2026-08-10_e3beb36bbe1ce5ecaff33bdab52fc007_icedid_luca-stealer_njrat_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-10_e3beb36bbe1ce5ecaff33bdab52fc007_icedid_luca-stealer_njrat_stealc
Size 2.5MB
Sample260810-eekzsszhqc
SHA256 3bfdbad16ddf47e2e9d303294c9f6de90eb90f6856bc0126e27bc1bd30e4e884
MD5 e3beb36bbe1ce5ecaff33bdab52fc007
SHA1 67b5c746d4cb24288a94fe38bbb9f34cb23b93d4
SHA512 e88f5573f0b8c298607b4bc61a20c2986c8e8a20dbdd9ce37d68ce7fcfbf0d57bb21c62e0f7e5f86e70c6cbbe78d1e28e8a0e78204fd8d99851c0fa6aace12ee
SSDEEP 49152:Rj/e9ISmwvGvNNDbSEeP0jsNO1kC7VyJ7OoVPwk:Fe9BroiWmF
TLSH
T1EBC5499522A801ADE076C47C89858C57E9FB7C0D173979FB0164B9581F3FAEA4A38F12
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

2026-08-10_e3beb36bbe1ce5ecaff33bdab52fc007_icedid_luca-stealer_njrat_stealc

.exe 2.5MB

2026-08-10_e3beb36bbe1ce5ecaff33bdab52fc007_icedid_luca-stealer_njrat_stealc

IMPHASH 0185f1f1e877303b88d8070a583d044a
SHA256 3bfdbad16ddf47e2e9d303294c9f6de90eb90f6856bc0126e27bc1bd30e4e884
MD5 e3beb36bbe1ce5ecaff33bdab52fc007
SHA1 67b5c746d4cb24288a94fe38bbb9f34cb23b93d4
SHA512 e88f5573f0b8c298607b4bc61a20c2986c8e8a20dbdd9ce37d68ce7fcfbf0d57bb21c62e0f7e5f86e70c6cbbe78d1e28e8a0e78204fd8d99851c0fa6aace12ee
SSDEEP 49152:Rj/e9ISmwvGvNNDbSEeP0jsNO1kC7VyJ7OoVPwk:Fe9BroiWmF
TLSH
T1EBC5499522A801ADE076C47C89858C57E9FB7C0D173979FB0164B9581F3FAEA4A38F12
MD5 SHA1 SHA512 SSDEEP TLSH

Digest

dd:b2:9b:12:a3:34:9e:31:c6:f6:7d:0f:9b:dd:b1:40:dd:92:a1:8e:62:17:09:2f:18:e2:c0:b2:33:f1:68:47

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=000681038,CN=Bitsum Technologies (Bitsum LLC),O=Bitsum Technologies (Bitsum LLC),L=Morristown,ST=Tennessee,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130954656e6e6573736565,1.3.6.1.4.1.311.60.2.1.3=#13025553

Chains

Jul 31, 2026

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

Serial Number

08:c1:a2:26:80:ab:e5:ed:39:c3:d6:76:63:fe:27:15

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jan 12, 2025 - Mar 28, 2028

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

1635012

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\dev\projs\ProcessSupervisor\output\ProcessLasso.pdb

comctl32

ImageList_Remove ord17 ImageList_Destroy ord412 ImageList_ReplaceIcon InitCommonControlsEx ord410 ord413 ImageList_Create

gdiplus

GdipCreateBitmapFromHBITMAP GdipDeletePath GdipGetPenColor GdipDisposeImage GdipBitmapSetPixel GdipAlloc GdipDeleteBrush GdipCloneImage GdipGetImageHeight GdiplusShutdown GdiplusStartup GdipSetSmoothingMode GdipCreatePath GdipSetInterpolationMode GdipCreateSolidFill GdipFillPath GdipSetPenDashStyle GdipAddPathLineI GdipSetPixelOffsetMode GdipClosePathFigure GdipFree GdipCreateFromHDC GdipBitmapGetPixel GdipDrawImageRectI GdipDrawCurve2I GdipCloneBrush GdipFillRectangleI GdipDeleteGraphics GdipGetImageWidth GdipDeletePen GdipCreateBitmapFromScan0 GdipCreatePen1 GdipDrawLineI GdipAddPathCurve2I GdipGetPenFillType GdipSetTextRenderingHint

