2026-09-24_2b3dcb2a88e24f4f5de8ef591d6c60c8_icedid_luca-stealer_njrat_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-24_2b3dcb2a88e24f4f5de8ef591d6c60c8_icedid_luca-stealer_njrat_stealc
Size 3.8MB
Sample260925-p63n2aec65
SHA256 0634e52da4270aacab7cf736fcbedd21c961b34646d5175b98bcd58a5e082e64
MD5 2b3dcb2a88e24f4f5de8ef591d6c60c8
SHA1 902a31bc80711a0beb9671f17eb56569846b72d8
SHA512 85747f2705cf7230ef6e2a2cbdee3a813631b27e07f9f519f78b23b15687e2af9ba061decb29f44331f392817955ba5b3da60ca17b0b8d3941684886401ffc23
SSDEEP 49152:GAFlnbzheQfC/IH3v4mP6RXna/bxlJob57hlbWBp9W5uL2uzD5dshE/ANoKRaxC/:aQH3v4myNANWg4q/AxRaxC3Y1oe
TLSH
T18506AF0653DC02E8E1F6D27D9E95C846EB727C4A4372A7CF0BA0856A5F736E04E79312
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-24_2b3dcb2a88e24f4f5de8ef591d6c60c8_icedid_luca-stealer_njrat_stealc

File Explorer

2026-09-24_2b3dcb2a88e24f4f5de8ef591d6c60c8_icedid_luca-stealer_njrat_stealc

.exe 3.8MB

2026-09-24_2b3dcb2a88e24f4f5de8ef591d6c60c8_icedid_luca-stealer_njrat_stealc

IMPHASH cc1a9ef87e39b31b92e43880849f7b9a
SHA256 0634e52da4270aacab7cf736fcbedd21c961b34646d5175b98bcd58a5e082e64
MD5 2b3dcb2a88e24f4f5de8ef591d6c60c8
SHA1 902a31bc80711a0beb9671f17eb56569846b72d8
SHA512 85747f2705cf7230ef6e2a2cbdee3a813631b27e07f9f519f78b23b15687e2af9ba061decb29f44331f392817955ba5b3da60ca17b0b8d3941684886401ffc23
SSDEEP 49152:GAFlnbzheQfC/IH3v4mP6RXna/bxlJob57hlbWBp9W5uL2uzD5dshE/ANoKRaxC/:aQH3v4myNANWg4q/AxRaxC3Y1oe
TLSH
T18506AF0653DC02E8E1F6D27D9E95C846EB727C4A4372A7CF0BA0856A5F736E04E79312
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2023504

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Jenkins\workspace\nsumer_CSIS_WPS_WPSUpdate_master\build\x64\Release\mc-update.pdb

api-ms-win-core-processthreads-l1-1-0

ExitThread TlsFree GetCurrentThreadId TlsGetValue TlsAlloc GetStartupInfoW OpenProcessToken GetCurrentProcess GetCurrentThread GetExitCodeProcess CreateProcessW TerminateProcess OpenThreadToken ExitProcess CreateThread TlsSetValue ProcessIdToSessionId GetCurrentProcessId GetExitCodeThread

api-ms-win-core-com-l1-1-0

CoRegisterClassObject CoRevokeClassObject CoResumeClassObjects CoTaskMemRealloc CoAddRefServerProcess CoMarshalInterThreadInterfaceInStream CoGetInterfaceAndReleaseStream CoTaskMemAlloc CoInitializeEx CoUninitialize PropVariantClear CoCreateGuid StringFromGUID2 CoCreateFreeThreadedMarshaler CoCreateInstance CoTaskMemFree CoReleaseServerProcess CLSIDFromString

api-ms-win-core-registry-l1-1-0

RegDeleteValueA RegSetKeySecurity RegSetValueExW RegFlushKey RegGetKeySecurity RegEnumKeyExW RegNotifyChangeKeyValue RegEnumValueW RegQueryValueExW RegDeleteKeyExW RegQueryValueExA RegCreateKeyExW RegOpenKeyExW RegDeleteTreeW RegDeleteValueW RegQueryInfoKeyW RegCreateKeyExA RegCloseKey RegSetValueExA RegOpenKeyExA RegDeleteTreeA

api-ms-win-core-libraryloader-l1-2-0

SizeofResource FreeLibraryAndExitThread GetModuleHandleW GetModuleHandleExW LoadLibraryExA SetDefaultDllDirectories LockResource FindResourceExW LoadStringW GetProcAddress LoadResource GetModuleFileNameW FreeLibrary LoadLibraryExW

api-ms-win-core-libraryloader-l1-2-1

LoadLibraryW FindResourceW

api-ms-win-core-errorhandling-l1-1-0

RaiseException GetLastError SetLastError UnhandledExceptionFilter

api-ms-win-core-file-l1-1-0

CreateDirectoryW GetLongPathNameW FindFirstFileW SetEndOfFile ReadFile GetFileType GetFileSize SetFileAttributesW FlushFileBuffers LocalFileTimeToFileTime SetFileTime FindNextFileW RemoveDirectoryW GetFileAttributesW WriteFile CreateFileW FindClose DeleteFileW FindFirstFileExW GetFileAttributesExW GetFileInformationByHandle GetFileSizeEx GetFullPathNameW

