2026-08-14_d2e7be34ed6072e5e4f0c892818b4b0c_icedid_luca-stealer_njrat_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-14_d2e7be34ed6072e5e4f0c892818b4b0c_icedid_luca-stealer_njrat_stealc
Size 20.2MB
Sample260815-cme3eadd23
SHA256 576ccafb4c108a10e5e87abd56637cd3db8408273081c5d02cbf63ec6d968e4d
MD5 d2e7be34ed6072e5e4f0c892818b4b0c
SHA1 12d0a9eb89821aa17eae7fd739c769492fede549
SHA512 a0b93ecb5333f4aa20aa3eb628fe998caf535ca64f6065b4dd0a067aed2beebe5e245e9e1b48349084a5d564aaca61eac2d8e155adc24936580a8f053a0c6dee
SSDEEP 393216:WETLG6QaAu5SVDMTNSG/lVrl3KYVSjgN6j2ifwsSY0g:UPvQ6yhpKYVSE8tWg
TLSH
T19E272352F3D86479D07151381B82C32BB272B44507A4C39B7BDA4436AFA6BF04F7AB91
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

vmprotect

Malware Config

Signatures

Detects executables packed with VMProtect. 1 IoCs

resource	yara_rule
sample	INDICATOR_EXE_Packed_VMProtect

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
sample	vmprotect

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-14_d2e7be34ed6072e5e4f0c892818b4b0c_icedid_luca-stealer_njrat_stealc

File Explorer

2026-08-14_d2e7be34ed6072e5e4f0c892818b4b0c_icedid_luca-stealer_njrat_stealc

.exe 20.2MB

2026-08-14_d2e7be34ed6072e5e4f0c892818b4b0c_icedid_luca-stealer_njrat_stealc

IMPHASH b9e7042c7f29f604031f057213826c28
SHA256 576ccafb4c108a10e5e87abd56637cd3db8408273081c5d02cbf63ec6d968e4d
MD5 d2e7be34ed6072e5e4f0c892818b4b0c
SHA1 12d0a9eb89821aa17eae7fd739c769492fede549
SHA512 a0b93ecb5333f4aa20aa3eb628fe998caf535ca64f6065b4dd0a067aed2beebe5e245e9e1b48349084a5d564aaca61eac2d8e155adc24936580a8f053a0c6dee
SSDEEP 393216:WETLG6QaAu5SVDMTNSG/lVrl3KYVSjgN6j2ifwsSY0g:UPvQ6yhpKYVSE8tWg
TLSH
T19E272352F3D86479D07151381B82C32BB272B44507A4C39B7BDA4436AFA6BF04F7AB91
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects executables packed with VMProtect.
VMProtect packed file

Detects executables packed with VMProtect commercial packer.

vmprotect
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

593060

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

bcrypt

BCryptOpenAlgorithmProvider BCryptCloseAlgorithmProvider BCryptCreateHash BCryptHashData BCryptFinishHash BCryptDestroyHash BCryptGenRandom BCryptSetProperty BCryptDestroyKey BCryptDecrypt BCryptGenerateSymmetricKey

winhttp

WinHttpConnect WinHttpCloseHandle WinHttpOpen WinHttpReadData WinHttpQueryDataAvailable WinHttpOpenRequest WinHttpSendRequest WinHttpReceiveResponse WinHttpQueryOption WinHttpQueryHeaders WinHttpWebSocketReceive WinHttpWebSocketSend WinHttpWebSocketCompleteUpgrade WinHttpSetTimeouts WinHttpSetOption

crypt32

CryptUnprotectData CryptEncodeObjectEx CertFreeCertificateContext CryptProtectData

d3d11

D3D11CreateDevice

d3dcompiler_47

D3DCompile

dcomp

DCompositionCreateDevice

advapi32

RegOpenKeyExW ConvertStringSecurityDescriptorToSecurityDescriptorW RegCloseKey CreateProcessWithTokenW OpenProcessToken GetTokenInformation DuplicateTokenEx RegQueryValueExW

