2026-08-15_bdc4f5d75108e3d7c129ea24e265fae7_icedid_luca-stealer_njrat_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-15_bdc4f5d75108e3d7c129ea24e265fae7_icedid_luca-stealer_njrat_stealc
Size 2.2MB
Sample260815-dv2rtayvht
SHA256 82d25f3c8fe4eb9f7c17a1e5d4d13bd7fd86719f581d93b9c8a77ba4e091f78c
MD5 bdc4f5d75108e3d7c129ea24e265fae7
SHA1 80ad5277efef0309e2473213608fb21e79a67ef3
SHA512 a1b5425303552a6275aeaba0f2aa02fd25e1e10a88b2612c2f50c71c16eebb59df52f339cf8cf061ad72a582b961e257314861cc093913e6a1b1a3f2872e6fa4
SSDEEP 49152:hOBFqp+i31Gb2XNL5CgVLNiXicJFFRGNzj3:Oq1obcNVC47wRGpj3
TLSH
T15BB5C212DEEE0E9FD09FB039844E4C03A9ED7894433185EBDE535E15BBD669309292E3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-15_bdc4f5d75108e3d7c129ea24e265fae7_icedid_luca-stealer_njrat_stealc

File Explorer

2026-08-15_bdc4f5d75108e3d7c129ea24e265fae7_icedid_luca-stealer_njrat_stealc

.exe 2.2MB

2026-08-15_bdc4f5d75108e3d7c129ea24e265fae7_icedid_luca-stealer_njrat_stealc

IMPHASH f690848b94a70b7ca4997f9545091386
SHA256 82d25f3c8fe4eb9f7c17a1e5d4d13bd7fd86719f581d93b9c8a77ba4e091f78c
MD5 bdc4f5d75108e3d7c129ea24e265fae7
SHA1 80ad5277efef0309e2473213608fb21e79a67ef3
SHA512 a1b5425303552a6275aeaba0f2aa02fd25e1e10a88b2612c2f50c71c16eebb59df52f339cf8cf061ad72a582b961e257314861cc093913e6a1b1a3f2872e6fa4
SSDEEP 49152:hOBFqp+i31Gb2XNL5CgVLNiXicJFFRGNzj3:Oq1obcNVC47wRGpj3
TLSH
T15BB5C212DEEE0E9FD09FB039844E4C03A9ED7894433185EBDE535E15BBD669309292E3
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

617456

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\dvs\p4\build\sw\rel\gpu_drv\installer_core\installer_core_vs2017\Build\Core\Out\x64\Release\CoInstaller64.pdb

kernel32

DecodePointer SetDefaultDllDirectories DebugBreak Sleep IsDebuggerPresent CreateEventW GetCommandLineW InitializeCriticalSectionEx DeleteCriticalSection SetLastError GetProcessHeap HeapAlloc HeapFree HeapReAlloc HeapSize HeapDestroy FindResourceExW FindResourceW LoadResource LockResource SizeofResource VerSetConditionMask VerifyVersionInfoW GetTempPathW GetCurrentProcessId WaitForSingleObject ReleaseMutex GetFileSizeEx WriteFile ExpandEnvironmentStringsW GetModuleFileNameW GetFileAttributesW RemoveDirectoryW CreateFileW CreateMutexW GetLastError GetCurrentThreadId WaitForSingleObjectEx SetEvent CreateEventA FormatMessageA FormatMessageW LocalFree WideCharToMultiByte CloseHandle OutputDebugStringW GetCurrentProcess GetProcessTimes WriteConsoleW ReadConsoleW SetStdHandle SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetOEMCP GetACP IsValidCodePage FindFirstFileExW ReadFile GetConsoleMode GetConsoleOutputCP GetFileType EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW VirtualProtect FlsFree FlsSetValue FlsGetValue FlsAlloc GetTimeZoneInformation GetStdHandle ExitProcess TlsFree TlsSetValue GetSystemTimeAsFileTime QueryPerformanceFrequency QueryPerformanceCounter TlsGetValue TlsAlloc GetSystemInfo GetVersionExW LocalAlloc MultiByteToWideChar GetLocalTime DuplicateHandle TerminateProcess GetExitCodeProcess CreateProcessW GetProcessId OpenProcess GetCurrentDirectoryW CreateDirectoryW DeleteFileW FindClose FindFirstFileW FindNextFileW GetFileTime QueryDosDeviceW SetFileAttributesW DeviceIoControl EnterCriticalSection LeaveCriticalSection GetCurrentThread GetSystemDirectoryW GetWindowsDirectoryW GetSystemWindowsDirectoryW CreateFileMappingW MapViewOfFile UnmapViewOfFile CopyFileW CopyFileExW MoveFileExW FileTimeToSystemTime FreeLibrary GetModuleHandleExW GetProcAddress LoadLibraryW OpenEventW SystemTimeToFileTime GetFullPathNameW GetModuleFileNameA GetModuleHandleW LoadLibraryExW GetStringTypeW GetLocaleInfoEx EncodePointer LCMapStringEx CompareStringEx GetCPInfo FlushFileBuffers GetFileInformationByHandle SetFilePointerEx CreateDirectoryExW AreFileApisANSI RaiseException ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW InitializeSListHead RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent GetStartupInfoW RtlUnwindEx RtlPcToFileHeader InterlockedPushEntrySList InitializeCriticalSectionAndSpinCount RtlUnwind

