2026-09-29_25d352e56827b8ecb78bf4f72c469050_icedid_luca-stealer_njrat_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-29_25d352e56827b8ecb78bf4f72c469050_icedid_luca-stealer_njrat_stealc
Size 2.0MB
Sample260930-eshrlawdnf
SHA256 3c9eacfb74c34122d2d26914a32910aaadf9b0cf16919db89a00ec19b5869320
MD5 25d352e56827b8ecb78bf4f72c469050
SHA1 c6d57b0f8dc6aaf758b0e8f3a404dc9aa3eb0770
SHA512 b4987378a1a5e42f2ba42bb12dce59e66562de5b5178c98f1d30fe2342816010658cc443efd0cbc2d106d8366f92672bf8e90e6a425bd4246c663169d6440f4c
SSDEEP 49152:VS0EQzL48KiLK8zCBnDKsnEs/QyrBQGv:XlKiG4Wx/Qs+s
TLSH
T126A5D05BB2A900F8D1A7D2BCC955994BE7727C0A4B3096DF13E059593F63AE00F7A702
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-29_25d352e56827b8ecb78bf4f72c469050_icedid_luca-stealer_njrat_stealc

File Explorer

2026-09-29_25d352e56827b8ecb78bf4f72c469050_icedid_luca-stealer_njrat_stealc

.exe 2.0MB

2026-09-29_25d352e56827b8ecb78bf4f72c469050_icedid_luca-stealer_njrat_stealc

IMPHASH 22e7e29b644ffaf721efe99d71d997c9
SHA256 3c9eacfb74c34122d2d26914a32910aaadf9b0cf16919db89a00ec19b5869320
MD5 25d352e56827b8ecb78bf4f72c469050
SHA1 c6d57b0f8dc6aaf758b0e8f3a404dc9aa3eb0770
SHA512 b4987378a1a5e42f2ba42bb12dce59e66562de5b5178c98f1d30fe2342816010658cc443efd0cbc2d106d8366f92672bf8e90e6a425bd4246c663169d6440f4c
SSDEEP 49152:VS0EQzL48KiLK8zCBnDKsnEs/QyrBQGv:XlKiG4Wx/Qs+s
TLSH
T126A5D05BB2A900F8D1A7D2BCC955994BE7727C0A4B3096DF13E059593F63AE00F7A702
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

831228

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

dwmapi

DwmExtendFrameIntoClientArea

kernel32

ReadConsoleA OpenProcess GetCommandLineA CreateToolhelp32Snapshot GetConsoleMode GetTickCount64 GetLastError CreateFileA Process32Next FreeConsole LoadLibraryW GetWindowsDirectoryA VirtualProtectEx VirtualAllocEx LocalFree GetStartupInfoA ExitProcess ReadProcessMemory FlushInstructionCache GetConsoleWindow VirtualFreeEx GetTickCount IsDebuggerPresent FlushFileBuffers GetSystemTimeAsFileTime LCMapStringEx DecodePointer EncodePointer DeleteCriticalSection InitializeCriticalSectionEx LeaveCriticalSection EnterCriticalSection SleepConditionVariableSRW TryAcquireSRWLockExclusive AcquireSRWLockExclusive ReleaseSRWLockExclusive InitOnceBeginInitialize InitOnceComplete GetLocaleInfoEx FormatMessageA GetModuleHandleW CompareStringEx GetCPInfo WakeAllConditionVariable GetStringTypeW RtlCaptureContext GetModuleFileNameW RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter Module32First IsProcessorFeaturePresent GetStartupInfoW InitializeSListHead RtlUnwindEx RtlPcToFileHeader RaiseException SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue Module32Next LoadLibraryExA SetConsoleMode GetStdHandle GetCurrentProcess SetConsoleTitleA SetConsoleTextAttribute VirtualProtect WriteProcessMemory GetCurrentProcessId CloseHandle GetCurrentThreadId CreateFileW VirtualAlloc DeviceIoControl VirtualFree QueryPerformanceCounter FreeLibrary GetProcAddress QueryPerformanceFrequency LoadLibraryA GetLocaleInfoA GlobalUnlock WideCharToMultiByte GlobalLock GlobalFree RtlUnwind GlobalAlloc MultiByteToWideChar Sleep GetModuleHandleA SetEndOfFile TlsFree LoadLibraryExW ReadFile WriteConsoleW HeapSize SetStdHandle GetProcessHeap SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW FindClose GetTimeZoneInformation CreatePipe GetFileAttributesExW GetExitCodeProcess WaitForSingleObject HeapReAlloc GetFileSizeEx GetConsoleOutputCP EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW DeleteFileW FlsFree Process32First TerminateProcess GetModuleHandleExW CreateThread ExitThread FreeLibraryAndExitThread DuplicateHandle CreateProcessW WriteFile GetCommandLineW SetFilePointerEx ReadConsoleW GetFileType HeapAlloc HeapFree FlsAlloc FlsGetValue FlsSetValue GetTempPathW RtlLookupFunctionEntry