version

VerQueryValueW GetFileVersionInfoW GetFileVersionInfoSizeW

kernel32

CompareFileTime EnterCriticalSection GetCommandLineW GetCurrentProcess WriteFile WaitForMultipleObjects LeaveCriticalSection InitializeCriticalSection SetFilePointer GetFileAttributesW OpenEventW ReleaseMutex GetSystemDirectoryW FindFirstChangeNotificationW OpenProcess CreateEventW MultiByteToWideChar ProcessIdToSessionId Sleep SetEvent FileTimeToSystemTime TerminateThread GetActiveProcessorGroupCount FindCloseChangeNotification GlobalAlloc DeleteFileW CloseHandle GetSystemInfo CreateThread ResetEvent FileTimeToLocalFileTime GetCurrentDirectoryW FindNextChangeNotification GlobalLock MoveFileExW GetFileSize GetCurrentProcessId SystemTimeToFileTime GlobalMemoryStatusEx CreateProcessW SetThreadExecutionState CopyFileW IsBadReadPtr OpenMutexW GlobalUnlock GetProcessTimes WideCharToMultiByte CreateMutexW FindFirstFileW GetFileSizeEx FindNextFileW GetUserDefaultLocaleName FindClose GetTimeZoneInformation GetComputerNameW TerminateProcess LoadLibraryW FreeLibrary SetThreadPriority ExitThread GetCurrentThread SetThreadPriorityBoost InitializeCriticalSectionAndSpinCount CreateDirectoryW SetPriorityClass SetProcessShutdownParameters GetVersionExW GetTickCount64 SetUnhandledExceptionFilter CreateToolhelp32Snapshot Process32NextW Process32FirstW QueryFullProcessImageNameW QueryPerformanceFrequency ReadFile GetStartupInfoW GetExitCodeProcess GetFileTime GetSystemTimeAsFileTime VerifyVersionInfoW WriteConsoleW GetConsoleMode GetConsoleOutputCP GetLastError VerSetConditionMask FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetOEMCP GetACP IsValidCodePage FindFirstFileExW SetFilePointerEx EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW FlsFree FlsSetValue FlsGetValue FlsAlloc GetFileType GetStdHandle GetModuleHandleExW FreeLibraryAndExitThread TlsFree TlsSetValue TlsGetValue TlsAlloc RtlPcToFileHeader RtlUnwindEx InitializeSListHead IsProcessorFeaturePresent UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext RaiseException OutputDebugStringW IsDebuggerPresent GetCPInfo CompareStringEx SleepConditionVariableSRW WakeAllConditionVariable LCMapStringEx GetLocaleInfoEx EncodePointer WaitForSingleObjectEx GetStringTypeW TryAcquireSRWLockExclusive AcquireSRWLockExclusive ReleaseSRWLockExclusive GetExitCodeThread SuspendThread GetCurrentThreadId LocalUnlock LocalLock LocalAlloc MulDiv GetTimeFormatW GetDateFormatW GetNumaNodeProcessorMask K32GetModuleBaseNameW SetEndOfFile FlushFileBuffers GetTickCount ResumeThread GetProcessPriorityBoost ExitProcess FindResourceW LoadResource FindResourceExW LockResource CreateFileW WaitForSingleObject SizeofResource QueryPerformanceCounter GetModuleHandleW GetProcessHeap DeleteCriticalSection GetProcAddress HeapDestroy DecodePointer HeapAlloc SetEnvironmentVariableW HeapReAlloc HeapSize InitializeCriticalSectionEx SetStdHandle HeapFree GetThreadPriority RemoveDirectoryW MoveFileW GetVolumeNameForVolumeMountPointW WinExec SetLastError GetModuleFileNameW GetUserDefaultUILanguage IsBadWritePtr GetNumaHighestNodeNumber GetActiveProcessorCount GetLogicalProcessorInformationEx LocalFileTimeToFileTime SetFileTime GetLocalTime GetFileInformationByHandle UnmapViewOfFile SetProcessWorkingSetSize GetPriorityClass SetProcessPriorityBoost GetProcessGroupAffinity GetProcessAffinityMask Thread32Next SetThreadGroupAffinity OpenThread Thread32First SetProcessAffinityMask LocalFree VirtualProtect LoadLibraryExW CompareStringOrdinal

