2026-08-22_e4352ec3f8b1996fc0f1e5d3a4aa0aee_icedid_luca-stealer_njrat_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-22_e4352ec3f8b1996fc0f1e5d3a4aa0aee_icedid_luca-stealer_njrat_stealc
Size 1.9MB
Sample260822-2d3vjsgf46
SHA256 17ba02eca505d5ee902929c80ab4dea24bf8126e8734d63bdae41e461e5531b4
MD5 e4352ec3f8b1996fc0f1e5d3a4aa0aee
SHA1 68fb8a8ef227da437e93abb42cca68b39af13647
SHA512 b16cda22965a5b52e8741a788879d9b9a0513d3775a190ff9ee36dac1cf4a7fe5613f0514ec81bc3eeafb5a70324f110baca38c0dc9469d8de9e7c3360ebb665
SSDEEP 12288:HAW7/VqQ3/TI/F6Lg4lyCJIzF2zwAy10JjnOhiD4msiXM4JuR7cMm53FtrpMFu:17NqZ6LgLCaEzwAyujOhcid/RrmpF
TLSH
T11795E01AEBA505F9E07BD279C8A34501FB713C4E03A4AACF179446AA1F637E09E3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-22_e4352ec3f8b1996fc0f1e5d3a4aa0aee_icedid_luca-stealer_njrat_stealc

File Explorer

2026-08-22_e4352ec3f8b1996fc0f1e5d3a4aa0aee_icedid_luca-stealer_njrat_stealc

.exe 1.9MB

2026-08-22_e4352ec3f8b1996fc0f1e5d3a4aa0aee_icedid_luca-stealer_njrat_stealc

IMPHASH 10f694f29d5e125f34944eefd2fb781d
SHA256 17ba02eca505d5ee902929c80ab4dea24bf8126e8734d63bdae41e461e5531b4
MD5 e4352ec3f8b1996fc0f1e5d3a4aa0aee
SHA1 68fb8a8ef227da437e93abb42cca68b39af13647
SHA512 b16cda22965a5b52e8741a788879d9b9a0513d3775a190ff9ee36dac1cf4a7fe5613f0514ec81bc3eeafb5a70324f110baca38c0dc9469d8de9e7c3360ebb665
SSDEEP 12288:HAW7/VqQ3/TI/F6Lg4lyCJIzF2zwAy10JjnOhiD4msiXM4JuR7cMm53FtrpMFu:17NqZ6LgLCaEzwAyujOhcid/RrmpF
TLSH
T11795E01AEBA505F9E07BD279C8A34501FB713C4E03A4AACF179446AA1F637E09E3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

146240

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\__w\1\s\src\GameInput\build\amd64\exe\gameinputredistservice\RelWithDebInfo\GameInputRedistService.pdb

api-ms-win-core-debug-l1-1-0

DebugBreak OutputDebugStringW IsDebuggerPresent

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-errorhandling-l1-1-0

RaiseException GetLastError SetLastError UnhandledExceptionFilter SetUnhandledExceptionFilter

api-ms-win-core-heap-l1-1-0

HeapReAlloc HeapFree HeapSize GetProcessHeap HeapAlloc

api-ms-win-core-synch-l1-1-0

InitializeCriticalSectionEx CreateMutexExW ReleaseSRWLockExclusive ReleaseSRWLockShared AcquireSRWLockExclusive WaitForSingleObject ReleaseSemaphore ReleaseMutex SetEvent AcquireSRWLockShared CreateSemaphoreExW OpenSemaphoreW CreateEventExW EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TryAcquireSRWLockExclusive WaitForSingleObjectEx

api-ms-win-core-processthreads-l1-1-0

TlsSetValue GetExitCodeThread TlsGetValue TlsAlloc TlsFree GetCurrentThreadId GetStartupInfoW TerminateProcess GetCurrentProcessId CreateProcessAsUserW GetProcessId ProcessIdToSessionId GetCurrentProcess ExitProcess CreateThread ExitThread

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleW GetModuleFileNameW FreeLibrary GetProcAddress GetModuleFileNameA FreeLibraryAndExitThread LoadLibraryExW GetModuleHandleExW

api-ms-win-core-localization-l1-2-0

FormatMessageW LCMapStringW IsValidCodePage GetCPInfo GetOEMCP GetACP

api-ms-win-core-string-l1-1-0

GetStringTypeW MultiByteToWideChar WideCharToMultiByte

api-ms-win-core-debug-l1-1-1

CheckRemoteDebuggerPresent

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressSingle WakeAllConditionVariable

api-ms-win-core-interlocked-l1-1-0

InterlockedPushEntrySList InterlockedPopEntrySList InterlockedFlushSList InitializeSListHead

api-ms-win-core-sysinfo-l1-1-0

GetSystemDirectoryW GetSystemTimeAsFileTime

api-ms-win-core-threadpool-l1-2-0

CloseThreadpoolTimer CreateThreadpoolTimer SetThreadpoolTimer WaitForThreadpoolTimerCallbacks

api-ms-win-core-com-l1-1-0

CoInitializeEx CoGetCallContext CoUninitialize CoResumeClassObjects CoCreateFreeThreadedMarshaler CoTaskMemFree CoRegisterClassObject CoRevokeClassObject StringFromCLSID CoInitializeSecurity CoEnableCallCancellation CoCancelCall CoDisableCallCancellation

