2026-08-16_60029942fe41c65693602ba800a4d153_icedid_luca-stealer_njrat_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-16_60029942fe41c65693602ba800a4d153_icedid_luca-stealer_njrat_stealc
Size 2.7MB
Sample260816-whf9fstdpf
SHA256 18e0675c2540e574981a0c41f7ae0a54fcad3d055156e2fd7e68003fdfbceabd
MD5 60029942fe41c65693602ba800a4d153
SHA1 ceaf1a5c13af2175a5e4eb06ef602897dad7066d
SHA512 25998146a0b8b63c050fe3ed14bf2039b3c3223828faa8e3b7a85535eb4854df5a6783b0e151dc0ee895914d0cea7f263f2bd50f2116862e1e6704c2b74581c2
SSDEEP 49152:u84gcqsCIPMFOAAglrsTmNMs7p5IQln0xCy+9RlTSWDmg27RnWGj:SChfrsI0xYSWD527BWG
TLSH
T110D5A00763AC02FCE0FAD27DC9869906EBB1740907716ACF1690C96A4F77AE04E7D716
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-16_60029942fe41c65693602ba800a4d153_icedid_luca-stealer_njrat_stealc

File Explorer

2026-08-16_60029942fe41c65693602ba800a4d153_icedid_luca-stealer_njrat_stealc

.exe 2.7MB

2026-08-16_60029942fe41c65693602ba800a4d153_icedid_luca-stealer_njrat_stealc

IMPHASH 265f7a152e93960fbca031d728272c4a
SHA256 18e0675c2540e574981a0c41f7ae0a54fcad3d055156e2fd7e68003fdfbceabd
MD5 60029942fe41c65693602ba800a4d153
SHA1 ceaf1a5c13af2175a5e4eb06ef602897dad7066d
SHA512 25998146a0b8b63c050fe3ed14bf2039b3c3223828faa8e3b7a85535eb4854df5a6783b0e151dc0ee895914d0cea7f263f2bd50f2116862e1e6704c2b74581c2
SSDEEP 49152:u84gcqsCIPMFOAAglrsTmNMs7p5IQln0xCy+9RlTSWDmg27RnWGj:SChfrsI0xYSWD527BWG
TLSH
T110D5A00763AC02FCE0FAD27DC9869906EBB1740907716ACF1690C96A4F77AE04E7D716
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1328688

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\jenk17\workspace\wsg-cit\ICPS_REL_4.0\src\Build\Release\Bin\x64\IntelConnectivityNetworkService.pdb

iphlpapi

NotifyIpInterfaceChange GetAdaptersAddresses ConvertLengthToIpv4Mask GetIfEntry2 ConvertInterfaceGuidToLuid SendARP CancelMibChangeNotify2 GetIpInterfaceEntry ResolveIpNetEntry2 FreeMibTable GetIpNetTable2

ws2_32

InetNtopW

gdiplus

GdipDrawImageI GdipSetInterpolationMode GdipSaveImageToFile GdipCreateSolidFill GdipSetSmoothingMode GdipScaleWorldTransform GdipDeleteGraphics GdipGetImageGraphicsContext GdipGetImageWidth GdipLoadImageFromFileICM GdipDisposeImage GdipCloneImage GdipCreateBitmapFromScan0 GdipFree GdipAlloc GdipGetImageEncoders GdipCreateBitmapFromFile GdiplusStartup GdiplusShutdown GdipFillRectangleI GdipSetCompositingMode GdipGetImageEncodersSize GdipGetImageHeight GdipDeleteBrush

ntdll

RtlEthernetAddressToStringA NtQuerySystemInformation RtlUnwindEx RtlCaptureContext RtlPcToFileHeader RtlVirtualUnwind RtlLookupFunctionEntry

kernel32

DecodePointer GetCommandLineW GetCurrentProcess GetTickCount64 lstrcmpiW FindResourceW SizeofResource CreateMutexW CreateThread SetProcessInformation GetExitCodeProcess CreateProcessW LoadResource GetModuleFileNameW FreeLibrary DeleteCriticalSection LeaveCriticalSection EnterCriticalSection LoadLibraryExW WTSGetActiveConsoleSessionId FormatMessageW LocalAlloc GetProcAddress GetModuleHandleW WaitForMultipleObjects OpenEventW GetProcessHeap HeapSize HeapFree HeapReAlloc HeapAlloc HeapDestroy GetLastError MultiByteToWideChar Sleep CreateEventW WaitForSingleObject ResetEvent SetEvent GetPackagePath GetPackageId LocalFree OpenProcess CloseHandle CopyFileW DeleteFileW InitializeCriticalSectionEx GetCurrentThreadId RaiseException GetLocalTime OutputDebugStringA InitializeCriticalSection DeviceIoControl SetStdHandle SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetOEMCP GetACP IsValidCodePage FindFirstFileExW SetFilePointerEx GetConsoleMode GetConsoleOutputCP FlushFileBuffers GetTimeZoneInformation EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW FlsFree FlsSetValue FlsGetValue FlsAlloc GetFileType GetStdHandle ExitProcess VirtualQuery VirtualProtect VirtualAlloc GetSystemInfo GetModuleHandleExW FreeLibraryAndExitThread ResumeThread TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount InterlockedPushEntrySList InitializeSListHead GetCurrentProcessId GetStartupInfoW IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter K32GetModuleFileNameExW GetUserDefaultLangID CreateFileW ExitThread CloseThreadpool CloseThreadpoolCleanupGroup CloseThreadpoolCleanupGroupMembers CreateThreadpoolCleanupGroup CreateThreadpool SetThreadpoolThreadMaximum WideCharToMultiByte GetModuleHandleA HeapCreate GetCurrentThread WriteConsoleW SetThreadInformation LoadLibraryW SubmitThreadpoolWork CreateThreadpoolWork CloseThreadpoolWork CallbackMayRunLong TerminateProcess SetHandleInformation CreatePipe K32GetProcessMemoryInfo K32EnumProcesses K32EnumProcessModulesEx QueryFullProcessImageNameW ReadFile GetEnvironmentVariableW GetFileSizeEx UnmapViewOfFile MapViewOfFile CreateFileMappingW SetLastError FindNextFileW FindFirstFileW FindClose WriteFile CreateDirectoryW ExpandEnvironmentStringsW GetFileAttributesW GetThreadId GetCPInfo CompareStringEx IsDebuggerPresent OutputDebugStringW ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive WaitForSingleObjectEx GetExitCodeThread GetStringTypeW QueryPerformanceCounter QueryPerformanceFrequency WakeAllConditionVariable SleepConditionVariableSRW GetLocaleInfoEx EncodePointer LCMapStringEx GetSystemTimeAsFileTime

