2026-09-29_3ff3cae226bdefa4658c999680b07983_icedid_luca-stealer_njrat

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-29_3ff3cae226bdefa4658c999680b07983_icedid_luca-stealer_njrat
Size 2.3MB
Sample260930-1m879abb26
SHA256 590f0fbdee3a18cf3381f84f01f5f8a92d4303ac9ea9f9046089ca18ef9b8558
MD5 3ff3cae226bdefa4658c999680b07983
SHA1 4fa65ce654fe60e95315604f45be92fd799df930
SHA512 6a458dffab9a2cc6d4eb74b8e52f31cbb629af971d945a1f66d17b87a596a54767337bdf447a7bd39fdb90ecf8e91ce5326d911b15aa93a4c799f1786441ce62
SSDEEP 49152:DbU2Ux/oItE1oXYnQwfnVpEWU/3Rdo9UYr+tWtGVLrTnNEY:jkoIRXYTkWi3HoGgg/NEY
TLSH
T160B50140E7E555F5E1BBE63889774152DE727CA91B30DACF22D0866A0E33BC08D79722
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-29_3ff3cae226bdefa4658c999680b07983_icedid_luca-stealer_njrat

File Explorer

2026-09-29_3ff3cae226bdefa4658c999680b07983_icedid_luca-stealer_njrat

.exe 2.3MB

2026-09-29_3ff3cae226bdefa4658c999680b07983_icedid_luca-stealer_njrat

IMPHASH 0ecb35a6ae3ccd2074f265c326995039
SHA256 590f0fbdee3a18cf3381f84f01f5f8a92d4303ac9ea9f9046089ca18ef9b8558
MD5 3ff3cae226bdefa4658c999680b07983
SHA1 4fa65ce654fe60e95315604f45be92fd799df930
SHA512 6a458dffab9a2cc6d4eb74b8e52f31cbb629af971d945a1f66d17b87a596a54767337bdf447a7bd39fdb90ecf8e91ce5326d911b15aa93a4c799f1786441ce62
SSDEEP 49152:DbU2Ux/oItE1oXYnQwfnVpEWU/3Rdo9UYr+tWtGVLrTnNEY:jkoIRXYTkWi3HoGgg/NEY
TLSH
T160B50140E7E555F5E1BBE63889774152DE727CA91B30DACF22D0866A0E33BC08D79722
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

118360

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

E:\Work\Code\AsusLinkNear\AsusSync\x64\Release\GlideXWirelessService.pdb

kernel32

QueryFullProcessImageNameW SetLastError lstrcmpA MultiByteToWideChar FileTimeToSystemTime FileTimeToLocalFileTime LocalFree HeapFree OpenEventW LoadLibraryW HeapAlloc GetProcAddress GetProcessHeap CreateProcessW FreeLibrary WideCharToMultiByte EnterCriticalSection WaitForMultipleObjects LeaveCriticalSection InitializeCriticalSection GetExitCodeThread GetTickCount64 TerminateThread WaitForSingleObjectEx DeleteCriticalSection GetCurrentProcessId FormatMessageW GetConsoleMode GetConsoleOutputCP HeapReAlloc HeapSize SetFilePointerEx GetStringTypeW SetStdHandle SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCPInfo GetExitCodeProcess FlushFileBuffers ConnectNamedPipe WaitNamedPipeW GetOverlappedResult SetEvent GetLastError CreateEventW DisconnectNamedPipe ReleaseMutex CreateFileW GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW FindClose EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW CreateMutexW GetNamedPipeClientProcessId K32GetModuleFileNameExW CreateNamedPipeW WriteFile ReadFile CreateThread CloseHandle WaitForSingleObject TerminateProcess lstrcmpiW GetModuleHandleW Sleep OpenProcess LCMapStringW CompareStringW FlsFree FlsSetValue FlsGetValue FlsAlloc GetFileType GetStdHandle GetModuleHandleExW GetModuleFileNameW WriteConsoleW ExitProcess GetCommandLineW GetCommandLineA LoadLibraryExW TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount EncodePointer InterlockedPushEntrySList RaiseException RtlPcToFileHeader RtlUnwindEx InitializeSListHead GetSystemTimeAsFileTime ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW QueryPerformanceCounter GetCurrentThreadId

user32

GetWindowThreadProcessId GetMessageW PostMessageW SendMessageTimeoutW CreateWindowExW RegisterClassExW SetTimer DispatchMessageW DefWindowProcW TranslateMessage PostQuitMessage KillTimer LoadCursorW FindWindowW LoadIconW

advapi32

RegQueryValueExW RegOpenKeyExW RegCloseKey SetSecurityDescriptorDacl EventUnregister EventSetInformation EventRegister EventWriteTransfer InitializeSecurityDescriptor

ole32

CoCreateFreeThreadedMarshaler CoInitializeEx CoCreateInstance CoUninitialize CoTaskMemAlloc

oleaut32

SetErrorInfo GetErrorInfo SysAllocString SysFreeString SysStringLen

crypt32

CryptDecodeObjectEx CryptDecodeObject CryptMsgUpdate CryptFindOIDInfo CryptMsgOpenToDecode CryptQueryObject CertCloseStore CertFindCertificateInStore CertGetNameStringW CertOpenStore CryptMsgClose CryptMsgGetParam

wintrust

WinVerifyTrust

wlanapi

WlanEnumInterfaces WlanOpenHandle WlanQueryInterface WlanFreeMemory WlanCloseHandle

iphlpapi

GetAdaptersAddresses

ws2_32

GetHostNameW InetPtonW WSAStartup listen closesocket bind WSACleanup inet_addr WSAGetLastError htons inet_ntoa connect ntohs accept socket getsockname

Name

.text

Size

242KB

Virtual Size

244KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

147KB

Virtual Size

148KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.data

Size

35KB

Virtual Size

44KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

12KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

2KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

UPX1

Size

1.8MB

Virtual Size

1.8MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-29_3ff3cae226bdefa4658c999680b07983_icedid_luca-stealer_njrat

kernel32

user32

advapi32

ole32

oleaut32

crypt32

wintrust

wlanapi

iphlpapi

ws2_32

generic