2026-08-28_b10407f8ca5c65c3f0ac8491709f0da7_icedid_luca-stealer_njrat_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-28_b10407f8ca5c65c3f0ac8491709f0da7_icedid_luca-stealer_njrat_stealc
Size 3.8MB
Sample260828-l58bcace48
SHA256 5059a00f50619125979a929de3b3b3aa87370260a87f625373bea9e80ec6c35d
MD5 b10407f8ca5c65c3f0ac8491709f0da7
SHA1 7e99020e47c2f8105051951ed397c59eb122a278
SHA512 97d51d5946f11357f1391ffca1e99fca06e0c13dd97f8ba51af0f9bdd0555294bbec9526458358740e17f6876fbdae4f0e4c1dc3118d9aa1fea3af0e200a97b3
SSDEEP 49152:RoQy3eYXx8/2DjhVqFyZIWOjbeWzkDszUo+1Dt1SmLR1pk3nj/ofzF:3hMEbeWzc5RR83j/4F
TLSH
T14C06CE17F39542D8E537D57C8AA68707F372B415072293CF02E41BA9AF976E00E7A392
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-28_b10407f8ca5c65c3f0ac8491709f0da7_icedid_luca-stealer_njrat_stealc

File Explorer

2026-08-28_b10407f8ca5c65c3f0ac8491709f0da7_icedid_luca-stealer_njrat_stealc

.exe 3.8MB

2026-08-28_b10407f8ca5c65c3f0ac8491709f0da7_icedid_luca-stealer_njrat_stealc

IMPHASH 85a4dca5025ee38db2c886ebc630d663
SHA256 5059a00f50619125979a929de3b3b3aa87370260a87f625373bea9e80ec6c35d
MD5 b10407f8ca5c65c3f0ac8491709f0da7
SHA1 7e99020e47c2f8105051951ed397c59eb122a278
SHA512 97d51d5946f11357f1391ffca1e99fca06e0c13dd97f8ba51af0f9bdd0555294bbec9526458358740e17f6876fbdae4f0e4c1dc3118d9aa1fea3af0e200a97b3
SSDEEP 49152:RoQy3eYXx8/2DjhVqFyZIWOjbeWzkDszUo+1Dt1SmLR1pk3nj/ofzF:3hMEbeWzc5RR83j/4F
TLSH
T14C06CE17F39542D8E537D57C8AA68707F372B415072293CF02E41BA9AF976E00E7A392
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1099608

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\Sources\Mine\cs2\bin\velocity-loader.pdb

d3d11

D3D11CreateDeviceAndSwapChain

winhttp

WinHttpOpenRequest WinHttpQueryDataAvailable WinHttpReadData WinHttpConnect WinHttpCloseHandle WinHttpOpen WinHttpCrackUrl WinHttpSendRequest WinHttpReceiveResponse WinHttpSetTimeouts WinHttpQueryHeaders

bcrypt

BCryptHashData BCryptCreateHash BCryptCloseAlgorithmProvider BCryptOpenAlgorithmProvider BCryptFinishHash BCryptDestroyHash BCryptGenRandom