user32

GetForegroundWindow GetWindowThreadProcessId GetWindow EnumWindows EnableWindow FrameRect GetDesktopWindow IsWindow DialogBoxParamW KillTimer GetDlgItem GetMenuBarInfo GetClassNameW SetPropW OffsetRect UpdateWindow LoadStringW IsWindowEnabled IntersectRect GetWindowInfo WaitMessage IsDialogMessageW PeekMessageW CreateDialogIndirectParamW WinHelpW MoveWindow GetSystemMenu GetDialogBaseUnits DrawIcon MessageBeep GetLastActivePopup GetActiveWindow SetRect GetDlgItemTextW SetDlgItemTextW SetTimer ShowWindow GetWindowLongPtrW GetMessagePos GetClassLongPtrW GetMessageW LoadAcceleratorsW DispatchMessageW TranslateAcceleratorW TranslateMessage GetWindowTextLengthW IsDlgButtonChecked GetDlgItemInt SetDlgItemInt SetDlgItemTextA CheckDlgButton GetWindowLongW GetKeyState CallWindowProcW GetSystemMetrics GetDlgCtrlID MapWindowPoints GetClipboardData SetWindowLongW GetSysColorBrush GetParent PtInRect GetWindowTextW GetMenuItemInfoW DefWindowProcW LoadMenuW CheckMenuRadioItem GetWindowRect GetMenuItemID GetMenu DestroyWindow GetDC IsWindowVisible SetWindowPos GetMenuItemCount FillRect CreateWindowExW DeleteMenu ScreenToClient CreatePopupMenu SetClassLongPtrW RegisterClassExW TrackPopupMenu GetSubMenu GetClassInfoW GetAsyncKeyState OpenClipboard RedrawWindow DestroyIcon SetWindowTextW ClientToScreen CloseClipboard SetMenuItemInfoW EmptyClipboard IsChild TrackMouseEvent GetSysColor LoadBitmapW DestroyMenu SetFocus LoadIconW FindWindowW LoadCursorW DrawMenuBar InsertMenuW SetClipboardData wsprintfW CheckMenuItem GetClientRect AppendMenuW DrawTextW PostQuitMessage EnableMenuItem SystemParametersInfoW RegisterWindowMessageW SetForegroundWindow LoadImageW InvalidateRect IsIconic ReleaseDC GetCursorPos BeginPaint EndPaint PostMessageW MessageBoxW SetWindowLongPtrW SendMessageW EndDialog EnumChildWindows

gdi32

BitBlt CreateCompatibleBitmap SelectObject CreateCompatibleDC GetStockObject CreateRoundRectRgn GetTextMetricsW DeleteDC TextOutW GetTextExtentPoint32W SetBkMode DeleteObject CreateFontIndirectW FillRgn SetTextColor SetBkColor CreateSolidBrush Ellipse GetObjectW D3DKMTGetProcessSchedulingPriorityClass D3DKMTSetProcessSchedulingPriorityClass CreateBitmap CreateDCW

comdlg32

ChooseColorW GetSaveFileNameW GetOpenFileNameW

advapi32

RegDeleteValueW InitiateSystemShutdownExW GetUserNameW RegOpenKeyExW InitializeSecurityDescriptor RegSetValueExW RegEnumKeyExW RegCreateKeyExW RegQueryInfoKeyW EnumServicesStatusExW ControlService QueryServiceStatus QueryServiceConfigW RegDeleteKeyW ChangeServiceConfigW StartServiceW CloseServiceHandle OpenServiceW OpenSCManagerW GetSidSubAuthority GetSidSubAuthorityCount RegEnumValueW LookupAccountSidW GetTokenInformation RegCloseKey LookupPrivilegeValueW AdjustTokenPrivileges OpenProcessToken SetSecurityDescriptorDacl RegQueryValueExW

shell32

ShellExecuteExW SHGetStockIconInfo SHQueryUserNotificationState SHGetKnownFolderPath SHGetFolderPathW SHGetSpecialFolderPathW ord178 SHCreateDirectoryExW ExtractAssociatedIconW Shell_NotifyIconW ShellExecuteW

ole32

CoInitializeEx CoInitializeSecurity CoInitialize CoCreateInstance CoUninitialize IIDFromString StringFromGUID2 CoTaskMemFree

oleaut32

SysFreeString SysAllocString VariantInit VariantClear

pdh

PdhRemoveCounter PdhCollectQueryData PdhGetFormattedCounterValue PdhAddEnglishCounterW PdhCloseQuery PdhOpenQueryW

wtsapi32

WTSQuerySessionInformationW WTSFreeMemory

shlwapi

AssocQueryStringW SHDeleteKeyW

dbghelp

MiniDumpWriteDump

uxtheme

GetThemeColor CloseThemeData DrawThemeBackground DrawThemeText SetWindowTheme IsThemeActive OpenThemeData

dwmapi

DwmSetWindowAttribute

dxgi

CreateDXGIFactory CreateDXGIFactory1

rpcrt4

UuidFromStringW UuidCreate

wininet

InternetCanonicalizeUrlW InternetOpenW InternetReadFile InternetOpenUrlW InternetCloseHandle

Name

.text

Size

1.8MB

Virtual Size

1.8MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

333KB

Virtual Size

332KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

25KB

Virtual Size

50KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

52KB

Virtual Size

52KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

249KB

Virtual Size

248KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-10_e3beb36bbe1ce5ecaff33bdab52fc007_icedid_luca-stealer_njrat_stealc

comctl32

gdiplus

version

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ole32

oleaut32

pdh

wtsapi32

shlwapi

dbghelp

uxtheme

dwmapi

dxgi

rpcrt4

wininet

generic