2026-08-20_8e0fa90e6665ab285fdd372c3f5dd277_icedid_luca-stealer_njrat_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-20_8e0fa90e6665ab285fdd372c3f5dd277_icedid_luca-stealer_njrat_stealc
Size 1.3MB
Sample260820-sgpbwsem2x
SHA256 7942831db571a3653d32232863ca904e123240c4d952f352f0c1245d680f83ee
MD5 8e0fa90e6665ab285fdd372c3f5dd277
SHA1 a84a1dc09a8e2cff0e62d89b654aa0df5635ae1b
SHA512 5f0c50fdb08daf570c35025133585f36792615619a3622da7070fe8d6be388acfcfa737ab103d7b09461ee39ec143a480b6a6f8a4240e7d54de12b5cdd9cab0e
SSDEEP 24576:M7W+K0yqkRiOO8NckmMT+dLUnQ/tbw/2Mkjy6Fr7g0o9:eWUytRzyk/+dUQ/lFTjN4
TLSH
T14055CF16A7E811F9E1BBD276CC634516FBB2BC165B7196CF03A0425A1F3BA904E3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-20_8e0fa90e6665ab285fdd372c3f5dd277_icedid_luca-stealer_njrat_stealc

File Explorer

2026-08-20_8e0fa90e6665ab285fdd372c3f5dd277_icedid_luca-stealer_njrat_stealc

.exe 1.3MB

2026-08-20_8e0fa90e6665ab285fdd372c3f5dd277_icedid_luca-stealer_njrat_stealc

IMPHASH b52bd34300fe569ecf3993d50ae07436
SHA256 7942831db571a3653d32232863ca904e123240c4d952f352f0c1245d680f83ee
MD5 8e0fa90e6665ab285fdd372c3f5dd277
SHA1 a84a1dc09a8e2cff0e62d89b654aa0df5635ae1b
SHA512 5f0c50fdb08daf570c35025133585f36792615619a3622da7070fe8d6be388acfcfa737ab103d7b09461ee39ec143a480b6a6f8a4240e7d54de12b5cdd9cab0e
SSDEEP 24576:M7W+K0yqkRiOO8NckmMT+dLUnQ/tbw/2Mkjy6Fr7g0o9:eWUytRzyk/+dUQ/lFTjN4
TLSH
T14055CF16A7E811F9E1BBD276CC634516FBB2BC165B7196CF03A0425A1F3BA904E3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

282672

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

MsSense.pdb

kernel32

CloseThreadpoolTimer WaitForThreadpoolTimerCallbacks SetThreadpoolTimer GetModuleFileNameW DeleteCriticalSection InitializeCriticalSectionEx LeaveCriticalSection CreateFileW FindFirstVolumeW FindNextVolumeW FindVolumeClose GetDriveTypeW GetLogicalDrives GetVolumeInformationW QueryDosDeviceW GetVolumeNameForVolumeMountPointW GetVolumePathNamesForVolumeNameW DeviceIoControl MultiByteToWideChar QueryPerformanceCounter CompareFileTime CreateThreadpoolTimer GetSystemTimeAsFileTime GetProductInfo GetVersionExW Sleep AcquireSRWLockShared DeleteFileW FindClose FindFirstFileW FindNextFileW FlushFileBuffers GetFileAttributesW RemoveDirectoryW SetFileAttributesW SetFilePointerEx WriteFile AcquireSRWLockExclusive ReleaseSRWLockShared ReleaseSRWLockExclusive VerSetConditionMask LoadLibraryW FreeLibrary MoveFileExW WriteConsoleW GetWindowsDirectoryW GetComputerNameExW EnterCriticalSection GetTempPathW GlobalAlloc GetTempFileNameW SetStdHandle SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW FindFirstFileExW GetOEMCP GetLongPathNameW TerminateProcess GetCurrentProcess InitOnceComplete InitOnceBeginInitialize WideCharToMultiByte FormatMessageW GetProcAddress GetModuleHandleExW GetModuleHandleW GetACP IsValidCodePage GetModuleFileNameA CompareStringW GetConsoleMode GetConsoleOutputCP EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW DecodePointer HeapReAlloc HeapSize GetCurrentThreadId GetCurrentProcessId CreateSemaphoreExW CreateMutexExW LCMapStringW OpenSemaphoreW WaitForSingleObjectEx FlsFree WaitForSingleObject ReleaseMutex ReleaseSemaphore FlsSetValue FlsGetValue FlsAlloc GetFileType ExpandEnvironmentStringsW GetCommandLineW GetCommandLineA GetStdHandle ExitProcess LoadLibraryExW GlobalFree TlsFree TlsSetValue VerifyVersionInfoW TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount InterlockedPushEntrySList RtlUnwindEx GetStartupInfoW IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext InitializeSListHead GetProcessHeap HeapFree HeapAlloc SetLastError GetLastError CloseHandle OutputDebugStringW DebugBreak IsDebuggerPresent RaiseException GetSystemInfo VirtualProtect VirtualQuery LoadLibraryExA LCMapStringEx GetCPInfo CompareStringEx RtlPcToFileHeader GetStringTypeW WakeAllConditionVariable SleepConditionVariableSRW EncodePointer

