2026-08-22_5debf629c21768e7fb89cccbc5579dfa_icedid_luca-stealer_moonclient_njrat

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-22_5debf629c21768e7fb89cccbc5579dfa_icedid_luca-stealer_moonclient_njrat
Size 50.6MB
Sample260823-jp2gray1dv
SHA256 eceae6f623ffc2c46db77ae3070eb5f7d3f8761a8701b32bc603154b54ad45bf
MD5 5debf629c21768e7fb89cccbc5579dfa
SHA1 3fa7ff23a22714ccef4c0bfb75e05d9a36faabc5
SHA512 59d06679c10de6f10ee783aef699dd94c8ad4a53639fa807aff2dff34ccaa82ab2aca81dcafa6349314f73e565f819a0fa0f6ec2f283bb7c936c8ae297c579fe
SSDEEP 786432:XptcUFtO8ZNYAF6nm4d9JfD3+kaiaCePAXkff6yauJXnmzkLv1j3ekw5/i9cP4nG:tFtPqAQnH9OkDy9f6fYXr5e55/h2p+
TLSH
T180C71246E2F901E8D57BC178C6675617E7B13419173097DF66A48AA82F33BE0AE3D320
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-22_5debf629c21768e7fb89cccbc5579dfa_icedid_luca-stealer_moonclient_njrat

File Explorer

2026-08-22_5debf629c21768e7fb89cccbc5579dfa_icedid_luca-stealer_moonclient_njrat

.exe 50.6MB

2026-08-22_5debf629c21768e7fb89cccbc5579dfa_icedid_luca-stealer_moonclient_njrat

IMPHASH bb83195c4a729460b8b83e4d266360a8
SHA256 eceae6f623ffc2c46db77ae3070eb5f7d3f8761a8701b32bc603154b54ad45bf
MD5 5debf629c21768e7fb89cccbc5579dfa
SHA1 3fa7ff23a22714ccef4c0bfb75e05d9a36faabc5
SHA512 59d06679c10de6f10ee783aef699dd94c8ad4a53639fa807aff2dff34ccaa82ab2aca81dcafa6349314f73e565f819a0fa0f6ec2f283bb7c936c8ae297c579fe
SSDEEP 786432:XptcUFtO8ZNYAF6nm4d9JfD3+kaiaCePAXkff6yauJXnmzkLv1j3ekw5/i9cP4nG:tFtPqAQnH9OkDy9f6fYXr5e55/h2p+
TLSH
T180C71246E2F901E8D57BC178C6675617E7B13419173097DF66A48AA82F33BE0AE3D320
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

375792

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

d3d11

D3D11CreateDeviceAndSwapChain

d3dcompiler_47

D3DCompile

dwmapi

DwmSetWindowAttribute DwmExtendFrameIntoClientArea

winmm

waveOutUnprepareHeader waveOutPrepareHeader waveOutOpen PlaySoundA waveOutWrite

advapi32

AllocateAndInitializeSid CheckTokenMembership FreeSid

ntdll

RtlLookupFunctionEntry RtlVirtualUnwind VerSetConditionMask RtlCaptureContext

kernel32

WakeAllConditionVariable SleepConditionVariableSRW IsDebuggerPresent GetStartupInfoW GetModuleHandleW SetUnhandledExceptionFilter UnhandledExceptionFilter CreateDirectoryA CreateFileA WriteFile GetTempPathA CloseHandle GetLastError QueryPerformanceCounter LoadResource LockResource SizeofResource FindResourceA GetFileAttributesA CreateProcessA GetCurrentProcessId Process32First Process32Next DeleteFileA GetFileSize ReleaseSRWLockExclusive SetFilePointer GlobalAlloc GlobalUnlock GlobalLock FindClose FindFirstFileA FindNextFileA RemoveDirectoryA SetFileAttributesA Beep WaitForSingleObject Sleep GetExitCodeProcess CopyFileA GetWindowsDirectoryA OutputDebugStringA GlobalFree MultiByteToWideChar WideCharToMultiByte QueryPerformanceFrequency FreeLibrary GetModuleHandleA GetProcAddress LoadLibraryA GetLocaleInfoA IsDBCSLeadByte GetCurrentThreadId AcquireSRWLockExclusive GetCurrentProcess TerminateProcess ReadFile IsProcessorFeaturePresent GetSystemTimeAsFileTime CreateToolhelp32Snapshot InitializeSListHead

user32

SetProcessDPIAware ScreenToClient ClientToScreen GetCursorPos SetCursor SetCursorPos GetClientRect GetForegroundWindow IsWindowUnicode ReleaseCapture SetCapture GetCapture SetWindowPos GetMessageExtraInfo TrackMouseEvent GetKeyboardLayout GetClipboardData LoadIconW LoadCursorA GetSystemMetrics DestroyWindow CreateWindowExW RegisterClassExW UnregisterClassW PostQuitMessage DefWindowProcW SendMessageW PeekMessageA DispatchMessageA TranslateMessage FindWindowW GetKeyState EmptyClipboard SetClipboardData CloseClipboard OpenClipboard

shell32

SHGetFolderPathA ShellExecuteA ShellExecuteW

msvcp140

_Thrd_detach ?_Throw_Cpp_error@std@@YAXH@Z _Cnd_do_broadcast_at_thread_exit ?_Xlength_error@std@@YAXPEBD@Z

imm32

ImmGetContext ImmSetCompositionWindow ImmSetCandidateWindow ImmReleaseContext

vcruntime140

__std_terminate memcpy memmove __std_exception_copy __std_exception_destroy _CxxThrowException memchr memcmp memset strchr strstr __current_exception __current_exception_context __C_specific_handler

vcruntime140_1

__CxxFrameHandler4

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vsscanf _wfopen fflush __stdio_common_vfprintf ftell fseek fopen fgets ferror feof fclose fgetc __stdio_common_vsprintf ungetc _set_fmode fwrite fread __p__commode __acrt_iob_func

api-ms-win-crt-runtime-l1-1-0

_register_onexit_function _cexit _seh_filter_exe _set_app_type _initialize_narrow_environment terminate _beginthreadex _register_thread_local_exe_atexit_callback _configure_narrow_argv _initialize_onexit_table _get_narrow_winmain_command_line _invoke_watson _initterm _initterm_e exit _exit _c_exit _crt_atexit

api-ms-win-crt-string-l1-1-0

_stricmp strcmp strncmp strncpy strlen

api-ms-win-crt-heap-l1-1-0

_set_new_mode realloc malloc free _callnewh

api-ms-win-crt-utility-l1-1-0

qsort abs _lrotl

api-ms-win-crt-convert-l1-1-0

atoi strtol

api-ms-win-crt-math-l1-1-0

acosf __setusermatherr fabs fmodf sqrtf sinf cosf ceilf ldexp pow

api-ms-win-crt-time-l1-1-0

_localtime64_s _time64

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-22_5debf629c21768e7fb89cccbc5579dfa_icedid_luca-stealer_moonclient_njrat

d3d11

d3dcompiler_47

dwmapi

winmm

advapi32

ntdll

kernel32

user32

shell32

msvcp140

imm32

vcruntime140

vcruntime140_1

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic