2026-08-12_d0d1893a29e3b647edc7e5ec22dbe543_icedid_luca-stealer_njrat_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-12_d0d1893a29e3b647edc7e5ec22dbe543_icedid_luca-stealer_njrat_stealc
Size 20.2MB
Sample260812-e1ed5svyfs
SHA256 5501599c28459a80a155b88c4a4675d54a75a2c8b3b2b04be494b440ea0c5a46
MD5 d0d1893a29e3b647edc7e5ec22dbe543
SHA1 1c7ec81914deeb621063f5031247539fbcce6b91
SHA512 636029e63658fad738a3c38916cb2eb44d839b2cf0510be84fc83abf7ac11af26f589680bbcf5a780e045bce3cf74ca8d536f7fa6a202e69777ac5a68109300d
SSDEEP 393216:FETAgSMTNSG/lVrl3KExL3JzATzC8WfehGRPigN6j2ifwsSY0g:bgDhpKOxkyh8tWg
TLSH
T13C272352F7D56479D03260385B82C32B7671B40407A1C39B7BDA4876AFA2BF04F76B92
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

vmprotect

Malware Config

Signatures

Detects executables packed with VMProtect. 1 IoCs

resource	yara_rule
sample	INDICATOR_EXE_Packed_VMProtect

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
sample	vmprotect

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-12_d0d1893a29e3b647edc7e5ec22dbe543_icedid_luca-stealer_njrat_stealc

File Explorer

2026-08-12_d0d1893a29e3b647edc7e5ec22dbe543_icedid_luca-stealer_njrat_stealc

.exe 20.2MB

2026-08-12_d0d1893a29e3b647edc7e5ec22dbe543_icedid_luca-stealer_njrat_stealc

IMPHASH 43b4470f4ff512d1ab214fb33200cb7d
SHA256 5501599c28459a80a155b88c4a4675d54a75a2c8b3b2b04be494b440ea0c5a46
MD5 d0d1893a29e3b647edc7e5ec22dbe543
SHA1 1c7ec81914deeb621063f5031247539fbcce6b91
SHA512 636029e63658fad738a3c38916cb2eb44d839b2cf0510be84fc83abf7ac11af26f589680bbcf5a780e045bce3cf74ca8d536f7fa6a202e69777ac5a68109300d
SSDEEP 393216:FETAgSMTNSG/lVrl3KExL3JzATzC8WfehGRPigN6j2ifwsSY0g:bgDhpKOxkyh8tWg
TLSH
T13C272352F7D56479D03260385B82C32B7671B40407A1C39B7BDA4876AFA2BF04F76B92
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects executables packed with VMProtect.
VMProtect packed file

Detects executables packed with VMProtect commercial packer.

vmprotect
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

591956

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

bcrypt

BCryptOpenAlgorithmProvider BCryptCloseAlgorithmProvider BCryptCreateHash BCryptHashData BCryptFinishHash BCryptDestroyHash BCryptGenRandom BCryptSetProperty BCryptDestroyKey BCryptDecrypt BCryptGenerateSymmetricKey

winhttp

WinHttpConnect WinHttpCloseHandle WinHttpOpen WinHttpReadData WinHttpQueryDataAvailable WinHttpOpenRequest WinHttpSendRequest WinHttpReceiveResponse WinHttpQueryOption WinHttpQueryHeaders WinHttpWebSocketReceive WinHttpWebSocketSend WinHttpWebSocketCompleteUpgrade WinHttpSetTimeouts WinHttpSetOption

crypt32

CryptUnprotectData CryptEncodeObjectEx CertFreeCertificateContext CryptProtectData

d3d11

D3D11CreateDevice

d3dcompiler_47

D3DCompile

dcomp

DCompositionCreateDevice

advapi32

RegOpenKeyExW ConvertStringSecurityDescriptorToSecurityDescriptorW RegCloseKey CreateProcessWithTokenW OpenProcessToken GetTokenInformation DuplicateTokenEx RegQueryValueExW

