2026-08-13_ef4077657e3bc3c722d84e07f51038c6_icedid_luca-stealer_njrat

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-13_ef4077657e3bc3c722d84e07f51038c6_icedid_luca-stealer_njrat
Size 181KB
Sample260813-jnpfssvbpd
SHA256 13edf08a1ee70c63d3e801b3d7e1cb6c497f14ffbcf83832969fd408ce78004e
MD5 ef4077657e3bc3c722d84e07f51038c6
SHA1 cad5cbb49b85547638962ce56eeddf19ff5041ad
SHA512 c7135afd0bd9d6a4af3ecfb3d6b5bee0f8254285062baafe0781c59ab72612b6e1381f3e429d0840d5c9ef7b0ead106ad03a8a075bf8e8050757ebae8248f563
SSDEEP 3072:cZvxpKYhwT2sYCkbypAtP0xek8ewuRTt9GANyVi0O1uCPT:UZAswTYVbypI4Xwfzmua
TLSH
T1E0046C59B2AA10F6E57A813DCE964619F273740007615BDF036047BAEF23BE99C3DB21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-13_ef4077657e3bc3c722d84e07f51038c6_icedid_luca-stealer_njrat

File Explorer

2026-08-13_ef4077657e3bc3c722d84e07f51038c6_icedid_luca-stealer_njrat

.exe 181KB

2026-08-13_ef4077657e3bc3c722d84e07f51038c6_icedid_luca-stealer_njrat

IMPHASH 610a622f6677305876b7d5009f927b7a
SHA256 13edf08a1ee70c63d3e801b3d7e1cb6c497f14ffbcf83832969fd408ce78004e
MD5 ef4077657e3bc3c722d84e07f51038c6
SHA1 cad5cbb49b85547638962ce56eeddf19ff5041ad
SHA512 c7135afd0bd9d6a4af3ecfb3d6b5bee0f8254285062baafe0781c59ab72612b6e1381f3e429d0840d5c9ef7b0ead106ad03a8a075bf8e8050757ebae8248f563
SSDEEP 3072:cZvxpKYhwT2sYCkbypAtP0xek8ewuRTt9GANyVi0O1uCPT:UZAswTYVbypI4Xwfzmua
TLSH
T1E0046C59B2AA10F6E57A813DCE964619F273740007615BDF036047BAEF23BE99C3DB21
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

95664

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

UCPDMgr.pdb

advapi32

OpenServiceA RegQueryValueExW RegOpenKeyExW RegSetValueExW ChangeServiceConfigA OpenSCManagerA QueryServiceConfigA CloseServiceHandle RegCloseKey

kernel32

GetModuleFileNameA CreateSemaphoreExW HeapFree SetLastError ReleaseSemaphore GetModuleHandleExW GetProductInfo WaitForThreadpoolTimerCallbacks WaitForSingleObject LocalAlloc GetCurrentThreadId GetVersionExW ReleaseMutex FormatMessageW GetLastError ReleaseSRWLockExclusive OutputDebugStringW CloseThreadpoolTimer AcquireSRWLockExclusive WaitForSingleObjectEx OpenSemaphoreW CloseHandle SetThreadpoolTimer CreateThreadpoolTimer HeapAlloc GetProcAddress CreateMutexExW LocalFree GetCurrentProcessId GetProcessHeap GetModuleHandleW FreeLibrary WideCharToMultiByte DebugBreak LoadLibraryExW IsDebuggerPresent RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent EnterCriticalSection LeaveCriticalSection DeleteCriticalSection GetStdHandle GetFileType GetStartupInfoW ExitProcess FlsAlloc FlsGetValue FlsSetValue FlsFree InitializeCriticalSectionEx GetSystemTimeAsFileTime VirtualProtect LCMapStringW IsValidCodePage GetACP GetOEMCP GetCPInfo GetStringTypeW MultiByteToWideChar SetFilePointerEx SetStdHandle FlushFileBuffers WriteFile GetConsoleOutputCP GetConsoleMode HeapSize HeapReAlloc RaiseException CreateFileW WriteConsoleW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA RtlPcToFileHeader EncodePointer RtlUnwindEx InitializeSListHead QueryPerformanceCounter SetEnvironmentVariableW

api-ms-win-core-featurestaging-l1-1-0

RecordFeatureUsage UnsubscribeFeatureStateChangeNotification SubscribeFeatureStateChangeNotification GetFeatureEnabledState

api-ms-win-crt-string-l1-1-0

memset

api-ms-win-crt-private-l1-1-0

_o___p__commode _o___std_exception_copy _o___std_exception_destroy _o__configure_narrow_argv _o__set_fmode _o__strnicoll _o_free

Name

.text

Size

123KB

Virtual Size

122KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

44KB

Virtual Size

44KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-13_ef4077657e3bc3c722d84e07f51038c6_icedid_luca-stealer_njrat

advapi32

kernel32

api-ms-win-core-featurestaging-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-private-l1-1-0

generic