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-registry-l2-1-0

RegDeleteKeyW

api-ms-win-core-synch-l1-1-0

CreateMutexW ReleaseSRWLockShared CreateEventW LeaveCriticalSection InitializeCriticalSectionAndSpinCount EnterCriticalSection AcquireSRWLockShared WaitForSingleObjectEx SetEvent DeleteCriticalSection WaitForSingleObject InitializeCriticalSectionEx ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive ResetEvent

api-ms-win-core-processthreads-l1-1-1

OpenProcess

api-ms-win-core-psapi-l1-1-0

QueryFullProcessImageNameW K32GetModuleFileNameExW

api-ms-win-core-toolhelp-l1-1-0

Process32FirstW Process32NextW CreateToolhelp32Snapshot

api-ms-win-security-lsalookup-l2-1-0

LookupPrivilegeValueW

api-ms-win-security-base-l1-1-0

GetTokenInformation GetFileSecurityW DeleteAce GetAce AllocateAndInitializeSid SetSecurityDescriptorControl SetFileSecurityW DuplicateTokenEx GetAclInformation ImpersonateLoggedOnUser FreeSid EqualSid GetSecurityDescriptorDacl RevertToSelf SetSecurityDescriptorDacl SetTokenInformation AdjustTokenPrivileges InitializeSecurityDescriptor

api-ms-win-core-kernel32-legacy-l1-1-0

DosDateTimeToFileTime GetSystemPowerStatus

api-ms-win-core-heap-l2-1-0

GlobalFree LocalFree GlobalAlloc

api-ms-win-core-debug-l1-1-0

IsDebuggerPresent OutputDebugStringW

api-ms-win-shcore-obsolete-l1-1-0

CommandLineToArgvW

api-ms-win-core-synch-l1-2-0

WakeAllConditionVariable WakeConditionVariable SleepConditionVariableSRW InitOnceBeginInitialize InitOnceComplete Sleep

api-ms-win-core-heap-l1-1-0

HeapFree HeapAlloc HeapDestroy HeapSize HeapQueryInformation GetProcessHeap HeapReAlloc

api-ms-win-core-util-l1-1-0

DecodePointer EncodePointer

api-ms-win-core-string-l1-1-0

WideCharToMultiByte CompareStringW GetStringTypeW CompareStringEx MultiByteToWideChar

api-ms-win-core-string-obsolete-l1-1-0

lstrlenW lstrcmpiW

api-ms-win-service-management-l1-1-0

OpenSCManagerW

api-ms-win-core-string-l2-1-0

CharNextW

api-ms-win-core-threadpool-l1-2-0

CloseThreadpoolTimer SetThreadpoolTimer CreateThreadpoolWork CreateThreadpoolTimer SubmitThreadpoolWork CloseThreadpoolWork WaitForThreadpoolWorkCallbacks

api-ms-win-service-winsvc-l1-1-0

RegisterServiceCtrlHandlerW

api-ms-win-eventlog-legacy-l1-1-0

RegisterEventSourceW DeregisterEventSource ReportEventW

api-ms-win-core-file-l2-1-0

MoveFileExW CreateSymbolicLinkW

api-ms-win-core-localization-l1-2-0

GetUserDefaultLocaleName GetLocaleInfoEx LocaleNameToLCID LCMapStringW GetACP GetLocaleInfoW IsValidLocale GetUserDefaultLCID GetCPInfo FormatMessageW EnumSystemLocalesW FormatMessageA GetOEMCP IsValidCodePage

api-ms-win-ntuser-sysparams-l1-1-0

GetSystemMetrics

api-ms-win-core-memory-l1-1-0

MapViewOfFile VirtualProtect VirtualAlloc UnmapViewOfFile VirtualFree MapViewOfFileEx CreateFileMappingW

api-ms-win-core-wow64-l1-1-1

IsWow64Process2

api-ms-win-core-processenvironment-l1-1-0

GetCurrentDirectoryW GetCommandLineA SetStdHandle GetEnvironmentStringsW GetEnvironmentVariableW SetEnvironmentVariableW FreeEnvironmentStringsW

api-ms-win-core-sysinfo-l1-1-0

GetTickCount GetSystemInfo GetSystemTimeAsFileTime

api-ms-win-core-version-l1-1-1

GetFileVersionInfoW

api-ms-win-core-version-l1-1-0

VerQueryValueW

api-ms-win-core-namedpipe-l1-1-0

WaitNamedPipeW DisconnectNamedPipe SetNamedPipeHandleState CreateNamedPipeW ConnectNamedPipe

api-ms-win-core-io-l1-1-0

GetOverlappedResult CancelIoEx

api-ms-win-security-sddl-l1-1-0

ConvertStringSidToSidW ConvertSidToStringSidW

api-ms-win-core-privateprofile-l1-1-0

WritePrivateProfileStringW

api-ms-win-security-cryptoapi-l1-1-0

CryptAcquireContextW CryptImportKey CryptReleaseContext CryptEncrypt CryptSetKeyParam CryptDestroyKey

