2026-09-08_89d41535ddc73927569c4421bb5248f2_icedid_luca-stealer_njrat_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-08_89d41535ddc73927569c4421bb5248f2_icedid_luca-stealer_njrat_stealc
Size 7.0MB
Sample260910-ewppbafn5v
SHA256 f6c6204a584b20d676e508458d024e75cb14751d3f41ae3502fe4e8f63830064
MD5 89d41535ddc73927569c4421bb5248f2
SHA1 efba6691bb68b16798bbdc478a6032cd3032e0bd
SHA512 85a8abd86b9762418923f0bc5a11c428a432328cf00d9351ed274b8310b1f5777124d0b894581dda4e6de969f71f8771781fce254ecd0a20c4a48bf5351364d0
SSDEEP 49152:F8k+iR8QNMJRVUfseQKZBCBU8RgxD/M+gnGFBc+VVoRfqZ0o+ii8x7RkwiJTRA3+:IybRieF/IArwk6ExR4KOFzJLgjZLH/m
TLSH
T16E768DE623F2E9CDD157C0BE8692B82FE68F7039031565E78195E2165E13CC1762BF0A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

themida

Malware Config

Signatures

Detects executables packed with Themida 1 IoCs

resource	yara_rule
sample	INDICATOR_EXE_Packed_Themida

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
sample	themida

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-08_89d41535ddc73927569c4421bb5248f2_icedid_luca-stealer_njrat_stealc

File Explorer

2026-09-08_89d41535ddc73927569c4421bb5248f2_icedid_luca-stealer_njrat_stealc

.exe 7.0MB

2026-09-08_89d41535ddc73927569c4421bb5248f2_icedid_luca-stealer_njrat_stealc

SHA256 f6c6204a584b20d676e508458d024e75cb14751d3f41ae3502fe4e8f63830064
MD5 89d41535ddc73927569c4421bb5248f2
SHA1 efba6691bb68b16798bbdc478a6032cd3032e0bd
SHA512 85a8abd86b9762418923f0bc5a11c428a432328cf00d9351ed274b8310b1f5777124d0b894581dda4e6de969f71f8771781fce254ecd0a20c4a48bf5351364d0
SSDEEP 49152:F8k+iR8QNMJRVUfseQKZBCBU8RgxD/M+gnGFBc+VVoRfqZ0o+ii8x7RkwiJTRA3+:IybRieF/IArwk6ExR4KOFzJLgjZLH/m
TLSH
T16E768DE623F2E9CDD157C0BE8692B82FE68F7039031565E78195E2165E13CC1762BF0A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects executables packed with Themida
Themida packer

Detects Themida, an advanced Windows software protection system.

themida
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4543148

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Name

.text

Size

2.2MB

Virtual Size

2.2MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

539KB

Virtual Size

539KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

45KB

Virtual Size

164KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

69KB

Virtual Size

69KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

15KB

Virtual Size

14KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.vm_sec

Size

120KB

Virtual Size

120KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

1024B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.themida

Size

4.1MB

Virtual Size

4.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

16B

Virtual Size

4KB

Characteristics

IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-08_89d41535ddc73927569c4421bb5248f2_icedid_luca-stealer_njrat_stealc

generic