2026-08-13_b8fabf35c54c20089cb068389bbbd863_icedid_luca-stealer_njrat_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-13_b8fabf35c54c20089cb068389bbbd863_icedid_luca-stealer_njrat_stealc
Size 1.9MB
Sample260813-pg217sygrf
SHA256 ba2af54c3e1968bfc4b14fbf0b8c03421f01a8ceef8bea3b4c5bb7b71aa0336f
MD5 b8fabf35c54c20089cb068389bbbd863
SHA1 e0161848dec299432ab3aeba41ebf607bf1b7528
SHA512 08879187ceaa3f01c5e46ac6df3cb4e7a0e32f7bd06aa44640d4a7447654e954e413aad768b1cd644877ebfbf4575888a638c07b965920862915de6ee91a6f15
SSDEEP 24576:s42ypCOZbL0rVLv3dVD2F1rsCr8y8dO1dmK3BIJ8A2bJ5Q+:srsCOlorVL1VDGrT8c1iRIJ5Q
TLSH
T140951932E29C26ACD0A2D179EE869C52DA31748D03717FFB01915E921F9BDE04B7E352
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-13_b8fabf35c54c20089cb068389bbbd863_icedid_luca-stealer_njrat_stealc

File Explorer

2026-08-13_b8fabf35c54c20089cb068389bbbd863_icedid_luca-stealer_njrat_stealc

.exe 1.9MB

2026-08-13_b8fabf35c54c20089cb068389bbbd863_icedid_luca-stealer_njrat_stealc

IMPHASH 1b29eadf1bc8864a21b08b9477c4ef69
SHA256 ba2af54c3e1968bfc4b14fbf0b8c03421f01a8ceef8bea3b4c5bb7b71aa0336f
MD5 b8fabf35c54c20089cb068389bbbd863
SHA1 e0161848dec299432ab3aeba41ebf607bf1b7528
SHA512 08879187ceaa3f01c5e46ac6df3cb4e7a0e32f7bd06aa44640d4a7447654e954e413aad768b1cd644877ebfbf4575888a638c07b965920862915de6ee91a6f15
SSDEEP 24576:s42ypCOZbL0rVLv3dVD2F1rsCr8y8dO1dmK3BIJ8A2bJ5Q+:srsCOlorVL1VDGrT8c1iRIJ5Q
TLSH
T140951932E29C26ACD0A2D179EE869C52DA31748D03717FFB01915E921F9BDE04B7E352
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1324856

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

ws2_32

connect ioctlsocket recv send setsockopt shutdown socket WSAStartup WSACleanup WSAGetLastError WSAPoll getaddrinfo closesocket freeaddrinfo

ole32

CoUninitialize CoInitializeEx CoSetProxyBlanket CoCreateInstance CreateStreamOnHGlobal

oleaut32

SysAllocString SysFreeString VariantClear SysAllocStringByteLen SafeArrayGetUBound SafeArrayGetLBound SafeArrayGetElement VariantInit SysStringByteLen

gdiplus

GdipGetImageEncoders GdipGetImageEncodersSize GdipCreateBitmapFromHBITMAP GdipSaveImageToStream GdipAlloc GdipFree GdiplusStartup GdipCloneImage GdipDisposeImage