iphlpapi

GetAdaptersAddresses

dwmapi

DwmSetWindowAttribute

shell32

SHGetKnownFolderPath

kernel32

GetACP IsValidCodePage OutputDebugStringW SetConsoleCtrlHandler ReadConsoleW SetFilePointerEx GetOEMCP GetConsoleOutputCP FlushFileBuffers EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW GetConsoleMode GetCommandLineA LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW LocalFree K32EnumProcessModules K32GetModuleBaseNameW GetModuleHandleW MultiByteToWideChar QueryPerformanceCounter QueryPerformanceFrequency GlobalAlloc GlobalUnlock GlobalLock CloseHandle WaitForSingleObject CreateRemoteThread VirtualAllocEx ReadProcessMemory WriteProcessMemory VirtualFreeEx GetProcAddress OpenProcess IsWow64Process CreateToolhelp32Snapshot Process32FirstW Process32NextW GetTempPathW GetSystemDirectoryW IsDebuggerPresent GetSystemTimeAsFileTime CreateFileW GetFileSizeEx GetCommandLineW DeviceIoControl GetCurrentProcess FreeEnvironmentStringsW GetCurrentThread ProcessIdToSessionId GetThreadContext GetTickCount64 GetSystemFirmwareTable GetModuleFileNameW QueryFullProcessImageNameW GetComputerNameW GetTimeZoneInformation WideCharToMultiByte GetUserDefaultLocaleName GetLastError CreateFileA HeapAlloc HeapReAlloc HeapFree GetProcessHeap MapViewOfFile UnmapViewOfFile CreateFileMappingA VirtualProtect IsThreadAFiber FlsFree FlsSetValue FlsGetValue FlsAlloc WriteFile ExitProcess WriteConsoleW GetFileType GetStdHandle GetModuleHandleExW FreeLibraryAndExitThread ResumeThread ExitThread CreateThread LoadLibraryExW FreeLibrary TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount RtlUnwind SetLastError InterlockedFlushSList InterlockedPushEntrySList ReadFile GetEnvironmentStringsW SetEnvironmentVariableW SetStdHandle RtlUnwindEx RaiseException RtlPcToFileHeader GetCPInfo CompareStringEx WakeConditionVariable CloseThreadpoolWait HeapSize GetCurrentProcessId RtlCaptureContext ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW SetEndOfFile RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent GetStartupInfoW GetCurrentThreadId InitializeSListHead FormatMessageA GetLocaleInfoEx SetCurrentDirectoryW GetCurrentDirectoryW CreateDirectoryW FindClose FindFirstFileW FindFirstFileExW FindNextFileW GetDiskFreeSpaceExW GetFileAttributesW GetFileAttributesExW GetFileInformationByHandle GetFinalPathNameByHandleW GetFullPathNameW SetFileAttributesW SetFileInformationByHandle SetFileTime AreFileApisANSI CreateDirectoryExW CopyFileW MoveFileExW CreateHardLinkW GetFileInformationByHandleEx CreateSymbolicLinkW WaitForSingleObjectEx Sleep SwitchToThread GetExitCodeThread GetNativeSystemInfo ReleaseSRWLockShared AcquireSRWLockShared TryAcquireSRWLockExclusive TryAcquireSRWLockShared InitOnceBeginInitialize InitOnceComplete GetStringTypeW EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer LCMapStringEx InitOnceExecuteOnce CreateEventExW CreateSemaphoreExW FlushProcessWriteBuffers GetCurrentProcessorNumber FreeLibraryWhenCallbackReturns CreateThreadpoolTimer SetThreadpoolTimer WaitForThreadpoolTimerCallbacks CloseThreadpoolTimer CreateThreadpoolWait SetThreadpoolWait

user32

GetSystemMetrics WaitForInputIdle ShowWindow SetCursorPos SetCursor MapVirtualKeyW EmptyClipboard GetClipboardData SetClipboardData CloseClipboard OpenClipboard LoadIconW ScreenToClient MessageBoxW AdjustWindowRect UpdateWindow DestroyWindow CreateWindowExW RegisterClassExW PostQuitMessage DefWindowProcW PeekMessageW DispatchMessageW TranslateMessage LoadCursorW

gdi32

GetStockObject

advapi32

GetUserNameW

ole32

CoUninitialize CreateStreamOnHGlobal CoCreateInstance PropVariantClear CoInitializeEx CoTaskMemFree

crypt32

CryptProtectData CryptUnprotectData

Name

.text

Size

1.9MB

Virtual Size

1.9MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

446KB

Virtual Size

446KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

1.3MB

Virtual Size

1.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

92KB

Virtual Size

91KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

7KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-28_b10407f8ca5c65c3f0ac8491709f0da7_icedid_luca-stealer_njrat_stealc

d3d11

winhttp

bcrypt

iphlpapi

dwmapi

shell32

kernel32

user32

gdi32

advapi32

ole32

crypt32

generic