2026-08-11_22972055a640a554f2a7692296daa3bb_icedid_luca-stealer_njrat_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-11_22972055a640a554f2a7692296daa3bb_icedid_luca-stealer_njrat_stealc
Size 1.2MB
Sample260812-af98vsfl71
SHA256 953cf105e135a17c8dd0bd695d448ea02757027bd6f38efeda91de4488df8912
MD5 22972055a640a554f2a7692296daa3bb
SHA1 446a1e34397aab9a0d0769d173ac41c3066dbacb
SHA512 acbfc964522091efa8ac82390b8a5c9ff9e7b06c7c73d0824b7c4786bc78e8a1043fac603944a5980bcdd36aa8501664717cb102c17ff0133bf956b90b1c7486
SSDEEP 24576:NIrXckfDzHGCH5oWQDAYxx9SftjUUEgbui:NgckfDzHGCHyWQnJSlwFgbj
TLSH
T14C459F1BA6BC42F9E0BBC179C646580BEBB2744A1334E59F03E08A565F375209F7E712
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

2026-08-11_22972055a640a554f2a7692296daa3bb_icedid_luca-stealer_njrat_stealc

.exe 1.2MB

2026-08-11_22972055a640a554f2a7692296daa3bb_icedid_luca-stealer_njrat_stealc

IMPHASH ff255ff8e8c87d76bb2323ef0ff6c694
SHA256 953cf105e135a17c8dd0bd695d448ea02757027bd6f38efeda91de4488df8912
MD5 22972055a640a554f2a7692296daa3bb
SHA1 446a1e34397aab9a0d0769d173ac41c3066dbacb
SHA512 acbfc964522091efa8ac82390b8a5c9ff9e7b06c7c73d0824b7c4786bc78e8a1043fac603944a5980bcdd36aa8501664717cb102c17ff0133bf956b90b1c7486
SSDEEP 24576:NIrXckfDzHGCH5oWQDAYxx9SftjUUEgbui:NgckfDzHGCHyWQnJSlwFgbj
TLSH
T14C459F1BA6BC42F9E0BBC179C646580BEBB2744A1334E59F03E08A565F375209F7E712
MD5 SHA1 SHA512 SSDEEP TLSH

Digest

cf:31:09:ea:2a:e3:a5:87:92:6f:74:97:f0:ff:48:95:27:3e:59:e0:c5:ed:10:46:b3:38:9b:15:9a:11:35:a8

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=P16000097897,CN=MIKOM INC,O=MIKOM INC,L=Hallandale Beach,ST=Florida,C=US,1.3.6.1.4.1.311.60.2.1.3=#13025553,1.3.6.1.4.1.311.60.2.1.2=#1307466c6f72696461,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

Aug 4, 2026

CN=SSL.com EV Code Signing Intermediate CA ECC R2,O=SSL Corp,L=Houston,ST=Texas,C=US

CN=SSL.com EV Root Certification Authority ECC,O=SSL Corporation,L=Houston,ST=Texas,C=US

Subject

CN=SSL.com EV Code Signing Intermediate CA ECC R2,O=SSL Corp,L=Houston,ST=Texas,C=US

Serial Number

6e:dd:4f:25:e7:31:7d:39:81:57:31:34:cf:c1:dc:a0

Issuer

CN=SSL.com EV Root Certification Authority ECC,O=SSL Corporation,L=Houston,ST=Texas,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 7, 2019 - Mar 3, 2034

Subject

Serial Number

6e:86:59:a0:d8:20:c0:ca:66:03:8f:3a:77:26:fc:79

Issuer

CN=SSL.com EV Code Signing Intermediate CA ECC R2,O=SSL Corp,L=Houston,ST=Texas,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Sep 16, 2025 - Sep 15, 2028

