2026-08-08_d4a19dc8ea41d8b2954af64cf854bd0d_icedid_luca-stealer_njrat_remcos

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-08_d4a19dc8ea41d8b2954af64cf854bd0d_icedid_luca-stealer_njrat_remcos
Size 9.8MB
Sample260808-vramlavyaz
SHA256 7b6aeefc92e84da11c196a0ad219b51833f2a9486f153097aae3dd35b37d82b3
MD5 d4a19dc8ea41d8b2954af64cf854bd0d
SHA1 2b981f168cf347c1ce3e0742b6bec2f5b059b691
SHA512 3d8b8fca3e33352e80443054cceaee0cdfb9ba6c024ff900f62630d16d7c2d9b947a3914c45731fba47b4e9cbe238348e450d71fe1173e599f092e96595551ef
SSDEEP 98304:CczrpIfLTuy35F5E6sX8HvIYZFfnFzn3PMpmJBuBS/l71mcd0KTewHEhRhkf:6L6y3T5LsX8HrfFz3FbuBSd7+/EEhRQ
TLSH
T15AA69DF732C2769DC416C57A9792FC7F868F7135061AA9A3A05DE2766F2BC003219F09
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

themida

Malware Config

Signatures

Detects executables packed with Themida 1 IoCs

resource	yara_rule
sample	INDICATOR_EXE_Packed_Themida

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
sample	themida

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-08_d4a19dc8ea41d8b2954af64cf854bd0d_icedid_luca-stealer_njrat_remcos

File Explorer

2026-08-08_d4a19dc8ea41d8b2954af64cf854bd0d_icedid_luca-stealer_njrat_remcos

.exe 9.8MB

2026-08-08_d4a19dc8ea41d8b2954af64cf854bd0d_icedid_luca-stealer_njrat_remcos

SHA256 7b6aeefc92e84da11c196a0ad219b51833f2a9486f153097aae3dd35b37d82b3
MD5 d4a19dc8ea41d8b2954af64cf854bd0d
SHA1 2b981f168cf347c1ce3e0742b6bec2f5b059b691
SHA512 3d8b8fca3e33352e80443054cceaee0cdfb9ba6c024ff900f62630d16d7c2d9b947a3914c45731fba47b4e9cbe238348e450d71fe1173e599f092e96595551ef
SSDEEP 98304:CczrpIfLTuy35F5E6sX8HvIYZFfnFzn3PMpmJBuBS/l71mcd0KTewHEhRhkf:6L6y3T5LsX8HrfFz3FbuBSd7+/EEhRQ
TLSH
T15AA69DF732C2769DC416C57A9792FC7F868F7135061AA9A3A05DE2766F2BC003219F09
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects executables packed with Themida
Themida packer

Detects Themida, an advanced Windows software protection system.

themida
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

6648160

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Name

Size

182KB

Virtual Size

184KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

Size

76KB

Virtual Size

80KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

Size

3KB

Virtual Size

24KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

Size

9KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

Size

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

Size

88KB

Virtual Size

88KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

Size

2KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.idata

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

87KB

Virtual Size

88KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.themida

Size

5.9MB

Virtual Size

5.9MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.boot

Size

3.5MB

Virtual Size

3.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-08_d4a19dc8ea41d8b2954af64cf854bd0d_icedid_luca-stealer_njrat_remcos

generic