2026-09-08_84170d745f0f7b64efd9ba4cfede23b0_icedid_luca-stealer_njrat_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-08_84170d745f0f7b64efd9ba4cfede23b0_icedid_luca-stealer_njrat_stealc
Size 1.4MB
Sample260908-shda1ssgra
SHA256 ad59dd283737e53eced06195900dc6bb4aec01356881d4f9b3920d643285cfa5
MD5 84170d745f0f7b64efd9ba4cfede23b0
SHA1 cd3812fac140e75cd3eec735356e0649283c2eda
SHA512 c9c1cfc0cce5deb5f191771546297237f05565b040cf2821488f3a10d4369c860f5500745df935c3b4d29660927e6cd951a0ffd565e6b9097c1f264e61ba402b
SSDEEP 24576:6/EfRN71xNMV+L6FQZLgXe4i7ojhsP5Lgrk1TWb4AN5:6/EXpxo+AUSe30jaNf1TWbdz
TLSH
T19D65C02EA79C42FDD076D2B9C6825602FB71B806532156CB47E049A93F7B9E04F7E312
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-08_84170d745f0f7b64efd9ba4cfede23b0_icedid_luca-stealer_njrat_stealc

File Explorer

2026-09-08_84170d745f0f7b64efd9ba4cfede23b0_icedid_luca-stealer_njrat_stealc

.exe 1.4MB

2026-09-08_84170d745f0f7b64efd9ba4cfede23b0_icedid_luca-stealer_njrat_stealc

IMPHASH 8b67ae582dfc2bf4c22245cd810d25c0
SHA256 ad59dd283737e53eced06195900dc6bb4aec01356881d4f9b3920d643285cfa5
MD5 84170d745f0f7b64efd9ba4cfede23b0
SHA1 cd3812fac140e75cd3eec735356e0649283c2eda
SHA512 c9c1cfc0cce5deb5f191771546297237f05565b040cf2821488f3a10d4369c860f5500745df935c3b4d29660927e6cd951a0ffd565e6b9097c1f264e61ba402b
SSDEEP 24576:6/EfRN71xNMV+L6FQZLgXe4i7ojhsP5Lgrk1TWb4AN5:6/EXpxo+AUSe30jaNf1TWbdz
TLSH
T19D65C02EA79C42FDD076D2B9C6825602FB71B806532156CB47E049A93F7B9E04F7E312
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

359696

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Jenkins\workspace\ebAdvisor_WABinary_release_4.1.2\build\x64\Release\ServiceHost.pdb

kernel32

GetTickCount64 WTSGetActiveConsoleSessionId GetCurrentThreadId TerminateProcess GetCurrentProcess InitializeCriticalSectionEx DeleteCriticalSection DecodePointer LoadLibraryExW CloseHandle FormatMessageW SetLastError ReadDirectoryChangesW GetNativeSystemInfo GetLargePageMinimum QueryFullProcessImageNameW GetModuleHandleExW OpenProcess GetSystemDirectoryW VirtualQuery MultiByteToWideChar CreateFileW IsDebuggerPresent RtlCaptureContext RaiseFailFastException SetUnhandledExceptionFilter OutputDebugStringW IsProcessorFeaturePresent IsWow64Process IsWow64Process2 GetFinalPathNameByHandleW LCMapStringEx GetFileInformationByHandleEx SetFileInformationByHandle SetFilePointerEx GetCommandLineW GetCurrentProcessId K32EnumProcesses WideCharToMultiByte GetProcessHeap SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetOEMCP GetACP IsValidCodePage HeapReAlloc GetFileSizeEx ReadFile GetConsoleMode GetConsoleOutputCP FlushFileBuffers GetTimeZoneInformation EnumSystemLocalesW CreateDirectoryW FindNextFileW GetFileAttributesW MoveFileExW GetModuleFileNameW FindClose LocalFree GetModuleHandleW RtlUnwind GetLastError CreateEventW GetProcAddress LoadLibraryExA FreeLibrary SetStdHandle HeapSize ReadConsoleW WriteConsoleW SetEndOfFile GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW FlsFree FlsSetValue FlsGetValue FlsAlloc GetFileType HeapFree HeapAlloc WriteFile GetStdHandle ExitProcess FreeLibraryAndExitThread ExitThread CreateThread TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount RaiseException GetSystemInfo VirtualProtect FormatMessageA GetStringTypeW ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive QueryPerformanceCounter QueryPerformanceFrequency InitOnceBeginInitialize InitOnceComplete GetLocaleInfoEx FindFirstFileExW AreFileApisANSI WakeAllConditionVariable SleepConditionVariableSRW RtlPcToFileHeader EnterCriticalSection LeaveCriticalSection EncodePointer GetSystemTimeAsFileTime CompareStringEx GetCPInfo InitializeSListHead RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter GetStartupInfoW RtlUnwindEx InterlockedPushEntrySList

user32

DispatchMessageW MsgWaitForMultipleObjects PeekMessageW TranslateMessage PostThreadMessageW LoadStringW

advapi32

SetNamedSecurityInfoW RegEnumKeyExW GetSecurityDescriptorDacl ConvertStringSecurityDescriptorToSecurityDescriptorW StartServiceCtrlDispatcherW SetServiceStatus RegisterServiceCtrlHandlerExW RegSetValueExA RegSetValueExW RegQueryValueExW RegQueryValueExA RegOpenKeyExW RegNotifyChangeKeyValue RegCreateKeyExW RegCloseKey

shell32

SHGetSpecialFolderPathW

shlwapi

PathFileExistsW StrRChrW

Name

.text

Size

638KB

Virtual Size

638KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

153KB

Virtual Size

152KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

16KB

Virtual Size

51KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

34KB

Virtual Size

33KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.didat

Size

512B

Virtual Size

144B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1024B

Virtual Size

880B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

572KB

Virtual Size

576KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-08_84170d745f0f7b64efd9ba4cfede23b0_icedid_luca-stealer_njrat_stealc

kernel32

user32

advapi32

shell32

shlwapi

generic