2026-08-14_a0b794685345a738a135ea77ae1701d8_icedid_luca-stealer_njrat_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-14_a0b794685345a738a135ea77ae1701d8_icedid_luca-stealer_njrat_stealc
Size 3.0MB
Sample260814-d7p9jsbr71
SHA256 94796fca278528c0cd3f22af9b84a1da2b562d562f5a8c9be3509371b0e0707b
MD5 a0b794685345a738a135ea77ae1701d8
SHA1 4f3c6416cdd4735b1ab7c9f2eaeaa75ce8970224
SHA512 bea216ef14f3bbffc2191138e3628071f58f95b8b7cbf3cf2f0312ed0d28d335d17539f737f50a86dcd33800b74438e0773b6cf64ebaf709a9ed46bfa3142a35
SSDEEP 49152:CdzU8NvYklcN5Hso5g9rJMLlIb2HyV9pbpqrBpn:cNvYkONRN5g8JIb2M9pbAv
TLSH
T10AE51209B79184F9D8AB427889634945E7337C59AB60EBCF0B90BEA62F373D05D39701
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-14_a0b794685345a738a135ea77ae1701d8_icedid_luca-stealer_njrat_stealc

File Explorer

2026-08-14_a0b794685345a738a135ea77ae1701d8_icedid_luca-stealer_njrat_stealc

.exe 3.0MB

2026-08-14_a0b794685345a738a135ea77ae1701d8_icedid_luca-stealer_njrat_stealc

IMPHASH a1866c463ff105804638c9f9f6ec1330
SHA256 94796fca278528c0cd3f22af9b84a1da2b562d562f5a8c9be3509371b0e0707b
MD5 a0b794685345a738a135ea77ae1701d8
SHA1 4f3c6416cdd4735b1ab7c9f2eaeaa75ce8970224
SHA512 bea216ef14f3bbffc2191138e3628071f58f95b8b7cbf3cf2f0312ed0d28d335d17539f737f50a86dcd33800b74438e0773b6cf64ebaf709a9ed46bfa3142a35
SSDEEP 49152:CdzU8NvYklcN5Hso5g9rJMLlIb2HyV9pbpqrBpn:cNvYkONRN5g8JIb2M9pbAv
TLSH
T10AE51209B79184F9D8AB427889634945E7337C59AB60EBCF0B90BEA62F373D05D39701
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

67056

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

bcrypt

BCryptDecrypt BCryptSetProperty BCryptCloseAlgorithmProvider BCryptGenerateSymmetricKey BCryptDestroyKey BCryptOpenAlgorithmProvider

advapi32

RegQueryValueExW RegOpenKeyExW RegCloseKey GetUserNameW RegSetValueExW

ole32

CoInitializeEx CoUninitialize

oleaut32

SysFreeString SafeArrayCreate SafeArrayDestroy SafeArrayAccessData SafeArrayUnaccessData VariantClear VariantInit SafeArrayPutElement SysAllocString

user32

wsprintfA LoadIconW LoadCursorW FillRect GetClientRect SetWindowTextW EndPaint BeginPaint ReleaseDC GetDC UpdateWindow DrawTextW KillTimer SetTimer CreateWindowExW RegisterClassExW PostQuitMessage DefWindowProcW SendMessageW ShowWindow TranslateMessage GetMessageW GetWindowThreadProcessId EnumWindows MessageBoxW MessageBoxA GetWindowTextW RedrawWindow InvalidateRect GetSystemMetrics IsWindowVisible SetWindowPos DispatchMessageW

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

gdi32

CreateCompatibleDC CreateCompatibleBitmap BitBlt SetTextColor SetBkMode SelectObject GetStockObject GetDeviceCaps DeleteObject DeleteDC CreateSolidBrush CreateFontW

shell32

DragFinish SHGetFolderPathW ShellExecuteW DragQueryFileW

winmm

PlaySoundW waveOutGetNumDevs timeGetTime timeBeginPeriod timeEndPeriod

crypt32

CertCloseStore CertFreeCertificateContext CertOpenStore

imm32

ImmReleaseContext ImmGetContext

kernel32

InitializeCriticalSectionEx FlsFree FlsSetValue FlsGetValue FlsAlloc FreeEnvironmentStringsW GetEnvironmentStringsW WideCharToMultiByte GetCPInfo GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW FindClose GetFileType HeapAlloc HeapFree GetCommandLineA GetStdHandle ExitProcess LoadLibraryExW FreeLibrary TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount DeleteCriticalSection EncodePointer SetLastError RtlUnwindEx RaiseException RtlPcToFileHeader CompareStringW LCMapStringW GetProcessHeap SetStdHandle GetStringTypeW HeapSize InitializeSListHead QueryPerformanceCounter GetStartupInfoW SleepConditionVariableSRW WakeAllConditionVariable AcquireSRWLockExclusive ReleaseSRWLockExclusive IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind HeapReAlloc GetConsoleOutputCP GetConsoleMode WriteConsoleW GetModuleHandleExW InitializeCriticalSection GetCommandLineW GetEnvironmentVariableA GetEnvironmentVariableW SetEnvironmentVariableA SetEnvironmentVariableW CreateFileW DeleteFileW FlushFileBuffers GetFileSizeEx ReadFile SetFileAttributesW SetFilePointer SetFilePointerEx WriteFile GetTempPathW IsDebuggerPresent CheckRemoteDebuggerPresent CloseHandle SetHandleInformation GetLastError CreatePipe EnterCriticalSection LeaveCriticalSection WaitForSingleObject Sleep GetCurrentProcess GetCurrentProcessId TerminateProcess GetExitCodeProcess CreateThread GetCurrentThread GetCurrentThreadId OpenThread SuspendThread CreateProcessW GetThreadContext OpenProcess GetSystemTimeAsFileTime GetLocalTime GetTickCount64 GetSystemDirectoryW VirtualProtect MapViewOfFile FlushViewOfFile UnmapViewOfFile GetModuleFileNameW GetModuleHandleA GetModuleHandleW GetProcAddress LoadResource LockResource SizeofResource FindResourceW LoadLibraryA LoadLibraryW CreateFileMappingA OpenFileMappingA QueryFullProcessImageNameW MoveFileExW MultiByteToWideChar CreateToolhelp32Snapshot Process32FirstW Process32NextW Thread32First Thread32Next RtlCaptureContext RtlLookupFunctionEntry

Name

.text

Size

159KB

Virtual Size

159KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

72KB

Virtual Size

71KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

8KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fpcfg

Size

512B

Virtual Size

10B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.fptkt

Size

512B

Virtual Size

24B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.fppair

Size

512B

Virtual Size

24B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.fppoly

Size

512B

Virtual Size

72B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.falcon

Size

512B

Virtual Size

32B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tweaks

Size

512B

Virtual Size

32B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

2.7MB

Virtual Size

2.7MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-14_a0b794685345a738a135ea77ae1701d8_icedid_luca-stealer_njrat_stealc

bcrypt

advapi32

ole32

oleaut32

user32

version

gdi32

shell32

winmm

crypt32

imm32

kernel32

generic