2026-08-24_42f9c66552e4212e4257da602037c4ad_icedid_luca-stealer_njrat_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-24_42f9c66552e4212e4257da602037c4ad_icedid_luca-stealer_njrat_stealc
Size 1.4MB
Sample260825-rwz69stdkh
SHA256 3ae70f172826b1c9c764b50d60e973be98a7a31cbbb0ac5a1a2a9ca33321b0f8
MD5 42f9c66552e4212e4257da602037c4ad
SHA1 e1a4cb87982ed80bcfe6765110f57d11efd9967b
SHA512 5badc7fae1d638a17aaebe9d407b2ca392975fb080d5afe0451a179db895edeb5166677340c717fc81ce1694073960bb94e38229f59f7590683e44f5abd8c6b1
SSDEEP 24576:pbtigwnF30gQbXjm93LUzKfojKNsVFyxknw4FYnshx8OfVe247:omgmXjgUyog4Qx4x8EVep
TLSH
T13065BF2EB7EC11F5D0BBD175CE620526FBB27815173196AF03A1525A2F37AA04E3E312
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-24_42f9c66552e4212e4257da602037c4ad_icedid_luca-stealer_njrat_stealc

File Explorer

2026-08-24_42f9c66552e4212e4257da602037c4ad_icedid_luca-stealer_njrat_stealc

.exe 1.4MB

2026-08-24_42f9c66552e4212e4257da602037c4ad_icedid_luca-stealer_njrat_stealc

IMPHASH 8f277bb40bff3becd26d90121e144f65
SHA256 3ae70f172826b1c9c764b50d60e973be98a7a31cbbb0ac5a1a2a9ca33321b0f8
MD5 42f9c66552e4212e4257da602037c4ad
SHA1 e1a4cb87982ed80bcfe6765110f57d11efd9967b
SHA512 5badc7fae1d638a17aaebe9d407b2ca392975fb080d5afe0451a179db895edeb5166677340c717fc81ce1694073960bb94e38229f59f7590683e44f5abd8c6b1
SSDEEP 24576:pbtigwnF30gQbXjm93LUzKfojKNsVFyxknw4FYnshx8OfVe247:omgmXjgUyog4Qx4x8EVep
TLSH
T13065BF2EB7EC11F5D0BBD175CE620526FBB27815173196AF03A1525A2F37AA04E3E312
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

315840

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

MsSense.pdb

kernel32

CompareFileTime FindVolumeClose FindNextVolumeW FindFirstVolumeW CreateFileW DeleteFileW FindClose FindFirstFileW FindNextFileW FlushFileBuffers GetFileAttributesW RemoveDirectoryW SetFileAttributesW SetFilePointerEx WriteFile QueryPerformanceCounter MultiByteToWideChar DeviceIoControl DeleteCriticalSection MoveFileExW InitializeCriticalSectionEx LeaveCriticalSection EnterCriticalSection GetWindowsDirectoryW GetComputerNameExW GetVolumePathNamesForVolumeNameW GetVolumeNameForVolumeMountPointW GlobalAlloc GlobalFree GetTempPathW GetTempFileNameW GetLongPathNameW ExpandEnvironmentStringsW QueryDosDeviceW GetVolumeInformationW VerifyVersionInfoW GetModuleFileNameW CloseThreadpoolTimer WaitForThreadpoolTimerCallbacks SetThreadpoolTimer CreateThreadpoolTimer GetProductInfo GetVersionExW Sleep CompareStringW DecodePointer HeapReAlloc HeapSize AcquireSRWLockShared AcquireSRWLockExclusive ReleaseSRWLockShared ReleaseSRWLockExclusive VerSetConditionMask GetSystemTimeAsFileTime LoadLibraryW FreeLibrary TerminateProcess GetLogicalDrives IsDebuggerPresent GetCurrentProcess InitOnceComplete InitOnceBeginInitialize WideCharToMultiByte FormatMessageW GetProcAddress GetModuleHandleExW GetModuleHandleW GetModuleFileNameA GetCurrentThreadId GetCurrentProcessId WriteConsoleW RaiseException GetSystemInfo VirtualProtect VirtualQuery LoadLibraryExA SetEnvironmentVariableW LoadLibraryExW InitializeCriticalSectionAndSpinCount GetModuleHandleExA CreateSemaphoreExW CreateMutexExW OpenSemaphoreW WaitForSingleObjectEx WaitForSingleObject ReleaseMutex ReleaseSemaphore GetProcessHeap HeapFree HeapAlloc SetLastError GetLastError CloseHandle OutputDebugStringW DebugBreak GetDriveTypeW SetStdHandle FreeEnvironmentStringsW GetEnvironmentStringsW FindFirstFileExW GetConsoleMode GetConsoleOutputCP RtlPcToFileHeader GetStringTypeW WakeAllConditionVariable SleepConditionVariableSRW EncodePointer CompareStringEx GetCPInfo LCMapStringEx InitializeSListHead RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent GetStartupInfoW RtlUnwindEx InterlockedPushEntrySList TlsAlloc TlsGetValue TlsSetValue TlsFree IsValidCodePage GetACP GetOEMCP ExitProcess GetStdHandle GetCommandLineA GetCommandLineW GetFileType FlsAlloc FlsGetValue FlsSetValue FlsFree LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW

