ??0AppSession@Session@Analytics@HP@@QEAA@AEBV0123@@Z ??0BaseDataClass@DataClass@Analytics@HP@@QEAA@$$QEAV0123@@Z ??0BaseDataClass@DataClass@Analytics@HP@@QEAA@AEBV0123@@Z ??0ConsentObject@@QEAA@$$QEAV0@@Z ??0ConsentObject@@QEAA@AEBV0@@Z ??0DataClassFieldInfo@DataClass@Analytics@HP@@QEAA@$$QEAV0123@@Z ??0DataClassFieldInfo@DataClass@Analytics@HP@@QEAA@AEBV0123@@Z ??0DataClassFieldInfo@DataClass@Analytics@HP@@QEAA@XZ ??0PrivacyDocuments@@QEAA@$$QEAV0@@Z ??0PrivacyDocuments@@QEAA@AEBV0@@Z ??1AnalyticsSession@@QEAA@XZ ??1AppSession@Session@Analytics@HP@@QEAA@XZ ??1BaseDataClass@DataClass@Analytics@HP@@QEAA@XZ ??1ConsentObject@@QEAA@XZ ??1DataClassFieldInfo@DataClass@Analytics@HP@@QEAA@XZ ??1PrivacyDocuments@@QEAA@XZ ??4AnalyticsSession@@QEAAAEAV0@$$QEAV0@@Z ??4AnalyticsSession@@QEAAAEAV0@AEBV0@@Z ??4AppSession@Session@Analytics@HP@@QEAAAEAV0123@$$QEAV0123@@Z ??4AppSession@Session@Analytics@HP@@QEAAAEAV0123@AEBV0123@@Z ??4BaseDataClass@DataClass@Analytics@HP@@QEAAAEAV0123@$$QEAV0123@@Z ??4BaseDataClass@DataClass@Analytics@HP@@QEAAAEAV0123@AEBV0123@@Z ??4ConsentObject@@QEAAAEAV0@$$QEAV0@@Z ??4ConsentObject@@QEAAAEAV0@AEBV0@@Z ??4DataClassFieldInfo@DataClass@Analytics@HP@@QEAAAEAV0123@$$QEAV0123@@Z ??4DataClassFieldInfo@DataClass@Analytics@HP@@QEAAAEAV0123@AEBV0123@@Z ??4PrivacyDocuments@@QEAAAEAV0@$$QEAV0@@Z ??4PrivacyDocuments@@QEAAAEAV0@AEBV0@@Z ??4ProcessingPermissions@@QEAAAEAV0@$$QEAV0@@Z ??4ProcessingPermissions@@QEAAAEAV0@AEBV0@@Z ??_7BaseDataClass@DataClass@Analytics@HP@@6B@ ?__autoclassinit2@AnalyticsSession@@QEAAX_K@Z

Name

.text

Size

178KB

Virtual Size

178KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

98KB

Virtual Size

98KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

10KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

170KB

Virtual Size

169KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

1.2MB

Virtual Size

1.8MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-08_5462c431a0e9cb602341f3723c968ebe_icedid_luca-stealer_njrat_stealc

api-ms-win-core-handle-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-security-base-l1-1-0

api-ms-win-core-heap-l2-1-0

api-ms-win-core-com-l1-1-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-processthreads-l1-1-1

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-security-lsalookup-l2-1-0

api-ms-win-core-kernel32-legacy-l1-1-0

api-ms-win-core-version-l1-1-1

api-ms-win-core-version-l1-1-0

oleaut32

api-ms-win-service-management-l2-1-0

api-ms-win-service-management-l1-1-0

api-ms-win-security-sddl-l1-1-0

api-ms-win-eventlog-legacy-l1-1-0

api-ms-win-service-core-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-service-winsvc-l1-1-0

api-ms-win-core-util-l1-1-0

api-ms-win-core-heap-l1-1-0

user32

hpaudioanalyticclientlib

wtsapi32

api-ms-win-core-debug-l1-1-0

api-ms-win-core-rtlsupport-l1-1-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-interlocked-l1-1-0

api-ms-win-core-file-l1-1-0

api-ms-win-core-realtime-l1-1-0

api-ms-win-core-registry-l1-1-0

api-ms-win-shell-shdirectory-l1-1-0

ext-ms-win-shell32-shellfolders-l1-1-0

api-ms-win-core-processenvironment-l1-1-0

api-ms-win-core-fibers-l1-1-0

api-ms-win-core-memory-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-console-l1-1-0

generic