kernel32

GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW VirtualProtect EnumSystemLocalesW FlushFileBuffers GetConsoleOutputCP GetConsoleMode ReadConsoleW FlsFree SetFilePointerEx FlsSetValue FlsGetValue HeapReAlloc FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCommandLineA GetCommandLineW CreateFileW GetFileSizeEx ReadFile CloseHandle GetCurrentProcess OpenProcess GetModuleFileNameW GetModuleHandleW GetProcAddress LocalFree MultiByteToWideChar GetTickCount64 GetLastError WaitForSingleObject CreateRemoteThread GetCurrentThreadId FlushInstructionCache VirtualAllocEx VirtualProtectEx ReadProcessMemory WriteProcessMemory VirtualFreeEx GetModuleFileNameA GetModuleHandleA LoadLibraryA WideCharToMultiByte CreateToolhelp32Snapshot Module32FirstW Module32NextW Sleep TerminateProcess CreateProcessW GetTickCount Process32FirstW Process32NextW SetLastError CreateFileMappingW MapViewOfFile UnmapViewOfFile CreateDirectoryW GetEnvironmentStringsW GetFileAttributesW WriteFile LoadResource LockResource SizeofResource FindResourceW RtlAddFunctionTable GetExitCodeProcess GlobalAlloc GlobalUnlock GlobalLock GlobalFree QueryPerformanceCounter QueryPerformanceFrequency FreeLibrary GetLocaleInfoA GetExitCodeThread OpenEventW GetProcessId GetCurrentThread GetThreadContext HeapAlloc HeapFree GetProcessHeap GetSystemFirmwareTable GetVolumeInformationW GetComputerNameExW ResetEvent CreateEventW CreateThread TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount RtlUnwindEx RaiseException RtlPcToFileHeader InitializeSListHead GetCurrentProcessId GetStartupInfoW IsDebuggerPresent IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext GetCPInfo GetStringTypeW LCMapStringEx DecodePointer EncodePointer DeleteCriticalSection LeaveCriticalSection EnterCriticalSection SleepConditionVariableSRW WakeAllConditionVariable GetSystemTimeAsFileTime FlsAlloc FreeEnvironmentStringsW SetStdHandle InitializeCriticalSectionEx GetFileType GetStdHandle ExitProcess GetModuleHandleExW HeapSize SetEndOfFile WriteConsoleW DeleteFileW FreeLibraryAndExitThread ExitThread LoadLibraryExW WaitForSingleObjectEx ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive TlsFree

user32

LoadCursorW ScreenToClient ClientToScreen GetCursorPos SetCursor SetCursorPos GetClientRect GetForegroundWindow IsWindowUnicode SetCapture GetCapture GetKeyState GetMessageExtraInfo TrackMouseEvent GetKeyboardLayout EmptyClipboard SetClipboardData CloseClipboard OpenClipboard SystemParametersInfoW LoadIconW UpdateWindow ReleaseCapture SetWindowPos ShowWindow DestroyWindow CreateWindowExW RegisterClassExW UnregisterClassW PostQuitMessage DefWindowProcW SendMessageW PeekMessageW DispatchMessageW TranslateMessage GetWindowThreadProcessId GetShellWindow MessageBoxW GetClipboardData

shell32

ShellExecuteExW CommandLineToArgvW SHGetKnownFolderPath ShellExecuteW

ole32

CoInitializeEx CoCreateInstance CoTaskMemFree

imm32

ImmSetCandidateWindow ImmGetContext ImmReleaseContext ImmSetCompositionWindow

Name

.text

Size

758KB

Virtual Size

760KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

500KB

Virtual Size

504KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

1.3MB

Virtual Size

1.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

31KB

Virtual Size

32KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.vmp0

Size

7.6MB

Virtual Size

7.6MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.text0

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.vmp1

Size

2.4MB

Virtual Size

2.4MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

7.6MB

Virtual Size

7.6MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-14_d2e7be34ed6072e5e4f0c892818b4b0c_icedid_luca-stealer_njrat_stealc

bcrypt

winhttp

crypt32

d3d11

d3dcompiler_47

dcomp

advapi32

kernel32

user32

shell32

ole32

imm32

generic