2026-08-18_0d1f0c67790bf8e224514cb808b5105a_icedid_luca-stealer_njrat

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-18_0d1f0c67790bf8e224514cb808b5105a_icedid_luca-stealer_njrat
Size 54.4MB
Sample260818-fxb1aafe45
SHA256 b6469b32b0e53bdc2b4b88ef5e30e6a47308ded6867788b4623439bb6c58ec6d
MD5 0d1f0c67790bf8e224514cb808b5105a
SHA1 ec43cf4728c44d92a085254ef215f4e07ace76e4
SHA512 5de03e5ae7bf75bfe89889078c934796f302406a4b4bf06e3a400d1c1ac6fb1481853e477e3bd1c3d5d74bd78e51af08e8f39cb74857bc0f30061ce94dac28ad
SSDEEP 98304:6oZC399XCU0gl/MvLV9FaGpIFeBv7ksszfza:v439sm/MESB8r
TLSH
T103C70E98C6CB123FCD762CB85F3CE34EDA5A579893245785687E6E8413312A51BE0EF0
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_Binary_References_Browsers

Detects executables Discord URL observed in first stage droppers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_DiscordURL

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-18_0d1f0c67790bf8e224514cb808b5105a_icedid_luca-stealer_njrat

File Explorer

2026-08-18_0d1f0c67790bf8e224514cb808b5105a_icedid_luca-stealer_njrat

.exe 54.4MB

2026-08-18_0d1f0c67790bf8e224514cb808b5105a_icedid_luca-stealer_njrat

IMPHASH 7d222574cc9690c40e5c0eeb8c9e8745
SHA256 b6469b32b0e53bdc2b4b88ef5e30e6a47308ded6867788b4623439bb6c58ec6d
MD5 0d1f0c67790bf8e224514cb808b5105a
SHA1 ec43cf4728c44d92a085254ef215f4e07ace76e4
SHA512 5de03e5ae7bf75bfe89889078c934796f302406a4b4bf06e3a400d1c1ac6fb1481853e477e3bd1c3d5d74bd78e51af08e8f39cb74857bc0f30061ce94dac28ad
SSDEEP 98304:6oZC399XCU0gl/MvLV9FaGpIFeBv7ksszfza:v439sm/MESB8r
TLSH
T103C70E98C6CB123FCD762CB85F3CE34EDA5A579893245785687E6E8413312A51BE0EF0
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers
Detects executables Discord URL observed in first stage droppers
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

56259988

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

version

VerQueryValueW GetFileVersionInfoSizeW GetFileVersionInfoW

shell32

SHGetKnownFolderPath

advapi32

RegOpenKeyExW GetUserNameW RegCloseKey RegQueryValueExW

bcrypt

BCryptCloseAlgorithmProvider BCryptOpenAlgorithmProvider BCryptDecrypt BCryptDestroyKey BCryptDeriveKeyPBKDF2 BCryptSetProperty BCryptGenerateSymmetricKey BCryptHash

ole32

CoCreateInstance CoSetProxyBlanket CoInitializeEx CoUninitialize CoTaskMemFree

oleaut32

SysStringByteLen SysAllocStringByteLen SysFreeString

winhttp

WinHttpConnect WinHttpOpenRequest WinHttpQueryHeaders WinHttpCrackUrl WinHttpQueryDataAvailable WinHttpReceiveResponse WinHttpSendRequest WinHttpOpen WinHttpAddRequestHeaders WinHttpReadData WinHttpCloseHandle

crypt32

CryptStringToBinaryA CryptUnprotectData

kernel32

GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetCommandLineW GetCommandLineA GetOEMCP GetACP IsValidCodePage GetTimeZoneInformation ReadConsoleW EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW SetStdHandle VirtualProtect FlsFree FlsSetValue FlsGetValue FlsAlloc GetConsoleMode GetConsoleOutputCP SetFilePointerEx GetFileSizeEx GetFileType ExitProcess GetModuleHandleExW FreeLibraryAndExitThread ExitThread CreateThread LoadLibraryExW WriteConsoleW CompareStringW GetFileSize GetConsoleScreenBufferInfo SetConsoleTextAttribute GetStdHandle Sleep CloseHandle WideCharToMultiByte SetConsoleOutputCP GetTempPathW MultiByteToWideChar GetLocalTime GetComputerNameW GlobalMemoryStatusEx GetTickCount FindFirstFileW FindNextFileW GetModuleFileNameW FindClose LocalFree GetSystemTimeAsFileTime ExpandEnvironmentStringsW GetEnvironmentVariableW GetLogicalDriveStringsW GetDriveTypeW WaitForSingleObject ReadFile SetFilePointer CreateFileW GetLastError CreateProcessW WriteFile CreateNamedPipeW PeekNamedPipe GetCurrentThreadId GetCurrentProcessId ConnectNamedPipe GetModuleHandleW AreFileApisANSI TryEnterCriticalSection HeapCreate HeapFree EnterCriticalSection GetFullPathNameW GetDiskFreeSpaceW OutputDebugStringA LockFile LeaveCriticalSection InitializeCriticalSection GetFullPathNameA SetEndOfFile UnlockFileEx CreateMutexW GetFileAttributesW UnmapViewOfFile HeapValidate HeapSize GetTempPathA FormatMessageW GetDiskFreeSpaceA GetFileAttributesA GetFileAttributesExW OutputDebugStringW FlushViewOfFile CreateFileA WaitForSingleObjectEx DeleteFileA DeleteFileW HeapReAlloc RaiseException GetSystemInfo HeapAlloc HeapCompact HeapDestroy UnlockFile LockFileEx RtlUnwind DeleteCriticalSection GetProcessHeap SystemTimeToFileTime GetSystemTime FormatMessageA CreateFileMappingW MapViewOfFile QueryPerformanceCounter FlushFileBuffers GetLocaleInfoEx GetCurrentDirectoryW CreateDirectoryW FindFirstFileExW GetFileInformationByHandle GetFinalPathNameByHandleW SetFileInformationByHandle DeviceIoControl GetProcAddress CopyFileW MoveFileExW CreateHardLinkW GetFileInformationByHandleEx CreateSymbolicLinkW GetExitCodeThread ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive InitializeCriticalSectionEx EncodePointer DecodePointer GetStringTypeW LCMapStringEx WakeAllConditionVariable CompareStringEx GetCPInfo RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent InitializeSListHead GetCurrentProcess TerminateProcess FreeLibrary RtlUnwindEx RtlPcToFileHeader SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree

Name

.text

Size

53.9MB

Virtual Size

53.9MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

20KB

Virtual Size

34KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

42KB

Virtual Size

42KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

7KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

280KB

Virtual Size

279KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

161KB

Virtual Size

161KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-18_0d1f0c67790bf8e224514cb808b5105a_icedid_luca-stealer_njrat

version

shell32

advapi32

bcrypt

ole32

oleaut32

winhttp

crypt32

kernel32

generic