2026-08-15_adfe1ac203d06d867398507103e2cc03_icedid_luca-stealer_njrat_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-15_adfe1ac203d06d867398507103e2cc03_icedid_luca-stealer_njrat_stealc
Size 1.8MB
Sample260815-2cb1favbmd
SHA256 6ccbbcef087ab7626ae1a3485f07704334088b8a1709e828b5d1f58ae8a2622b
MD5 adfe1ac203d06d867398507103e2cc03
SHA1 ef8ce179de020ca7f02bcd4edc819ab16c785342
SHA512 32123b199f653d97459da0911e4b7652530b8d4c14a66cc07b259c0b764746b5e63e68b9dbd50980f4e9571e7c8de117991f481abf1defc5b7103c87799ccd86
SSDEEP 24576:TfZ1Egqm0g9b6fcCjuYqtgmvCVeMZihbnOHt7s/F638Eu/xPHEatpm:TfZag7L9b6feYqUyhbnQsEr
TLSH
T1A2859D87B3EA8599D037A478CB42550BE6727424077082EB7FD51A5A9FBF5E0CB3A700
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-15_adfe1ac203d06d867398507103e2cc03_icedid_luca-stealer_njrat_stealc

File Explorer

2026-08-15_adfe1ac203d06d867398507103e2cc03_icedid_luca-stealer_njrat_stealc

.exe 1.8MB

2026-08-15_adfe1ac203d06d867398507103e2cc03_icedid_luca-stealer_njrat_stealc

IMPHASH 2801c79ffc86c0b3541bc114c051abcc
SHA256 6ccbbcef087ab7626ae1a3485f07704334088b8a1709e828b5d1f58ae8a2622b
MD5 adfe1ac203d06d867398507103e2cc03
SHA1 ef8ce179de020ca7f02bcd4edc819ab16c785342
SHA512 32123b199f653d97459da0911e4b7652530b8d4c14a66cc07b259c0b764746b5e63e68b9dbd50980f4e9571e7c8de117991f481abf1defc5b7103c87799ccd86
SSDEEP 24576:TfZ1Egqm0g9b6fcCjuYqtgmvCVeMZihbnOHt7s/F638Eu/xPHEatpm:TfZag7L9b6feYqUyhbnQsEr
TLSH
T1A2859D87B3EA8599D037A478CB42550BE6727424077082EB7FD51A5A9FBF5E0CB3A700
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

694820

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\-\Desktop\Source\x64\Release\upx_fivem.pdb

d3d11

D3D11CreateDeviceAndSwapChain

d3dcompiler_47

D3DCompile

kernel32

GetCommandLineA GetLastError GetStartupInfoA MultiByteToWideChar GlobalAlloc GlobalFree GlobalLock WideCharToMultiByte GlobalUnlock GetLocaleInfoA QueryPerformanceFrequency QueryPerformanceCounter GetModuleFileNameA CreateMutexA ReleaseMutex GetConsoleWindow SetUnhandledExceptionFilter WriteConsoleW HeapSize SetStdHandle GetProcessHeap SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP GetACP IsValidCodePage HeapReAlloc ReadConsoleW EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW VirtualProtect FlsFree FlsSetValue FlsGetValue FlsAlloc GetModuleHandleA GetConsoleOutputCP FlushFileBuffers GetTimeZoneInformation SetFilePointerEx GetFileSizeEx GetFileType HeapAlloc HeapFree GetCommandLineW WriteFile GetStdHandle ReadFile GetModuleHandleExW FreeLibraryAndExitThread ExitThread CreateThread LoadLibraryExW TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount SetLastError RaiseException RtlPcToFileHeader RtlUnwindEx InitializeSListHead OutputDebugStringA VirtualFreeEx CreateRemoteThread VirtualAllocEx Sleep Process32Next K32GetModuleFileNameExA Module32First Module32Next Process32First VirtualQueryEx FreeLibrary CreateProcessW ReadProcessMemory ExitProcess LocalFree GetProcAddress GetSystemInfo CloseHandle Process32FirstW LoadLibraryA Process32NextW CreateToolhelp32Snapshot OpenProcess GetModuleFileNameW GetCurrentProcessId GetStartupInfoW IsDebuggerPresent IsProcessorFeaturePresent TerminateProcess UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext GetCPInfo WakeAllConditionVariable LCMapStringEx DecodePointer EncodePointer RtlUnwind GetCurrentProcess WriteProcessMemory SetEndOfFile GetConsoleMode DeleteCriticalSection LeaveCriticalSection EnterCriticalSection ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive GetCurrentThreadId SleepConditionVariableSRW FormatMessageA GetLocaleInfoEx CreateDirectoryW CreateFileW FindClose FindFirstFileW FindFirstFileExW FindNextFileW GetFileAttributesW GetFileAttributesExW SetFileInformationByHandle GetTempPathW AreFileApisANSI GetModuleHandleW MoveFileExW GetFileInformationByHandleEx GetStringTypeW InitOnceComplete InitOnceBeginInitialize InitializeCriticalSectionEx GetSystemTimeAsFileTime

user32

SetForegroundWindow UpdateWindow FindWindowA PostQuitMessage SendInput AppendMenuW SystemParametersInfoA LoadIconA SetCursor TranslateMessage GetCursorPos GetAsyncKeyState GetForegroundWindow GetWindowLongPtrA EmptyClipboard SetLayeredWindowAttributes GetWindowThreadProcessId GetKeyState GetMessageExtraInfo ScreenToClient GetCapture ClientToScreen TrackMouseEvent GetKeyboardLayout SetCapture GetClientRect IsWindowUnicode ReleaseCapture SetCursorPos OpenClipboard CloseClipboard DestroyMenu GetClipboardData SetClipboardData DispatchMessageA GetWindowRect LoadCursorA DestroyWindow PostMessageA CallNextHookEx UnregisterClassW CreatePopupMenu RegisterClassExW TrackPopupMenu ShowWindow SetWindowLongA SetWindowsHookExA PeekMessageW SetWindowDisplayAffinity MessageBoxA MoveWindow UnhookWindowsHookEx DefWindowProcA SetFocus

advapi32

AdjustTokenPrivileges QueryServiceStatusEx OpenServiceW RegDeleteValueW ConvertSidToStringSidW GetTokenInformation RegOpenKeyExW RevertToSelf CreateProcessAsUserA PrivilegeCheck SetTokenInformation LookupPrivilegeValueA SetThreadToken DuplicateTokenEx LookupPrivilegeValueW OpenProcessToken RegCloseKey CloseServiceHandle OpenSCManagerW RegEnumValueW

shell32

SHGetFolderPathW Shell_NotifyIconW ShellExecuteA SHEmptyRecycleBinW

ole32

CoInitializeEx

d3dx9_43

D3DXMatrixTranspose

ntdll

ZwWriteVirtualMemory ZwReadVirtualMemory

wevtapi

EvtClose EvtOpenLog EvtClearLog

imm32

ImmReleaseContext ImmGetContext ImmSetCandidateWindow ImmSetCompositionWindow

dwmapi

DwmExtendFrameIntoClientArea

Name

.text

Size

904KB

Virtual Size

904KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

201KB

Virtual Size

200KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

648KB

Virtual Size

663KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

36KB

Virtual Size

35KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

488B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-15_adfe1ac203d06d867398507103e2cc03_icedid_luca-stealer_njrat_stealc

d3d11

d3dcompiler_47

kernel32

user32

advapi32

shell32

ole32

d3dx9_43

ntdll

wevtapi

imm32

dwmapi

generic