2026-09-27_43f64f13039e9dec44e74571c825b3e1_icedid_luca-stealer_njrat_stealc

General

Target
2026-09-27_43f64f13039e9dec44e74571c825b3e1_icedid_luca-stealer_njrat_stealc
Size 2.8MB
Sample260928-yslyssseng
SHA256 4540ea4f597a284aa285e3e8c99d96f414acb52224cdda84ab17b431c5dca8a9
MD5 43f64f13039e9dec44e74571c825b3e1
SHA1 186bf76910faa986088d86947447cd2b7dfed11d
SHA512 88809902a198c3d01a250eda78819ddea008cb717af77f47730a5df295b4b76acec74b85ac09b63d361fbadfda42448fcd2080a2dc305e2c8db6431d9fd5bce5
SSDEEP 49152:9qhRf95IuSkvaF3XKu5oX89dXzHXTysMDf+jn1Ye2MJAkxy4sh:AhRf9iOaFH55xX72NfwuALsh
TLSH
T1B8D50269E5E521FAD2B7C639CD05480EEA7234540700AEFB13E2CA965F22DD1AF3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-27_43f64f13039e9dec44e74571c825b3e1_icedid_luca-stealer_njrat_stealc

File Explorer

2026-09-27_43f64f13039e9dec44e74571c825b3e1_icedid_luca-stealer_njrat_stealc

.exe 2.8MB

2026-09-27_43f64f13039e9dec44e74571c825b3e1_icedid_luca-stealer_njrat_stealc

IMPHASH 97dcc239d02dc292811ec4463bcef1ff
SHA256 4540ea4f597a284aa285e3e8c99d96f414acb52224cdda84ab17b431c5dca8a9
MD5 43f64f13039e9dec44e74571c825b3e1
SHA1 186bf76910faa986088d86947447cd2b7dfed11d
SHA512 88809902a198c3d01a250eda78819ddea008cb717af77f47730a5df295b4b76acec74b85ac09b63d361fbadfda42448fcd2080a2dc305e2c8db6431d9fd5bce5
SSDEEP 49152:9qhRf95IuSkvaF3XKu5oX89dXzHXTysMDf+jn1Ye2MJAkxy4sh:AhRf9iOaFH55xX72NfwuALsh
TLSH
T1B8D50269E5E521FAD2B7C639CD05480EEA7234540700AEFB13E2CA965F22DD1AF3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

465664

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

user32

wsprintfW

advapi32

OpenProcessToken RegCloseKey RegEnumValueW RegDeleteValueW RegGetValueW RegOpenKeyExW RegCreateKeyExW RegSetValueExW RegEnumKeyExW RegQueryInfoKeyW

kernel32

DecodePointer SetEndOfFile HeapCreate HeapFree ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive GetCurrentThreadId QueryPerformanceCounter QueryPerformanceFrequency CloseHandle WaitForSingleObjectEx GetExitCodeThread LocalFree FormatMessageA GetLocaleInfoEx WideCharToMultiByte CreateFileW FindClose FindFirstFileW FindFirstFileExW FindNextFileW GetFileAttributesExW AreFileApisANSI GetLastError GetModuleHandleW GetProcAddress GetFileInformationByHandleEx MultiByteToWideChar GetStringTypeW InitializeCriticalSectionEx GetSystemTimeAsFileTime WakeAllConditionVariable EnterCriticalSection LeaveCriticalSection DeleteCriticalSection EncodePointer RtlUnwind LCMapStringEx CompareStringEx GetCPInfo RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent GetCurrentProcessId InitializeSListHead IsDebuggerPresent GetStartupInfoW RtlUnwindEx RtlPcToFileHeader RaiseException SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW CreateThread ExitThread FreeLibraryAndExitThread GetModuleHandleExW GetStdHandle WriteFile GetModuleFileNameW ExitProcess HeapAlloc GetFileType FlsAlloc FlsGetValue FlsSetValue FlsFree VirtualProtect LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetFileSizeEx SetFilePointerEx FlushFileBuffers GetConsoleOutputCP GetConsoleMode ReadFile ReadConsoleW HeapReAlloc IsValidCodePage GetACP GetOEMCP GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle GetProcessHeap HeapSize WriteConsoleW

ole32

CoCreateInstance OleSetContainedObject OleUninitialize

Name

.text

Size

614KB

Virtual Size

613KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.5MB

Virtual Size

1.5MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

7KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

23KB

Virtual Size

22KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

488B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-27_43f64f13039e9dec44e74571c825b3e1_icedid_luca-stealer_njrat_stealc

user32

advapi32

kernel32

ole32

generic