kernel32

GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW VirtualProtect EnumSystemLocalesW FlushFileBuffers GetConsoleOutputCP GetConsoleMode ReadConsoleW FlsFree SetFilePointerEx FlsSetValue FlsGetValue HeapReAlloc FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCommandLineA GetCommandLineW CreateFileW GetFileSizeEx ReadFile CloseHandle GetCurrentProcess OpenProcess GetModuleFileNameW GetModuleHandleW GetProcAddress LocalFree MultiByteToWideChar GetTickCount64 GetLastError WaitForSingleObject CreateRemoteThread GetCurrentThreadId FlushInstructionCache VirtualAllocEx VirtualProtectEx ReadProcessMemory WriteProcessMemory VirtualFreeEx GetModuleFileNameA GetModuleHandleA LoadLibraryA WideCharToMultiByte CreateToolhelp32Snapshot Module32FirstW Module32NextW Sleep CreateProcessW GetTickCount Process32FirstW Process32NextW SetLastError CreateFileMappingW MapViewOfFile UnmapViewOfFile CreateDirectoryW DeleteFileW GetEnvironmentStringsW WriteFile LoadResource LockResource SizeofResource FindResourceW RtlAddFunctionTable GetExitCodeProcess GlobalAlloc GlobalUnlock GlobalLock GlobalFree QueryPerformanceCounter QueryPerformanceFrequency FreeLibrary GetLocaleInfoA GetExitCodeThread OpenEventW TerminateProcess GetProcessId GetCurrentThread GetThreadContext HeapAlloc HeapFree GetProcessHeap GetSystemFirmwareTable GetVolumeInformationW GetComputerNameExW ResetEvent CreateEventW CreateThread TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount RtlUnwindEx RaiseException RtlPcToFileHeader InitializeSListHead GetCurrentProcessId GetStartupInfoW IsDebuggerPresent IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext GetCPInfo GetStringTypeW LCMapStringEx DecodePointer EncodePointer DeleteCriticalSection LeaveCriticalSection EnterCriticalSection SleepConditionVariableSRW WakeAllConditionVariable GetSystemTimeAsFileTime FlsAlloc FreeEnvironmentStringsW SetStdHandle InitializeCriticalSectionEx GetFileType GetStdHandle ExitProcess GetModuleHandleExW HeapSize SetEndOfFile WriteConsoleW GetFileAttributesW FreeLibraryAndExitThread ExitThread LoadLibraryExW WaitForSingleObjectEx ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive TlsFree

user32

LoadCursorW ScreenToClient ClientToScreen GetCursorPos SetCursor SetCursorPos GetClientRect GetForegroundWindow IsWindowUnicode SetCapture GetCapture GetKeyState GetMessageExtraInfo TrackMouseEvent GetKeyboardLayout EmptyClipboard SetClipboardData CloseClipboard OpenClipboard SystemParametersInfoW LoadIconW UpdateWindow ReleaseCapture SetWindowPos ShowWindow DestroyWindow CreateWindowExW RegisterClassExW UnregisterClassW PostQuitMessage DefWindowProcW SendMessageW PeekMessageW DispatchMessageW TranslateMessage GetWindowThreadProcessId GetShellWindow MessageBoxW GetClipboardData

shell32

ShellExecuteExW CommandLineToArgvW SHGetKnownFolderPath ShellExecuteW

ole32

CoInitializeEx CoCreateInstance CoTaskMemFree

imm32

ImmSetCandidateWindow ImmGetContext ImmReleaseContext ImmSetCompositionWindow

Name

.text

Size

757KB

Virtual Size

760KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

500KB

Virtual Size

504KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

1.3MB

Virtual Size

1.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

31KB

Virtual Size

32KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.vmp0

Size

7.6MB

Virtual Size

7.6MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.text0

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.vmp1

Size

2.4MB

Virtual Size

2.4MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

7.6MB

Virtual Size

7.6MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-12_d0d1893a29e3b647edc7e5ec22dbe543_icedid_luca-stealer_njrat_stealc

bcrypt

winhttp

crypt32

d3d11

d3dcompiler_47

dcomp

advapi32

kernel32

user32

shell32

ole32

imm32

generic