2026-08-15_bc6f628db1c6df1c0857e5673d6966ad_icedid_luca-stealer_njrat_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-15_bc6f628db1c6df1c0857e5673d6966ad_icedid_luca-stealer_njrat_stealc
Size 3.2MB
Sample260815-dv6e1ade99
SHA256 d529e2c78d01e4b1e69eb9da2500387137dea01941feb9432574b8889181909a
MD5 bc6f628db1c6df1c0857e5673d6966ad
SHA1 2fa84ffb5c9ac071b5b11f7d8dfd98360bb73785
SHA512 1dc6a33587ce2173a08beeca31cf4a81546c2f9c8b18a6ab9f851ff1d2517df9a68a81c03d6b30d3773803ba3818a7c1f7a31a862b43c1228c5ec47f4bef31b0
SSDEEP 49152:pxBv/zkGo+SBPpjhC1ZZ7Y2qUZ81wr8me1xInN3T9E28Zy:3YqqUdrF1T9nm
TLSH
T118F52A4BE6A641E8C5B6C038E643622FFA327846833497D7A7D01F574B637E0A97E350
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects executables referencing many IR and analysis tools 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_References_SecTools

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-15_bc6f628db1c6df1c0857e5673d6966ad_icedid_luca-stealer_njrat_stealc

File Explorer

2026-08-15_bc6f628db1c6df1c0857e5673d6966ad_icedid_luca-stealer_njrat_stealc

.exe 3.2MB

2026-08-15_bc6f628db1c6df1c0857e5673d6966ad_icedid_luca-stealer_njrat_stealc

IMPHASH a226d2fe7dbe1c3f0dca74a279fb70db
SHA256 d529e2c78d01e4b1e69eb9da2500387137dea01941feb9432574b8889181909a
MD5 bc6f628db1c6df1c0857e5673d6966ad
SHA1 2fa84ffb5c9ac071b5b11f7d8dfd98360bb73785
SHA512 1dc6a33587ce2173a08beeca31cf4a81546c2f9c8b18a6ab9f851ff1d2517df9a68a81c03d6b30d3773803ba3818a7c1f7a31a862b43c1228c5ec47f4bef31b0
SSDEEP 49152:pxBv/zkGo+SBPpjhC1ZZ7Y2qUZ81wr8me1xInN3T9E28Zy:3YqqUdrF1T9nm
TLSH
T118F52A4BE6A641E8C5B6C038E643622FFA327846833497D7A7D01F574B637E0A97E350
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects executables referencing many IR and analysis tools
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

82588

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

wininet

InternetReadFile InternetCloseHandle InternetOpenA InternetOpenUrlA

iphlpapi

GetAdaptersInfo

advapi32

CryptDestroyHash CryptAcquireContextA RegCloseKey RegQueryValueExA CryptGenRandom AllocateAndInitializeSid RegCreateKeyExA CryptReleaseContext CryptGetHashParam RegOpenKeyExA CheckTokenMembership FreeSid CryptCreateHash RegSetValueExA CryptHashData GetUserNameA

user32

EnumWindows GetWindowTextW

bcrypt

BCryptDestroyKey BCryptEncrypt BCryptCloseAlgorithmProvider BCryptGenerateSymmetricKey BCryptDecrypt BCryptOpenAlgorithmProvider BCryptSetProperty

kernel32

GetCurrentThreadId InitializeSListHead QueryPerformanceFrequency IsProcessorFeaturePresent GetExitCodeProcess CheckRemoteDebuggerPresent GetComputerNameA SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext SleepConditionVariableSRW WakeAllConditionVariable AcquireSRWLockExclusive ReadFile GetModuleFileNameA FindFirstFileA SetConsoleTextAttribute SetConsoleTitleA GetCurrentProcess GetStdHandle WriteFile SetConsoleMode TerminateProcess FindNextFileA FindClose WaitForSingleObject UnmapViewOfFile GetModuleHandleA OpenProcess CreateToolhelp32Snapshot Sleep GetConsoleMode GetTempPathA GetTickCount64 GetFileAttributesA Process32NextW CreateFileA FileTimeToSystemTime GetCurrentThread ReleaseSRWLockExclusive DeleteFileA Process32FirstW CloseHandle CreateThread SetFileAttributesA GetLocalTime GetThreadContext Beep GetProcAddress GetFileSize RemoveDirectoryA GetCurrentProcessId SystemTimeToFileTime GlobalMemoryStatusEx GetModuleHandleW WideCharToMultiByte CreateProcessA GetSystemTimeAsFileTime CreateDirectoryA CreateFileMappingW MapViewOfFile QueryPerformanceCounter IsDebuggerPresent

msvcp140

?uncaught_exceptions@std@@YAHXZ ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A ?_Xout_of_range@std@@YAXPEBD@Z ?_Random_device@std@@YAIXZ ?_Xlength_error@std@@YAXPEBD@Z ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z ?good@ios_base@std@@QEBA_NXZ

vcruntime140_1

__CxxFrameHandler4

vcruntime140

memmove __std_exception_destroy __std_exception_copy __std_terminate memcmp memcpy memset __current_exception __current_exception_context __C_specific_handler _CxxThrowException

api-ms-win-crt-runtime-l1-1-0

_initialize_narrow_environment _initialize_onexit_table _register_onexit_function _crt_atexit _configure_narrow_argv _cexit system _seh_filter_exe _set_app_type _get_initial_narrow_environment terminate _initterm_e _exit exit __p___argc __p___argv _c_exit _register_thread_local_exe_atexit_callback _invoke_watson _initterm

api-ms-win-crt-heap-l1-1-0

_callnewh free malloc _set_new_mode

api-ms-win-crt-stdio-l1-1-0

_set_fmode __stdio_common_vswprintf_s __stdio_common_vsprintf_s __p__commode __stdio_common_vsscanf

api-ms-win-crt-string-l1-1-0

_wcsicmp towlower toupper tolower

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-15_bc6f628db1c6df1c0857e5673d6966ad_icedid_luca-stealer_njrat_stealc

wininet

iphlpapi

advapi32

user32

bcrypt

kernel32

msvcp140

vcruntime140_1

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic