2026-09-04_26b541d0a84e81279baf3b1b10725bd3_icedid_luca-stealer_njrat_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-04_26b541d0a84e81279baf3b1b10725bd3_icedid_luca-stealer_njrat_stealc
Size 11.5MB
Sample260905-tjqs6seq7t
SHA256 0a622c7c2fa691883a9ddaa860a205d8b42bcbf36fb84199d6a6649c7b1c7fd6
MD5 26b541d0a84e81279baf3b1b10725bd3
SHA1 ac39abf09a5a1845812fed67aca26fe89bb3d646
SHA512 620ea57b07d7c02190508f6e52a85e80873aed0cec3dec895f3cd5a1781efc688e5edaeedde7b543a9dbc1a8f5753c94be25791fd83ed6abdd70960a604a808a
SSDEEP 49152:2bCgEGJpU4ADZay34LWCdDG8NWqRCYVxEMCy8G2dCYPhJX9JtiprX5JaXBUU/sVV:2jDD4ZaoRkezy/OPmDql0ZJgCO
TLSH
T1BAC69E18D564A2FBD056FAB2931A5533E7B134529635E0E680C3AF732E6B235F67CB00
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-04_26b541d0a84e81279baf3b1b10725bd3_icedid_luca-stealer_njrat_stealc

File Explorer

2026-09-04_26b541d0a84e81279baf3b1b10725bd3_icedid_luca-stealer_njrat_stealc

.exe 11.5MB

2026-09-04_26b541d0a84e81279baf3b1b10725bd3_icedid_luca-stealer_njrat_stealc

IMPHASH d5bd152b9f761782321a3ad41beec476
SHA256 0a622c7c2fa691883a9ddaa860a205d8b42bcbf36fb84199d6a6649c7b1c7fd6
MD5 26b541d0a84e81279baf3b1b10725bd3
SHA1 ac39abf09a5a1845812fed67aca26fe89bb3d646
SHA512 620ea57b07d7c02190508f6e52a85e80873aed0cec3dec895f3cd5a1781efc688e5edaeedde7b543a9dbc1a8f5753c94be25791fd83ed6abdd70960a604a808a
SSDEEP 49152:2bCgEGJpU4ADZay34LWCdDG8NWqRCYVxEMCy8G2dCYPhJX9JtiprX5JaXBUU/sVV:2jDD4ZaoRkezy/OPmDql0ZJgCO
TLSH
T1BAC69E18D564A2FBD056FAB2931A5533E7B134529635E0E680C3AF732E6B235F67CB00
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

3465556

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\Administrador\Desktop\PetrusOptimizer\update_theme\x64\Release\update_theme.pdb

advapi32

RegQueryValueExW RegOpenKeyExW RegCloseKey RegSetValueExA RegCreateKeyExW ConvertStringSidToSidW SetNamedSecurityInfoW SetEntriesInAclW RegDeleteValueW RegSetValueExW RegDeleteKeyW RegEnumKeyW FreeSid OpenProcessToken AllocateAndInitializeSid AdjustTokenPrivileges LookupPrivilegeValueW RegDeleteTreeW

crypt32

CryptBinaryToStringA

shell32

SHGetFolderPathW ShellExecuteW CommandLineToArgvW

shlwapi

SHDeleteKeyW

kernel32

SetEndOfFile WriteConsoleW HeapSize SetStdHandle GetProcessHeap GetCommandLineW GetModuleFileNameW GetFileAttributesW LocalFree ExitProcess CreateFileW CloseHandle CreateMutexW Sleep GetLastError FindFirstFileW FindNextFileW TerminateProcess FindClose WaitForSingleObject OpenProcess SetFileAttributesW CreateToolhelp32Snapshot Process32NextW DeleteFileW Process32FirstW CreateProcessW SizeofResource GetCurrentProcess LockResource LoadResource FindResourceW GetExitCodeProcess MoveFileExW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetOEMCP GetACP IsValidCodePage HeapReAlloc ReadConsoleW ReadFile EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW FormatMessageA WideCharToMultiByte MultiByteToWideChar GetLocaleInfoEx GetStringTypeW CreateDirectoryW FindFirstFileExW GetFileAttributesExW SetFileInformationByHandle AreFileApisANSI GetModuleHandleW GetProcAddress GetFileInformationByHandleEx EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer LCMapStringEx GetSystemTimeAsFileTime GetCPInfo ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId InitializeSListHead RtlUnwindEx RtlPcToFileHeader RaiseException SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW RemoveDirectoryW GetModuleHandleExW GetStdHandle WriteFile HeapAlloc HeapFree GetFileType GetFileSizeEx SetFilePointerEx FlushFileBuffers GetConsoleOutputCP GetConsoleMode FlsAlloc FlsGetValue FlsSetValue FlsFree VirtualProtect RtlUnwind

ole32

CoSetProxyBlanket CoInitializeEx CoUninitialize CoCreateInstance

oleaut32

VariantClear SysFreeString SysAllocString VariantInit

wevtapi

EvtClose EvtOpenChannelConfig EvtSetChannelConfigProperty EvtSaveChannelConfig

Name

.text

Size

3.6MB

Virtual Size

3.6MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

175KB

Virtual Size

175KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

7KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

67KB

Virtual Size

66KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

7.7MB

Virtual Size

7.7MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-04_26b541d0a84e81279baf3b1b10725bd3_icedid_luca-stealer_njrat_stealc

advapi32

crypt32

shell32

shlwapi

kernel32

ole32

oleaut32

wevtapi

generic