advapi32

RegOpenKeyExW RegCloseKey RegOpenCurrentUser RegDeleteKeyW RegDeleteValueW RegEnumKeyExW RegQueryInfoKeyW RegSetValueExW OpenThreadToken AccessCheck DuplicateToken GetFileSecurityW MapGenericMask ChangeServiceConfig2W CloseServiceHandle ControlService EnumDependentServicesW OpenSCManagerW OpenServiceW QueryServiceConfig2W RegCreateKeyExW QueryServiceStatusEx StartServiceW LsaNtStatusToWinError RegEnumValueW OpenProcessToken GetTokenInformation RegQueryValueExW

shell32

ShellExecuteExW SHGetFolderPathW

oleaut32

SysAllocStringLen VariantChangeType SysStringLen VariantInit VariantClear SafeArrayCreate SafeArrayDestroy SafeArrayGetUBound SafeArrayGetLBound SafeArrayLock SafeArrayUnlock SysFreeString

psapi

GetProcessImageFileNameW

shlwapi

PathFindFileNameW

rpcrt4

UuidToStringW RpcStringFreeW

version

VerQueryValueW GetFileVersionInfoW GetFileVersionInfoSizeW

setupapi

SetupDiDeleteDeviceInfo SetupDiGetDeviceInstanceIdW SetupGetStringFieldW SetupGetFieldCount SetupFindNextMatchLineW SetupFindFirstLineW SetupDiBuildDriverInfoList CM_Get_DevNode_Status SetupCloseInfFile SetupDiGetDriverInfoDetailW SetupDiOpenDeviceInfoW SetupDiCreateDeviceInfoList CM_Get_Device_IDW SetupOpenInfFileW SetupDiGetClassDevsW SetupDiDestroyDeviceInfoList SetupDiOpenDevRegKey SetupDiGetDeviceRegistryPropertyW SetupDiSetDeviceRegistryPropertyW SetupDiEnumDeviceInfo SetupDiEnumDriverInfoW SetupOpenAppendInfFileW SetupDiGetDeviceInstallParamsW SetupDiGetClassInstallParamsW SetupDiSetDeviceInstallParamsW SetupDiSetClassInstallParamsW SetupDiSetSelectedDriverW SetupDiSetSelectedDevice SetupDiGetActualSectionToInstallExW CM_Get_Parent SetupDiCallClassInstaller

userenv

UnloadUserProfile

Name

.text

Size

914KB

Virtual Size

914KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

258KB

Virtual Size

257KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

39KB

Virtual Size

46KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

38KB

Virtual Size

37KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

451KB

Virtual Size

450KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

572KB

Virtual Size

576KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-15_bdc4f5d75108e3d7c129ea24e265fae7_icedid_luca-stealer_njrat_stealc

kernel32

advapi32

shell32

oleaut32

psapi

shlwapi

rpcrt4

version

setupapi

userenv

generic