2026-08-16_db43b9a6cf2cd990b26f2afbd4de6edb_icedid_luca-stealer_njrat

General

Target
2026-08-16_db43b9a6cf2cd990b26f2afbd4de6edb_icedid_luca-stealer_njrat
Size 2.2MB
Sample260816-lp71msvtev
SHA256 d96109c92716a54af3d137d1c4b7554cd34ce3fc8f1687184a3b87fbaa3c5873
MD5 db43b9a6cf2cd990b26f2afbd4de6edb
SHA1 2ca603e7c67aaa022ad45a2439cea6a75e85d665
SHA512 6a4273fd1831bc09d930f70d12b17e87c1a3862369a8256f26299f0b1ef59eef0f89ef9e94421deca25643487e4881a13ac646bd45b6e935aeff14cc14c1544b
SSDEEP 49152:W818nyq2tGfNU83eEV+OJzxgLiz/mTv43k2zX2ZiP:h8nyqkGfZ3XJtgLm/QWSi
TLSH
T11CB5239A73B130F9D46343B8D9530219E376B83827209FAB47E056711F677808EBE766
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-16_db43b9a6cf2cd990b26f2afbd4de6edb_icedid_luca-stealer_njrat

File Explorer

2026-08-16_db43b9a6cf2cd990b26f2afbd4de6edb_icedid_luca-stealer_njrat

.exe 2.2MB

2026-08-16_db43b9a6cf2cd990b26f2afbd4de6edb_icedid_luca-stealer_njrat

IMPHASH 31c66edfdffc0a3eb2407f88d7492780
SHA256 d96109c92716a54af3d137d1c4b7554cd34ce3fc8f1687184a3b87fbaa3c5873
MD5 db43b9a6cf2cd990b26f2afbd4de6edb
SHA1 2ca603e7c67aaa022ad45a2439cea6a75e85d665
SHA512 6a4273fd1831bc09d930f70d12b17e87c1a3862369a8256f26299f0b1ef59eef0f89ef9e94421deca25643487e4881a13ac646bd45b6e935aeff14cc14c1544b
SSDEEP 49152:W818nyq2tGfNU83eEV+OJzxgLiz/mTv43k2zX2ZiP:h8nyqkGfZ3XJtgLm/QWSi
TLSH
T11CB5239A73B130F9D46343B8D9530219E376B83827209FAB47E056711F677808EBE766
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

11880

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

Sleep GetDiskFreeSpaceExW LoadLibraryA CloseHandle GetSystemInfo LoadLibraryW HeapAlloc GetCurrentDirectoryW GetComputerNameW GetProcessHeap GetModuleHandleW GetModuleHandleA WriteConsoleW CreateFileW GetConsoleMode GetConsoleOutputCP FlushFileBuffers HeapReAlloc HeapSize SetFilePointerEx GetFileAttributesW GetSystemPowerStatus GetEnvironmentVariableW HeapFree FreeLibrary CreateDirectoryW LCMapStringW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW RtlUnwindEx GetLastError SetLastError EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree GetProcAddress LoadLibraryExW EncodePointer RaiseException RtlPcToFileHeader GetStdHandle WriteFile GetModuleFileNameW ExitProcess GetModuleHandleExW GetFileType FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle GetStringTypeW FlsAlloc FlsGetValue FlsSetValue FlsFree InitializeCriticalSectionEx VirtualProtect

user32

DestroyWindow CreateWindowExW GetSystemMetrics DefWindowProcW RegisterClassExW PeekMessageW EnumDisplaySettingsW SystemParametersInfoW UnregisterClassW

advapi32

RegEnumKeyExW RegOpenKeyExW GetUserNameW RegQueryValueExW RegCloseKey

shell32

SHGetFolderPathW

Name

.text

Size

85KB

Virtual Size

84KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

45KB

Virtual Size

44KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

2.0MB

Virtual Size

2.0MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-16_db43b9a6cf2cd990b26f2afbd4de6edb_icedid_luca-stealer_njrat

kernel32

user32

advapi32

shell32

generic