2026-08-09_3bd476dcda4495e92bc9c3f17b8c1eb4_icedid_luca-stealer_njrat_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-09_3bd476dcda4495e92bc9c3f17b8c1eb4_icedid_luca-stealer_njrat_stealc
Size 4.0MB
Sample260809-vhc2csan3z
SHA256 81933ff9a8b7fd6a07371fbe383104d30627891f8807cd7e5668e535165ab683
MD5 3bd476dcda4495e92bc9c3f17b8c1eb4
SHA1 94f9d57234e944ee17e7c68f96d11c62a76de85d
SHA512 fd79bae8734d0f351af9ccf865b2d06847ad97d1e8b1ccee7989bde099355c1958d8e2a16ec56bccb279629a368d15324d84155e2c30e73f07280410a6f5e701
SSDEEP 49152:qQ719w1cnbdrr7w4lZPLsseVsVkIET9Fh65Cvwxt7Uv+MnIIC:qxc5/ZlZPOn4GGMnI
TLSH
T1F316C41263FA0399F1F39B789A7A56128973BC699B31D6CF0298515D0F33AD08974B33
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-09_3bd476dcda4495e92bc9c3f17b8c1eb4_icedid_luca-stealer_njrat_stealc

File Explorer

2026-08-09_3bd476dcda4495e92bc9c3f17b8c1eb4_icedid_luca-stealer_njrat_stealc

.exe 4.0MB

2026-08-09_3bd476dcda4495e92bc9c3f17b8c1eb4_icedid_luca-stealer_njrat_stealc

IMPHASH 7c7ae818487558b13b985d709c6c403e
SHA256 81933ff9a8b7fd6a07371fbe383104d30627891f8807cd7e5668e535165ab683
MD5 3bd476dcda4495e92bc9c3f17b8c1eb4
SHA1 94f9d57234e944ee17e7c68f96d11c62a76de85d
SHA512 fd79bae8734d0f351af9ccf865b2d06847ad97d1e8b1ccee7989bde099355c1958d8e2a16ec56bccb279629a368d15324d84155e2c30e73f07280410a6f5e701
SSDEEP 49152:qQ719w1cnbdrr7w4lZPLsseVsVkIET9Fh65Cvwxt7Uv+MnIIC:qxc5/ZlZPOn4GGMnI
TLSH
T1F316C41263FA0399F1F39B789A7A56128973BC699B31D6CF0298515D0F33AD08974B33
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1057856

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\__w\1\s\bin\x64\Release\wslhost.pdb

ws2_32

ioctlsocket setsockopt WSAGetLastError WSAGetOverlappedResult WSASend bind listen WSAIoctl WSASocketW shutdown InetNtopW WSAStartup WSARecv closesocket