advapi32

RegGetValueW RegDeleteKeyValueW RegOpenKeyExW RegCreateKeyExW OpenSCManagerW CloseServiceHandle RegSetValueExW StartServiceCtrlDispatcherW EventRegister EventUnregister EventSetInformation EventWriteTransfer GetSecurityDescriptorOwner GetSecurityDescriptorGroup GetSecurityDescriptorDacl LookupPrivilegeValueW AdjustTokenPrivileges OpenProcessToken SetNamedSecurityInfoW ConvertStringSecurityDescriptorToSecurityDescriptorW GetSecurityDescriptorSacl DestroyPrivateObjectSecurity ChangeServiceConfigW OpenServiceW StartServiceW RegCloseKey QueryServiceConfigW ControlService

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

api-ms-win-core-featurestaging-l1-1-0

SubscribeFeatureStateChangeNotification RecordFeatureError RecordFeatureUsage UnsubscribeFeatureStateChangeNotification GetFeatureEnabledState

api-ms-win-core-featurestaging-l1-1-1

GetFeatureVariant

api-ms-win-core-path-l1-1-0

PathCchCombine

userenv

GetAllUsersProfileDirectoryW

ws2_32

InetNtopW

iphlpapi

GetUnicastIpAddressEntry GetIfEntry2 FreeMibTable GetUnicastIpAddressTable

setupapi

SetupDiDestroyDeviceInfoList SetupDiEnumDeviceInfo SetupDiGetDeviceInterfaceDetailW SetupDiGetClassDevsW SetupDiGetDevicePropertyW SetupDiGetDeviceRegistryPropertyW SetupOpenInfFileW SetupDiEnumDeviceInterfaces SetupInstallFromInfSectionW SetupInstallServicesFromInfSectionW

bcrypt

BCryptCloseAlgorithmProvider BCryptDestroyHash

ntdll

RtlInitUnicodeString

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleExA

Name

.text

Size

476KB

Virtual Size

472KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

188KB

Virtual Size

186KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

16KB

Virtual Size

30KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

28KB

Virtual Size

24KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.didat

Size

4KB

Virtual Size

32B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

44KB

Virtual Size

40KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

576KB

Virtual Size

580KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-20_8e0fa90e6665ab285fdd372c3f5dd277_icedid_luca-stealer_njrat_stealc

kernel32

advapi32

version

api-ms-win-core-featurestaging-l1-1-0

api-ms-win-core-featurestaging-l1-1-1

api-ms-win-core-path-l1-1-0

userenv

ws2_32

iphlpapi

setupapi

bcrypt

ntdll

api-ms-win-core-libraryloader-l1-2-0

generic