2026-09-30_ce1ec85c26145a074149d4d7215fa2d2_icedid_luca-stealer_njrat

General

Target
2026-09-30_ce1ec85c26145a074149d4d7215fa2d2_icedid_luca-stealer_njrat
Size 2.7MB
Sample260930-jmxqsazakb
SHA256 2ff7344e8f6e8fdcbbe41841988659141789703bcb7988d6603c962d30d1579b
MD5 ce1ec85c26145a074149d4d7215fa2d2
SHA1 1ba66ceefc26ad3b2a4376b45c7acf5c106c2c0f
SHA512 373dbab9bfa306b184c3278a647836cdf93b4bbba845cf92f84e6b6ff9fdface7f9c2a12e7e30ebf079b07126d3cbda8a461a549def08e370dd852f882750be7
SSDEEP 49152:RJF+ZFx/xO4Cs/hxSMmT8oWgBCaXfyMRYmJzxj8Z7hxSMmT8oWgBCaX:RniF+M4FHX6YbJzl8l+M4FHX
TLSH
T162D5F12EEF9841E9D076D23989924607E7B27C094351AACF1F907A7AEF375D44D3A302
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-30_ce1ec85c26145a074149d4d7215fa2d2_icedid_luca-stealer_njrat

File Explorer

2026-09-30_ce1ec85c26145a074149d4d7215fa2d2_icedid_luca-stealer_njrat

.exe 2.7MB

2026-09-30_ce1ec85c26145a074149d4d7215fa2d2_icedid_luca-stealer_njrat

IMPHASH 6f7422e8b528a5112b70e48e5805773e
SHA256 2ff7344e8f6e8fdcbbe41841988659141789703bcb7988d6603c962d30d1579b
MD5 ce1ec85c26145a074149d4d7215fa2d2
SHA1 1ba66ceefc26ad3b2a4376b45c7acf5c106c2c0f
SHA512 373dbab9bfa306b184c3278a647836cdf93b4bbba845cf92f84e6b6ff9fdface7f9c2a12e7e30ebf079b07126d3cbda8a461a549def08e370dd852f882750be7
SSDEEP 49152:RJF+ZFx/xO4Cs/hxSMmT8oWgBCaXfyMRYmJzxj8Z7hxSMmT8oWgBCaX:RniF+M4FHX6YbJzl8l+M4FHX
TLSH
T162D5F12EEF9841E9D076D23989924607E7B27C094351AACF1F907A7AEF375D44D3A302
MD5 SHA1 SHA512 SSDEEP TLSH

windows:10 windows x64 arch:x64

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

10

Entry point

325120

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

SophosHealthClient.pdb

kernel32

OutputDebugStringW CloseHandle GetCurrentProcessId OpenProcess LoadLibraryExA SetEnvironmentVariableW GetEnvironmentVariableW SetSearchPathMode HeapSetInformation GetProcAddress GetProcessHeap GetModuleHandleW SetDllDirectoryW OutputDebugStringA WaitForSingleObject CreateEventW SetEvent GetQueuedCompletionStatus CancelIoEx CreateIoCompletionPort GetCurrentThreadId ExitThread Sleep CreateThread EnterCriticalSection LeaveCriticalSection InitializeCriticalSection LoadLibraryExW GetSystemTimeAsFileTime WriteFile TerminateProcess WriteConsoleW GetFileInformationByHandleEx DeviceIoControl SetFilePointer SetEndOfFile CreateFileW GetFileInformationByHandle MoveFileExW ReplaceFileW FlushFileBuffers GetStdHandle FileTimeToSystemTime FindClose FreeEnvironmentStringsW LocalFree FreeLibrary FormatMessageW MultiByteToWideChar WideCharToMultiByte HeapSize GetCurrentProcess DeleteCriticalSection DecodePointer GetLastError GetConsoleMode InitializeCriticalSectionEx RaiseException GetSystemInfo VirtualProtect VirtualQuery ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW QueryPerformanceCounter InitializeSListHead FormatMessageA GetLocaleInfoEx FindFirstFileExW FindNextFileW AreFileApisANSI GetStringTypeW TryAcquireSRWLockExclusive WakeConditionVariable WaitForSingleObjectEx GetExitCodeThread ReleaseSRWLockShared AcquireSRWLockShared EncodePointer LCMapStringEx GetCPInfo RtlUnwindEx RtlPcToFileHeader SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree GetModuleHandleExW ExitProcess GetModuleFileNameW GetCommandLineA GetCommandLineW HeapFree HeapAlloc GetFileType FlsAlloc FlsGetValue FlsSetValue FlsFree GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetTimeZoneInformation SetStdHandle GetFileSizeEx SetFilePointerEx GetConsoleOutputCP ReadFile IsValidCodePage GetACP GetOEMCP GetEnvironmentStringsW ReadConsoleW HeapReAlloc RtlUnwind

advapi32

ConvertSidToStringSidA IsWellKnownSid OpenProcessToken GetTokenInformation

Name

.text

Size

475KB

Virtual Size

475KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

287KB

Virtual Size

286KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

14KB

Virtual Size

21KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

25KB

Virtual Size

24KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

106KB

Virtual Size

106KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

UPX1

Size

1.9MB

Virtual Size

1.9MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-30_ce1ec85c26145a074149d4d7215fa2d2_icedid_luca-stealer_njrat

kernel32

advapi32

generic