kernel32

ExitThread CreateThread LoadLibraryExW TlsFree TlsSetValue CloseHandle GetLastError ReleaseMutex CreateMutexA GetCurrentProcessId ExitProcess TerminateProcess OpenProcess GetModuleHandleA GetProcAddress GetDiskFreeSpaceExA GetDriveTypeA GlobalMemoryStatusEx GetSystemInfo GetTickCount64 GetComputerNameA CreateToolhelp32Snapshot Process32FirstW Process32NextW GetEnvironmentVariableA CreateFileA DeleteFileA FindClose FindFirstFileA FindNextFileA GetFileSizeEx ReadFile WriteFile FreeLibrary LoadLibraryExA LoadLibraryA GetLocalTime GetNativeSystemInfo LoadLibraryW LocalFree Sleep GetTickCount GetModuleFileNameW GlobalAlloc GlobalUnlock GlobalLock GetModuleHandleW CreateDirectoryW GetTempPathW WideCharToMultiByte GetTempPathA SetHandleInformation CreatePipe WaitForSingleObject GetCurrentProcess CreateProcessA GetModuleFileNameA GetEnvironmentStringsW FreeEnvironmentStringsW GetPhysicallyInstalledSystemMemory GlobalFree GetComputerNameW GetTimeZoneInformation GetLocaleInfoEx FreeLibraryAndExitThread K32GetProcessMemoryInfo TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount SetLastError RtlUnwindEx InitializeSListHead GetStartupInfoW SetUnhandledExceptionFilter UnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext GetStringTypeW GetSystemTimeAsFileTime GetCPInfo GetStdHandle HeapAlloc HeapFree FlsAlloc FlsGetValue FlsSetValue FlsFree VirtualProtect GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetFileType FlushFileBuffers GetConsoleOutputCP GetConsoleMode SetFilePointerEx ReadConsoleW HeapReAlloc CompareStringEx LCMapStringEx DecodePointer EncodePointer AreFileApisANSI SetFileInformationByHandle GetFinalPathNameByHandleW DeleteCriticalSection InitializeCriticalSectionEx IsValidCodePage GetACP LeaveCriticalSection EnterCriticalSection GetExitCodeThread WaitForSingleObjectEx IsProcessorFeaturePresent GetModuleHandleExW CloseThreadpoolWork SubmitThreadpoolWork CreateThreadpoolWork FreeLibraryWhenCallbackReturns InitOnceComplete InitOnceBeginInitialize WakeAllConditionVariable GetCurrentThreadId SleepConditionVariableSRW TryAcquireSRWLockExclusive AcquireSRWLockExclusive ReleaseSRWLockExclusive QueryPerformanceFrequency QueryPerformanceCounter GetOEMCP GetCommandLineA GetCommandLineW SetEnvironmentVariableW GetProcessHeap SetStdHandle HeapSize WriteConsoleW SetEndOfFile GetUserDefaultLocaleName RtlUnwind RaiseException RtlPcToFileHeader MultiByteToWideChar GetFileInformationByHandleEx FormatMessageA CreateFileW FindFirstFileW FindFirstFileExW FindNextFileW GetFileAttributesExW GetFileInformationByHandle CopyFileW

user32

ExitWindowsEx GetClipboardData RegisterClipboardFormatA MessageBoxA SystemParametersInfoA SendMessageW IsWindow DestroyWindow GetDC CloseClipboard OpenClipboard SetClipboardData wsprintfA GetSystemMetrics EmptyClipboard ReleaseDC EnumDisplayDevicesW EnumDisplaySettingsW GetDesktopWindow

advapi32

CryptAcquireContextW RegCloseKey RegOpenKeyExA RegQueryValueExA OpenProcessToken AdjustTokenPrivileges LookupPrivilegeValueW InitiateSystemShutdownExA RegSetValueExA GetTokenInformation GetUserNameW RegEnumKeyExW RegEnumValueW CryptDestroyHash CryptHashData CryptCreateHash CryptGetHashParam CryptReleaseContext GetUserNameA ConvertSidToStringSidW CredFree CredEnumerateA RegQueryValueExW RegOpenKeyExW

shell32

SHGetFolderPathA ShellExecuteA DragQueryFileW

mfplat

MFStartup

avicap32

capCreateCaptureWindowA

wininet

InternetOpenUrlA InternetCloseHandle InternetOpenA InternetReadFile

winhttp

WinHttpQueryHeaders WinHttpReceiveResponse WinHttpSendRequest WinHttpAddRequestHeaders WinHttpOpenRequest WinHttpCrackUrl WinHttpOpen WinHttpCloseHandle WinHttpConnect WinHttpReadData WinHttpQueryDataAvailable WinHttpSetTimeouts

bcrypt

BCryptOpenAlgorithmProvider BCryptDestroyKey BCryptEncrypt BCryptGenerateSymmetricKey BCryptGenRandom BCryptSetProperty BCryptCloseAlgorithmProvider

gdi32

BitBlt CreateCompatibleBitmap CreateCompatibleDC DeleteDC DeleteObject SelectObject SetDIBits

iphlpapi

GetAdaptersInfo

Name

.text

Size

1.5MB

Virtual Size

1.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

290KB

Virtual Size

290KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

21KB

Virtual Size

28KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

51KB

Virtual Size

51KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-13_b8fabf35c54c20089cb068389bbbd863_icedid_luca-stealer_njrat_stealc

ws2_32

ole32

oleaut32

gdiplus

kernel32

user32

advapi32

shell32

mfplat

avicap32

wininet

winhttp

bcrypt

gdi32

iphlpapi

generic