user32

DispatchMessageW PostThreadMessageW LoadCursorW CharNextW LoadStringW GetMessageW TranslateMessage DestroyIcon PrivateExtractIconsW GetDC LoadIconW GetIconInfo UpdateWindow ShowWindow CreateWindowExW RegisterClassExW PostQuitMessage DefWindowProcW UnregisterSuspendResumeNotification RegisterSuspendResumeNotification UnregisterPowerSettingNotification SendMessageW MessageBoxW CharUpperW

gdi32

DeleteObject GetObjectW DeleteDC CreateSolidBrush GetDIBits

advapi32

RevertToSelf AddAce CryptGetHashParam CryptHashData CryptCreateHash CryptAcquireContextW CryptDestroyHash CryptReleaseContext RegOpenKeyExA EventRegister EventSetInformation CreateProcessAsUserW SetNamedSecurityInfoW EventUnregister StartServiceCtrlDispatcherW SetServiceStatus RegisterServiceCtrlHandlerExW OpenServiceW OpenSCManagerW DeleteService CreateServiceW ControlService CloseServiceHandle ReportEventW RegisterEventSourceW DeregisterEventSource RegSetValueExW RegQueryInfoKeyW RegEnumKeyExW RegDeleteValueW RegDeleteKeyW RegCreateKeyExW RegQueryValueExW RegOpenKeyExW RegCloseKey SetSecurityDescriptorDacl IsValidSid InitializeSid InitializeSecurityDescriptor GetSidSubAuthority GetSidLengthRequired GetLengthSid DuplicateTokenEx CopySid ImpersonateLoggedOnUser OpenProcessToken EventWriteTransfer QueryServiceConfig2W QueryServiceConfigW ChangeServiceConfigW StartServiceW QueryServiceStatus QueryServiceStatusEx EnumServicesStatusExW InitializeAcl

ole32

CoAddRefServerProcess CoResumeClassObjects CoInitializeSecurity CoRegisterClassObject CoUninitialize CoInitializeEx CoRevokeClassObject CoTaskMemFree CoTaskMemRealloc CoTaskMemAlloc OleRun StringFromGUID2 CoCreateInstance CLSIDFromString CoCancelCall CoEnableCallCancellation CoDisableCallCancellation StgCreatePropSetStg StgOpenStorageEx CoReleaseServerProcess

oleaut32

SafeArrayUnlock SafeArrayLock VariantInit VariantClear VariantCopy SysFreeString SysAllocString VariantChangeType SysStringByteLen SysAllocStringByteLen SysStringLen VarUI4FromStr LoadRegTypeLi SafeArrayCreate SafeArrayPutElement RegisterTypeLi UnRegisterTypeLi GetErrorInfo SetErrorInfo LoadTypeLi

setupapi

CM_Locate_DevNodeW SetupDiGetDeviceRegistryPropertyW SetupDiGetDeviceInstallParamsW CM_Get_Device_ID_ListW SetupDiCallClassInstaller SetupDiGetClassDevsExW SetupDiDestroyDeviceInfoList SetupDiEnumDeviceInfo CM_Open_DevNode_Key CM_Get_Device_ID_List_SizeW SetupDiSetClassInstallParamsW

rpcrt4

RpcServerInqCallAttributesW

wintrust

WinVerifyTrust

imagehlp

ImageGetCertificateHeader ImageGetCertificateData ImageEnumerateCertificates

wtsapi32

WTSQueryUserToken

cfgmgr32

CM_Get_DevNode_PropertyW

winhttp

WinHttpCreateUrl WinHttpCrackUrl

urlmon

URLDownloadToCacheFileW URLDownloadToFileW

crypt32

CryptVerifyMessageSignature CertFreeCertificateContext CertNameToStrW

version

GetFileVersionInfoSizeExW GetFileVersionInfoExW VerQueryValueW

Name

.text

Size

1.5MB

Virtual Size

1.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

412KB

Virtual Size

412KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

47KB

Virtual Size

107KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

67KB

Virtual Size

67KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

86KB

Virtual Size

85KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

576KB

Virtual Size

580KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-16_60029942fe41c65693602ba800a4d153_icedid_luca-stealer_njrat_stealc

iphlpapi

ws2_32

gdiplus

ntdll

kernel32

user32

gdi32

advapi32

ole32

oleaut32

setupapi

rpcrt4

wintrust

imagehlp

wtsapi32

cfgmgr32

winhttp

urlmon

crypt32

version

generic