advapi32

RegGetValueW RegDeleteKeyValueW RegOpenKeyExW RegCreateKeyExW ChangeServiceConfigW ControlService QueryServiceConfigW StartServiceW OpenServiceW OpenSCManagerW CloseServiceHandle StartServiceCtrlDispatcherW EventRegister EventUnregister EventSetInformation EventWriteTransfer RegSetValueExW RegCloseKey DestroyPrivateObjectSecurity GetSecurityDescriptorSacl ConvertStringSecurityDescriptorToSecurityDescriptorW SetNamedSecurityInfoW GetSecurityDescriptorOwner GetSecurityDescriptorGroup GetSecurityDescriptorDacl LookupPrivilegeValueW AdjustTokenPrivileges OpenProcessToken

version

VerQueryValueW GetFileVersionInfoW GetFileVersionInfoSizeW

api-ms-win-core-featurestaging-l1-1-0

UnsubscribeFeatureStateChangeNotification RecordFeatureError GetFeatureEnabledState RecordFeatureUsage SubscribeFeatureStateChangeNotification

api-ms-win-core-featurestaging-l1-1-1

GetFeatureVariant

api-ms-win-core-path-l1-1-0

PathCchCombine

userenv

GetAllUsersProfileDirectoryW

ws2_32

InetNtopW

iphlpapi

GetUnicastIpAddressEntry GetIfEntry2 GetUnicastIpAddressTable FreeMibTable

setupapi

SetupInstallFromInfSectionW SetupDiEnumDeviceInfo SetupDiDestroyDeviceInfoList SetupInstallServicesFromInfSectionW SetupDiGetDevicePropertyW SetupOpenInfFileW SetupDiGetDeviceRegistryPropertyW SetupDiGetClassDevsW SetupDiGetDeviceInterfaceDetailW SetupDiEnumDeviceInterfaces

bcrypt

BCryptDestroyHash BCryptCloseAlgorithmProvider

ntdll

RtlInitUnicodeString

Name

.text

Size

520KB

Virtual Size

517KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

208KB

Virtual Size

205KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

20KB

Virtual Size

31KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

28KB

Virtual Size

25KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.didat

Size

4KB

Virtual Size

32B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.fptable

Size

4KB

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

44KB

Virtual Size

40KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

576KB

Virtual Size

580KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-24_42f9c66552e4212e4257da602037c4ad_icedid_luca-stealer_njrat_stealc

kernel32

advapi32

version

api-ms-win-core-featurestaging-l1-1-0

api-ms-win-core-featurestaging-l1-1-1

api-ms-win-core-path-l1-1-0

userenv

ws2_32

iphlpapi

setupapi

bcrypt

ntdll

generic