user32

TranslateMessage PeekMessageA PostQuitMessage GetClientRect CreateWindowExA DefWindowProcA RegisterClassA ShowWindow DestroyWindow LoadCursorA DispatchMessageA SetClipboardData GetClipboardData EmptyClipboard CloseClipboard OpenClipboard GetCursorPos SetCursorPos ReleaseCapture IsWindowUnicode GetMessageA GetSystemMetrics GetWindow SetWindowPos MessageBoxW keybd_event GetAsyncKeyState SetWindowLongA SetWindowDisplayAffinity MessageBoxA MoveWindow mouse_event UnregisterClassA FindWindowA RegisterClassExA UpdateWindow GetKeyState GetMessageExtraInfo ScreenToClient GetCapture ClientToScreen TrackMouseEvent GetKeyboardLayout GetForegroundWindow SetCapture SetCursor

advapi32

SetTokenInformation RegCreateKeyW RegDeleteTreeW RegCloseKey RegSetKeyValueW RevertToSelf CreateProcessAsUserA PrivilegeCheck LookupPrivilegeValueA RegCreateKeyExW RegSetValueExW OpenProcessToken SetThreadToken RegGetValueW DuplicateTokenEx GetTokenInformation RegOpenKeyW

shell32

ShellExecuteA ShellExecuteW

ole32

CoCreateInstance CoUninitialize CoInitialize

ntdll

RtlAdjustPrivilege ZwOpenKey ZwSetValueKey ZwClose ZwQueryValueKey ZwCreateKey RtlInitUnicodeString NtLoadDriver NtUnloadDriver NtQuerySystemInformation

imm32

ImmReleaseContext ImmGetContext ImmSetCompositionWindow ImmSetCandidateWindow

d3dx9_43

D3DXCreateTextureFromFileInMemoryEx

ws2_32

WSACleanup closesocket select WSAGetLastError setsockopt getnameinfo ioctlsocket freeaddrinfo getsockopt recv connect ntohs socket send getsockname getpeername WSAStartup getaddrinfo shutdown WSASocketW inet_pton __WSAFDIsSet

crypt32

CertOpenSystemStoreW CertEnumCertificatesInStore CertCloseStore CertFreeCertificateContext

d3d9

Direct3DCreate9Ex

secureenginesdk64

ord2 ord1

libssl-4-x64

SSL_CTX_set_cert_store SSL_CTX_free SSL_CTX_use_certificate_file SSL_CTX_set_default_verify_paths SSL_CTX_get_cert_store SSL_free OPENSSL_init_ssl SSL_connect SSL_peek SSL_CTX_use_PrivateKey_file SSL_CTX_new SSL_write SSL_get_verify_result TLS_client_method SSL_CTX_set_default_passwd_cb_userdata SSL_ctrl SSL_set_bio SSL_pending SSL_read SSL_set_verify SSL_CTX_load_verify_locations SSL_get1_peer_certificate SSL_shutdown SSL_get_error SSL_new

libcrypto-4-x64

EVP_sha512 BIO_new_socket ASN1_STRING_get0_data ASN1_STRING_length X509_get_ext_d2i EVP_DigestFinal_ex OPENSSL_sk_value EVP_DigestInit_ex EVP_MD_CTX_free GENERAL_NAMES_free EVP_DigestUpdate EVP_sha256 EVP_md5 X509_get_subject_name OPENSSL_sk_num X509_STORE_add_cert d2i_X509 EVP_MD_CTX_new X509_NAME_get_text_by_NID X509_STORE_free BIO_ctrl X509_free

Name

.text

Size

1.0MB

Virtual Size

1.0MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

385KB

Virtual Size

384KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

587KB

Virtual Size

606KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

41KB

Virtual Size

41KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

17KB

Virtual Size

17KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-29_25d352e56827b8ecb78bf4f72c469050_icedid_luca-stealer_njrat_stealc

dwmapi

kernel32

user32

advapi32

shell32

ole32

ntdll

imm32

d3dx9_43

ws2_32

crypt32

d3d9

secureenginesdk64

libssl-4-x64

libcrypto-4-x64

generic