2026-08-16_2786473306b10dfb2884c81e71474971_icedid_luca-stealer_njrat

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-16_2786473306b10dfb2884c81e71474971_icedid_luca-stealer_njrat
Size 50.9MB
Sample260816-sevqws1alg
SHA256 abc899e3e3b165d9cfa5383801654a6bd8c4bd79e1ab4cba57988b926afe6afe
MD5 2786473306b10dfb2884c81e71474971
SHA1 0660b7295011d6862a12efbc26934d04ed7ccda4
SHA512 f4fd0ec8ee45ee3c37e483d422850e7353f9d5420294c65d8485bba91a5f53750d81024eda8cec780e91a26043da81cb766e4ef41305a13a34acfd9420b5ee69
SSDEEP 98304:PMLS2t5GGJKCHJBPurpaP6DgZOrbqNMv88RkrabMO5wbKq2:PMLS2t/9BGr6042
TLSH
T13BC7CC98D6CB123FCD762CB85F3CA34EDA5A47A893245785687E5FC013712A51AE0EF0
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_Binary_References_Browsers

Detects executables Discord URL observed in first stage droppers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_DiscordURL

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-16_2786473306b10dfb2884c81e71474971_icedid_luca-stealer_njrat

File Explorer

2026-08-16_2786473306b10dfb2884c81e71474971_icedid_luca-stealer_njrat

.exe 50.9MB

2026-08-16_2786473306b10dfb2884c81e71474971_icedid_luca-stealer_njrat

IMPHASH 7d222574cc9690c40e5c0eeb8c9e8745
SHA256 abc899e3e3b165d9cfa5383801654a6bd8c4bd79e1ab4cba57988b926afe6afe
MD5 2786473306b10dfb2884c81e71474971
SHA1 0660b7295011d6862a12efbc26934d04ed7ccda4
SHA512 f4fd0ec8ee45ee3c37e483d422850e7353f9d5420294c65d8485bba91a5f53750d81024eda8cec780e91a26043da81cb766e4ef41305a13a34acfd9420b5ee69
SSDEEP 98304:PMLS2t5GGJKCHJBPurpaP6DgZOrbqNMv88RkrabMO5wbKq2:PMLS2t/9BGr6042
TLSH
T13BC7CC98D6CB123FCD762CB85F3CA34EDA5A47A893245785687E5FC013712A51AE0EF0
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers
Detects executables Discord URL observed in first stage droppers
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

52448692

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

version

VerQueryValueW GetFileVersionInfoSizeW GetFileVersionInfoW

shell32

SHGetKnownFolderPath

advapi32

RegOpenKeyExW GetUserNameW RegCloseKey RegQueryValueExW

bcrypt

BCryptCloseAlgorithmProvider BCryptOpenAlgorithmProvider BCryptDecrypt BCryptDestroyKey BCryptDeriveKeyPBKDF2 BCryptSetProperty BCryptGenerateSymmetricKey BCryptHash

ole32

CoCreateInstance CoSetProxyBlanket CoInitializeEx CoUninitialize CoTaskMemFree

oleaut32

SysStringByteLen SysAllocStringByteLen SysFreeString

winhttp

WinHttpConnect WinHttpOpenRequest WinHttpQueryHeaders WinHttpCrackUrl WinHttpQueryDataAvailable WinHttpReceiveResponse WinHttpSendRequest WinHttpOpen WinHttpAddRequestHeaders WinHttpReadData WinHttpCloseHandle

crypt32

CryptStringToBinaryA CryptUnprotectData

kernel32

GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetCommandLineW GetCommandLineA GetOEMCP GetACP IsValidCodePage GetTimeZoneInformation ReadConsoleW EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW SetStdHandle VirtualProtect FlsFree FlsSetValue FlsGetValue FlsAlloc GetConsoleMode GetConsoleOutputCP SetFilePointerEx GetFileSizeEx GetFileType ExitProcess GetModuleHandleExW FreeLibraryAndExitThread ExitThread CreateThread LoadLibraryExW WriteConsoleW CompareStringW GetFileSize GetConsoleScreenBufferInfo SetConsoleTextAttribute GetStdHandle Sleep CloseHandle WideCharToMultiByte SetConsoleOutputCP GetTempPathW MultiByteToWideChar GetLocalTime GetComputerNameW GlobalMemoryStatusEx GetTickCount FindFirstFileW FindNextFileW GetModuleFileNameW FindClose LocalFree GetSystemTimeAsFileTime ExpandEnvironmentStringsW GetEnvironmentVariableW GetLogicalDriveStringsW GetDriveTypeW WaitForSingleObject ReadFile SetFilePointer CreateFileW GetLastError CreateProcessW WriteFile CreateNamedPipeW PeekNamedPipe GetCurrentThreadId GetCurrentProcessId ConnectNamedPipe GetModuleHandleW AreFileApisANSI TryEnterCriticalSection HeapCreate HeapFree EnterCriticalSection GetFullPathNameW GetDiskFreeSpaceW OutputDebugStringA LockFile LeaveCriticalSection InitializeCriticalSection GetFullPathNameA SetEndOfFile UnlockFileEx CreateMutexW GetFileAttributesW UnmapViewOfFile HeapValidate HeapSize GetTempPathA FormatMessageW GetDiskFreeSpaceA GetFileAttributesA GetFileAttributesExW OutputDebugStringW FlushViewOfFile CreateFileA WaitForSingleObjectEx DeleteFileA DeleteFileW HeapReAlloc RaiseException GetSystemInfo HeapAlloc HeapCompact HeapDestroy UnlockFile LockFileEx RtlUnwind DeleteCriticalSection GetProcessHeap SystemTimeToFileTime GetSystemTime FormatMessageA CreateFileMappingW MapViewOfFile QueryPerformanceCounter FlushFileBuffers GetLocaleInfoEx GetCurrentDirectoryW CreateDirectoryW FindFirstFileExW GetFileInformationByHandle GetFinalPathNameByHandleW SetFileInformationByHandle DeviceIoControl GetProcAddress CopyFileW MoveFileExW CreateHardLinkW GetFileInformationByHandleEx CreateSymbolicLinkW GetExitCodeThread ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive InitializeCriticalSectionEx EncodePointer DecodePointer GetStringTypeW LCMapStringEx WakeAllConditionVariable CompareStringEx GetCPInfo RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent InitializeSListHead GetCurrentProcess TerminateProcess FreeLibrary RtlUnwindEx RtlPcToFileHeader SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree

Name

.text

Size

50.3MB

Virtual Size

50.3MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

20KB

Virtual Size

34KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

42KB

Virtual Size

42KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

7KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

280KB

Virtual Size

279KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

305KB

Virtual Size

304KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-16_2786473306b10dfb2884c81e71474971_icedid_luca-stealer_njrat

version

shell32

advapi32

bcrypt

ole32

oleaut32

winhttp

crypt32

kernel32

generic