api-ms-win-eventing-provider-l1-1-0

EventUnregister EventRegister EventSetInformation EventWriteTransfer

api-ms-win-core-file-l1-1-0

WriteFile GetFileType ReadFile FindFirstFileExW FlushFileBuffers SetFileAttributesW SetFilePointerEx GetTempFileNameW GetFileAttributesW GetFullPathNameW CreateFileW FindClose FindNextFileW DeleteFileW GetVolumePathNameW

api-ms-win-core-file-l2-1-2

CopyFileW

api-ms-win-service-core-l1-1-0

StartServiceCtrlDispatcherW RegisterServiceCtrlHandlerExW SetServiceStatus

api-ms-win-core-registry-l1-1-0

RegCreateKeyExW RegEnumValueW RegEnumKeyExW RegQueryValueExW RegSetValueExW RegDeleteTreeW RegGetValueW RegCloseKey RegOpenKeyExW

api-ms-win-core-processthreads-l1-1-1

OpenProcess IsProcessorFeaturePresent

api-ms-win-core-synch-l1-2-1

WaitForMultipleObjects

api-ms-win-core-heap-l2-1-0

LocalFree

api-ms-win-service-management-l2-1-0

ChangeServiceConfig2W

api-ms-win-service-management-l1-1-0

OpenServiceW CreateServiceW CloseServiceHandle OpenSCManagerW DeleteService

api-ms-win-security-sddl-l1-1-0

ConvertStringSecurityDescriptorToSecurityDescriptorW

api-ms-win-core-libraryloader-l1-2-1

LoadLibraryW

api-ms-win-core-wow64-l1-1-1

GetSystemWow64DirectoryW

api-ms-win-security-base-l1-1-0

GetSecurityDescriptorOwner GetSecurityDescriptorGroup GetSecurityDescriptorDacl GetSecurityDescriptorSacl

api-ms-win-core-psapi-l1-1-0

QueryFullProcessImageNameW

api-ms-win-core-sysinfo-l1-2-0

GetSystemTimePreciseAsFileTime

api-ms-win-core-file-l2-1-0

MoveFileExW CopyFileExW

api-ms-win-core-namedpipe-l1-1-0

CreateNamedPipeW

ntdll

RtlFirstEntrySList

shlwapi

PathFindFileNameW

api-ms-win-security-provider-l1-1-0

SetNamedSecurityInfoW GetNamedSecurityInfoW

wtsapi32

WTSFreeMemory WTSQueryUserToken WTSEnumerateSessionsW

user32

OpenInputDesktop CloseDesktop GetUserObjectInformationW

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-rtlsupport-l1-1-0

RtlPcToFileHeader RtlLookupFunctionEntry RtlUnwindEx RtlCaptureContext RtlVirtualUnwind

api-ms-win-core-util-l1-1-0

EncodePointer

api-ms-win-core-processenvironment-l1-1-0

SetStdHandle GetCommandLineW GetCommandLineA GetStdHandle GetEnvironmentStringsW FreeEnvironmentStringsW

api-ms-win-core-fibers-l1-1-0

FlsAlloc FlsGetValue FlsSetValue FlsFree

api-ms-win-core-memory-l1-1-0

VirtualProtect

api-ms-win-core-console-l1-1-0

GetConsoleOutputCP GetConsoleMode WriteConsoleW

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory

api-ms-win-core-winrt-error-l1-1-1

RoOriginateLanguageException

oleaut32

SetErrorInfo GetErrorInfo SysStringLen SysFreeString

Name

.text

Size

259KB

Virtual Size

258KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

98KB

Virtual Size

98KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

6KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

13KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

1.5MB

Virtual Size

1.5MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-22_e4352ec3f8b1996fc0f1e5d3a4aa0aee_icedid_luca-stealer_njrat_stealc

api-ms-win-core-debug-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-debug-l1-1-1

api-ms-win-core-synch-l1-2-0

api-ms-win-core-interlocked-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-threadpool-l1-2-0

api-ms-win-core-com-l1-1-0

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-file-l1-1-0

api-ms-win-core-file-l2-1-2

api-ms-win-service-core-l1-1-0

api-ms-win-core-registry-l1-1-0

api-ms-win-core-processthreads-l1-1-1

api-ms-win-core-synch-l1-2-1

api-ms-win-core-heap-l2-1-0

api-ms-win-service-management-l2-1-0

api-ms-win-service-management-l1-1-0

api-ms-win-security-sddl-l1-1-0

api-ms-win-core-libraryloader-l1-2-1

api-ms-win-core-wow64-l1-1-1

api-ms-win-security-base-l1-1-0

api-ms-win-core-psapi-l1-1-0

api-ms-win-core-sysinfo-l1-2-0

api-ms-win-core-file-l2-1-0

api-ms-win-core-namedpipe-l1-1-0

ntdll

shlwapi

api-ms-win-security-provider-l1-1-0

wtsapi32

user32

api-ms-win-core-profile-l1-1-0

api-ms-win-core-rtlsupport-l1-1-0

api-ms-win-core-util-l1-1-0

api-ms-win-core-processenvironment-l1-1-0

api-ms-win-core-fibers-l1-1-0

api-ms-win-core-memory-l1-1-0

api-ms-win-core-console-l1-1-0

api-ms-win-core-winrt-l1-1-0

api-ms-win-core-winrt-error-l1-1-1

oleaut32

generic