kernel32

GetCurrentProcess GetCurrentThread InitializeProcThreadAttributeList DeleteProcThreadAttributeList GetDynamicTimeZoneInformation GetUserDefaultGeoName AllocConsole AttachConsole SetConsoleTitleW GetPackagesByPackageFamily GetUserPreferredUILanguages ReadFile WriteFile CreatePipe GetStdHandle DeleteFileW GetFileSizeEx GetFileType SetEndOfFile SetFilePointer CancelSynchronousIo CreateMutexW ExitProcess SetThreadDescription GetWindowsDirectoryW GetLogicalProcessorInformationEx CreateJobObjectW AssignProcessToJobObject SetInformationJobObject FreeLibrary LoadLibraryW GetConsoleMode SetConsoleCtrlHandler FlushConsoleInputBuffer GetCurrentPackageId GetPackageFamilyName K32EnumProcesses GetEnvironmentStringsW FreeEnvironmentStringsW TerminateProcess GetExitCodeProcess ReadProcessMemory CreatePseudoConsole ResizePseudoConsole ClosePseudoConsole CompareStringOrdinal MultiByteToWideChar CreateDirectoryW FindClose WaitForMultipleObjects FindNextFileW GetDriveTypeW GetFileAttributesW GetFinalPathNameByHandleW GetFullPathNameW GetLogicalDrives GetTempFileNameW RemoveDirectoryW SetFileAttributesW SetFileInformationByHandle GetTempPathW GetComputerNameExA FindStringOrdinal LocalAlloc CopyFileW GetFileInformationByHandleEx UpdateProcThreadAttribute RaiseException WriteConsoleW GetConsoleScreenBufferInfo SetConsoleCursorPosition ResetEvent SetFilePointerEx EnterCriticalSection LeaveCriticalSection SetProcessMitigationPolicy GetFileInformationByHandle GetFileAttributesExW GetDiskFreeSpaceExW FindFirstFileExW GetCurrentDirectoryW SetCurrentDirectoryW GetLocaleInfoEx WakeAllConditionVariable WakeConditionVariable GetTickCount64 CreateEventW SetEnvironmentVariableW GetCommandLineA GetTimeZoneInformation HeapSize GetConsoleOutputCP FlushFileBuffers GetOEMCP GetACP IsValidCodePage ReadConsoleW PeekConsoleInputA CancelIoEx GetOverlappedResult CreateNamedPipeW ConnectNamedPipe SetHandleInformation DuplicateHandle CreateFileW DeviceIoControl K32GetModuleFileNameExW LocalFree GetModuleFileNameW GetSystemDirectoryW CreateEventExW SetEvent GetCommandLineW WideCharToMultiByte FormatMessageW GetProcAddress GetModuleHandleExW GetModuleHandleW GetModuleFileNameA GetCurrentThreadId GetCurrentProcessId CreateSemaphoreExW CreateMutexExW OpenSemaphoreW WaitForSingleObjectEx WaitForSingleObject ReleaseMutex ReleaseSemaphore DeleteCriticalSection InitializeCriticalSectionEx GetProcessHeap HeapFree HeapAlloc SetLastError GetLastError CloseHandle DecodePointer OutputDebugStringW DebugBreak IsDebuggerPresent SetFileTime AreFileApisANSI FindFirstFileW SleepConditionVariableSRW TryAcquireSRWLockShared TryAcquireSRWLockExclusive AcquireSRWLockShared AcquireSRWLockExclusive ReleaseSRWLockShared ReleaseSRWLockExclusive QueryPerformanceFrequency QueryPerformanceCounter GetNativeSystemInfo GetExitCodeThread SwitchToThread Sleep FormatMessageA InitOnceComplete InitOnceBeginInitialize ReadConsoleInputW GetNumberOfConsoleInputEvents SetConsoleMode HeapReAlloc EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW VirtualProtect IsThreadAFiber FlsFree FlsSetValue FlsGetValue FlsAlloc SetStdHandle GetConsoleCP FreeLibraryAndExitThread ResumeThread ExitThread CreateThread LoadLibraryExW TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount InterlockedFlushSList InterlockedPushEntrySList InitializeSListHead GetStartupInfoW IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter GetCPInfo CompareStringEx CloseThreadpoolWait SetThreadpoolWait CreateThreadpoolWait GetStringTypeW CreateDirectoryExW MoveFileExW CreateHardLinkW CreateSymbolicLinkW EncodePointer LCMapStringEx CloseThreadpoolTimer WaitForThreadpoolTimerCallbacks SetThreadpoolTimer CreateThreadpoolTimer FreeLibraryWhenCallbackReturns GetSystemTimeAsFileTime GetCurrentProcessorNumber FlushProcessWriteBuffers InitOnceExecuteOnce

user32

UnregisterClassW

shell32

CommandLineToArgvW ShellExecuteW SHGetKnownFolderPath

ole32

CoTaskMemFree CoTaskMemAlloc CoCreateGuid CoImpersonateClient CoReleaseServerProcess CoAddRefServerProcess CoInitializeSecurity CoGetCallContext CoCreateInstance CoRevokeClassObject CoCreateFreeThreadedMarshaler CoRegisterClassObject CoInitializeEx CoUninitialize CoRevertToSelf