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Minor OS version

Major OS version

Entry point

660144

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\MyProjects\Elizabeth3\out\setup_x64.pdb

kernel32

HeapDestroy HeapAlloc HeapFree HeapReAlloc HeapSize GetProcessHeap ConnectNamedPipe CreateNamedPipeW CreateThreadpoolTimer CreateThreadpoolIo ReleaseSRWLockShared AcquireSRWLockShared GetTickCount64 GetSystemTimeAsFileTime CreateToolhelp32Snapshot Process32FirstW lstrcmpiW OpenProcess GetProcessTimes Process32NextW GetModuleHandleW GetCommandLineW WaitForSingleObject FormatMessageW SetEnvironmentVariableW FreeEnvironmentStringsW lstrlenW GetSystemDirectoryW GetWindowsDirectoryW GetTempPathW OpenMutexW GetFileSizeEx CreateMutexW GetEnvironmentStringsW CreateJobObjectW CreateIoCompletionPort SetInformationJobObject CreateProcessW AssignProcessToJobObject ResumeThread GetQueuedCompletionStatus GetExitCodeProcess CloseThreadpoolWait SetThreadpoolWait CreateThreadpoolWait GetSystemTime CallbackMayRunLong OutputDebugStringW IsDebuggerPresent GetModuleFileNameA CreateSemaphoreExW ReleaseSemaphore GetModuleHandleExW InitializeCriticalSectionEx ReleaseMutex WaitForSingleObjectEx OpenSemaphoreW GetSystemInfo DecodePointer CreateMutexExW DeleteCriticalSection WideCharToMultiByte DebugBreak GetEnvironmentVariableW WaitForThreadpoolWaitCallbacks SetCurrentDirectoryW GetModuleFileNameW VirtualProtect AddAtomW WriteConsoleW GetConsoleMode GetConsoleOutputCP FlushFileBuffers SetStdHandle GetCommandLineA GetOEMCP GetACP IsValidCodePage SetFilePointerEx WaitNamedPipeW GetFileType EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW FlsFree FlsSetValue FlsGetValue FlsAlloc GetStdHandle ExitProcess FreeLibraryAndExitThread ExitThread CreateThread TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount InterlockedPushEntrySList RtlUnwindEx LocalAlloc InitializeSListHead IsProcessorFeaturePresent GetStartupInfoW SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext GetCPInfo CompareStringEx TryAcquireSRWLockExclusive LCMapStringEx LeaveCriticalSection EnterCriticalSection EncodePointer GetExitCodeThread GetStringTypeW RaiseException RtlPcToFileHeader GetLocaleInfoEx LocalFree FormatMessageA AreFileApisANSI CancelIoEx ReadFile CancelThreadpoolIo StartThreadpoolIo WriteFile CloseThreadpoolIo SetFileCompletionNotificationModes WaitForThreadpoolTimerCallbacks LoadLibraryW SetNamedPipeHandleState SetThreadpoolTimer TrySubmitThreadpoolCallback CloseThreadpoolTimer SetLastError GetDriveTypeW GetCurrentThreadId AcquireSRWLockExclusive ReleaseSRWLockExclusive SleepConditionVariableSRW WakeConditionVariable LoadLibraryExW Sleep CopyFileW MultiByteToWideChar CloseHandle GetCurrentProcessId CreateFileW GetVersionExW FindClose FindNextFileW SetFileAttributesW GetFileAttributesW SetFileAttributesTransactedW GetFileAttributesTransactedW FindFirstFileExW FindFirstFileTransactedW CreateHardLinkW CreateHardLinkTransactedW CopyFileExW CopyFileTransactedW DeleteFileW DeleteFileTransactedW RemoveDirectoryW QueryPerformanceCounter WakeAllConditionVariable SetFilePointer IsWow64Process SetFileTime RemoveDirectoryTransactedW GetLastError CreateDirectoryW CreateDirectoryTransactedW TerminateProcess FreeLibrary GetCurrentProcess GetProcAddress GetTimeZoneInformation