api-ms-win-core-synch-l1-2-1

WaitForMultipleObjects

wldp

ord8

kernel32

SetThreadpoolWait CloseThreadpoolWait SetFilePointer LocalAlloc QueryUnbiasedInterruptTime GetFinalPathNameByHandleW SetFilePointerEx IsWow64Process IsProcessorFeaturePresent GetGeoInfoW GetUserGeoID SetUnhandledExceptionFilter WaitForMultipleObjectsEx SetThreadPriority RtlPcToFileHeader CreateWaitableTimerW RaiseFailFastException RtlCaptureContext GetCommandLineW GetNamedPipeServerProcessId GetNamedPipeClientProcessId WritePrivateProfileStructW SetWaitableTimer GetStdHandle ReadDirectoryChangesW DeviceIoControl SetFileInformationByHandle WaitForThreadpoolWaitCallbacks CreateEventExW CreateThreadpoolWait SwitchToThread GetSystemDirectoryW VirtualQuery GetNativeSystemInfo GetTickCount64 LCMapStringEx ReadProcessMemory GetFileInformationByHandleEx GetLargePageMinimum

api-ms-win-core-file-l1-2-0

GetTempPathW

api-ms-win-core-file-l1-2-2

AreFileApisANSI

api-ms-win-core-file-l2-1-2

CopyFileW

api-ms-win-core-profile-l1-1-0

QueryPerformanceFrequency QueryPerformanceCounter

api-ms-win-core-rtlsupport-l1-1-0

RtlLookupFunctionEntry RtlUnwind RtlUnwindEx RtlVirtualUnwind

api-ms-win-core-interlocked-l1-1-0

InterlockedFlushSList InitializeSListHead InterlockedPushEntrySList

api-ms-win-core-console-l1-1-0

ReadConsoleW GetConsoleMode GetConsoleOutputCP WriteConsoleW

api-ms-win-core-fibers-l1-1-0

FlsFree FlsGetValue FlsAlloc FlsSetValue

api-ms-win-core-datetime-l1-1-0

GetTimeFormatW GetDateFormatW

api-ms-win-core-timezone-l1-1-0

GetTimeZoneInformation

api-ms-win-core-localization-obsolete-l1-2-0

GetUserDefaultUILanguage

api-ms-win-core-winrt-error-l1-1-1

RoOriginateLanguageException

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory

Name

.text

Size

2.3MB

Virtual Size

2.3MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

682KB

Virtual Size

681KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

99KB

Virtual Size

142KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

85KB

Virtual Size

84KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.didat

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

120KB

Virtual Size

120KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

588KB

Virtual Size

592KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-24_2b3dcb2a88e24f4f5de8ef591d6c60c8_icedid_luca-stealer_njrat_stealc

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-com-l1-1-0

api-ms-win-core-registry-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-libraryloader-l1-2-1

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-file-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-registry-l2-1-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-processthreads-l1-1-1

api-ms-win-core-psapi-l1-1-0

api-ms-win-core-toolhelp-l1-1-0

api-ms-win-security-lsalookup-l2-1-0

api-ms-win-security-base-l1-1-0

api-ms-win-core-kernel32-legacy-l1-1-0

api-ms-win-core-heap-l2-1-0

api-ms-win-core-debug-l1-1-0

api-ms-win-shcore-obsolete-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-util-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-string-obsolete-l1-1-0

api-ms-win-service-management-l1-1-0

api-ms-win-core-string-l2-1-0

api-ms-win-core-threadpool-l1-2-0

api-ms-win-service-winsvc-l1-1-0

api-ms-win-eventlog-legacy-l1-1-0

api-ms-win-core-file-l2-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-ntuser-sysparams-l1-1-0

api-ms-win-core-memory-l1-1-0

api-ms-win-core-wow64-l1-1-1

api-ms-win-core-processenvironment-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-version-l1-1-1

api-ms-win-core-version-l1-1-0

api-ms-win-core-namedpipe-l1-1-0

api-ms-win-core-io-l1-1-0

api-ms-win-security-sddl-l1-1-0

api-ms-win-core-privateprofile-l1-1-0

api-ms-win-security-cryptoapi-l1-1-0

api-ms-win-core-synch-l1-2-1

wldp

kernel32

api-ms-win-core-file-l1-2-0

api-ms-win-core-file-l1-2-2

api-ms-win-core-file-l2-1-2

api-ms-win-core-profile-l1-1-0

api-ms-win-core-rtlsupport-l1-1-0

api-ms-win-core-interlocked-l1-1-0

api-ms-win-core-console-l1-1-0

api-ms-win-core-fibers-l1-1-0

api-ms-win-core-datetime-l1-1-0

api-ms-win-core-timezone-l1-1-0

api-ms-win-core-localization-obsolete-l1-2-0

api-ms-win-core-winrt-error-l1-1-1

api-ms-win-core-winrt-l1-1-0

generic