advapi32

CloseServiceHandle LookupPrivilegeValueW SetTokenInformation SetSecurityDescriptorOwner InitializeSecurityDescriptor GetTokenInformation GetSidSubAuthorityCount GetSidSubAuthority GetLengthSid DuplicateTokenEx CreateRestrictedToken CheckTokenMembership OpenProcessToken CreateProcessAsUserW AdjustTokenPrivileges RegDeleteTreeW RegSetKeyValueW RegDeleteKeyValueW RegSetValueExW RegQueryInfoKeyW RegEnumValueW RegEnumKeyExW RegDeleteValueW RegCreateKeyExW ConvertSidToStringSidW CryptDestroyHash CryptHashData CryptCreateHash CryptGetHashParam CryptReleaseContext CryptAcquireContextW RegGetValueW RegOpenKeyExW RegOpenCurrentUser ReportEventW OpenServiceW OpenSCManagerW OpenThreadToken SetThreadToken EventSetInformation EventUnregister EventRegister EventWriteTransfer RegCloseKey

userenv

GetUserProfileDirectoryW DestroyEnvironmentBlock CreateEnvironmentBlock

api-ms-win-core-winrt-l1-1-0

RoActivateInstance RoGetActivationFactory

api-ms-win-core-winrt-string-l1-1-0

WindowsCreateStringReference

api-ms-win-core-path-l1-1-0

PathCchRemoveFileSpec PathCchSkipRoot PathAllocCombine

ntdll

ZwSetEaFile NtQueryDirectoryFile ZwQueryEaFile NtSetInformationFile NtQueryInformationFile RtlInitUnicodeString NtSetInformationThread NtQueryInformationThread NtDeviceIoControlFile NtCreateFile RtlIpv6StringToAddressW NtCancelIoFileEx RtlIpv6AddressToStringW RtlIpv4AddressToStringW RtlIpv6AddressToStringA RtlIpv4AddressToStringA NtQueryInformationProcess ZwQueryKey NtCreateNamedPipeFile NtOpenFile RtlInitializeSidEx NtClose NtWaitForSingleObject ZwCreateEvent NtReadFile NtWriteFile RtlPcToFileHeader RtlCaptureContext RtlLookupFunctionEntry RtlUnwindEx RtlVirtualUnwind RtlUnwind RtlIpv4StringToAddressW

rpcrt4

RpcRevertToSelf RpcImpersonateClient

mswsock

AcceptEx

shlwapi

PathUnquoteSpacesW

bcrypt

BCryptCreateHash BCryptDestroyHash BCryptFinishHash BCryptHashData

icu

u_UCharsToChars u_errorName ucal_getTimeZoneIDForWindowsID

wintrust

WinVerifyTrust

msi

ord169 ord88 ord16 ord137 ord141

api-ms-win-core-winrt-error-l1-1-1

RoOriginateLanguageException

oleaut32

SysFreeString GetErrorInfo SysStringLen SetErrorInfo

Name

.text

Size

1.6MB

Virtual Size

1.6MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.6MB

Virtual Size

1.6MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

67KB

Virtual Size

84KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

78KB

Virtual Size

77KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

65KB

Virtual Size

64KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

580KB

Virtual Size

584KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-09_3bd476dcda4495e92bc9c3f17b8c1eb4_icedid_luca-stealer_njrat_stealc

ws2_32

kernel32

user32

shell32

ole32

advapi32

userenv

api-ms-win-core-winrt-l1-1-0

api-ms-win-core-winrt-string-l1-1-0

api-ms-win-core-path-l1-1-0

ntdll

rpcrt4

mswsock

shlwapi

bcrypt

icu

wintrust

msi

api-ms-win-core-winrt-error-l1-1-1

oleaut32

generic