user32

GetDC DialogBoxParamW SetWindowLongPtrW ScreenToClient ExitWindowsEx MessageBoxW InvalidateRect SetScrollInfo MonitorFromWindow GetClientRect GetMessagePos ReleaseDC GetSystemMetrics DestroyIcon PostMessageW SetDlgItemTextW GetWindowTextLengthW GetWindowLongW DestroyWindow GetWindowTextW SendDlgItemMessageW MapDialogRect SetWindowPos KillTimer CreateWindowExW GetScrollInfo SetCapture SetFocus EndDialog RegisterWindowMessageW SetWindowTextW GetDlgItem EnableWindow SendMessageW GetWindowLongPtrW SetTimer IsDlgButtonChecked EnumChildWindows RealGetWindowClassW IsWindowEnabled RedrawWindow GetSysColor IsDialogMessageW DefWindowProcW DispatchMessageW TranslateMessage GetMessageW GetClassInfoExW RegisterClassExW CreateDialogParamW SetWindowsHookExW UnhookWindowsHookEx CallNextHookEx DeferWindowPos DrawTextW GetClassNameW GetPropW PostQuitMessage GetParent ClientToScreen BeginDeferWindowPos EndDeferWindowPos ShowWindow GetWindowRect SetWindowLongW PostThreadMessageW SystemParametersInfoW SetPropW BeginPaint EndPaint RemovePropW GetCursorPos SetCursor LoadCursorW ReleaseCapture

gdi32

SetTextColor GetCurrentObject SelectObject CreateFontIndirectW DeleteObject GetDeviceCaps ExtTextOutW SetBkColor CreateSolidBrush

advapi32

GetSecurityDescriptorSacl RegCreateKeyExW RegCreateKeyTransactedW RegSetValueExW RegQueryValueExW RegOpenKeyExW RegOpenKeyTransactedW GetSidLengthRequired InitializeSid GetSidSubAuthority RegDeleteValueW RegDeleteTreeW RegDeleteKeyTransactedW RegDeleteKeyW RegGetValueW AdjustTokenPrivileges LookupPrivilegeValueW OpenProcessToken InitializeSecurityDescriptor MakeAbsoluteSD GetSecurityDescriptorControl RegCloseKey SetSecurityDescriptorDacl GetSecurityDescriptorDacl GetSecurityDescriptorGroup GetSecurityDescriptorOwner GetAclInformation AddAce InitializeAcl IsValidSid GetLengthSid CopySid

shell32

ShellExecuteExW ord680 SHChangeNotify SHCreateItemFromParsingName SHGetFolderPathW ShellExecuteW

ole32

CoCreateInstance CoInitialize CoUninitialize CoTaskMemFree CoInitializeEx StringFromGUID2

oleaut32

SysStringLen GetErrorInfo SetErrorInfo SysFreeString

rpcrt4

UuidCreate

dwrite

DWriteCreateFactory

d2d1

ord1

xmllite

CreateXmlReader

psapi

GetModuleFileNameExW

gdiplus

GdipCreateBitmapFromScan0 GdipGetImageGraphicsContext GdipDeleteGraphics GdipCreateHICONFromBitmap GdipGetDC GdiplusStartup GdiplusShutdown GdipReleaseDC GdipDisposeImage

shlwapi

PathGetCharTypeW PathIsNetworkPathW SHCreateStreamOnFileEx

comctl32

ImageList_ReplaceIcon ImageList_Destroy ord410 ord413 InitCommonControlsEx ImageList_Create

uxtheme

GetThemePartSize DrawThemeBackground OpenThemeData CloseThemeData SetWindowTheme GetThemeColor

ktmw32

CommitTransaction RollbackTransaction CreateTransaction

dbghelp

MiniDumpWriteDump

rstrtmgr

RmEndSession RmStartSession RmRegisterResources RmRestart RmShutdown RmGetList

dwmapi

DwmSetWindowAttribute

api-ms-win-core-winrt-error-l1-1-1

RoOriginateLanguageException

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory

Name

.text

Size

935KB

Virtual Size

935KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

194KB

Virtual Size

194KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

11KB

Virtual Size

48KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

38KB

Virtual Size

37KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

34KB

Virtual Size

34KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-11_22972055a640a554f2a7692296daa3bb_icedid_luca-stealer_njrat_stealc

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

rpcrt4

dwrite

d2d1

xmllite

psapi

gdiplus

shlwapi

comctl32

uxtheme

ktmw32

dbghelp

rstrtmgr

dwmapi

api-ms-win-core-winrt-error-l1-1-1

api-ms-win-core-winrt-l1-1-0

generic