2026-09-30_9000a7f344bda0f38d0a7e6c23119977_icedid_luca-stealer_njrat

General

Target
2026-09-30_9000a7f344bda0f38d0a7e6c23119977_icedid_luca-stealer_njrat
Size 2.4MB
Sample260930-lnrl9styfx
SHA256 396a973ff011b6b7d038b4b056ce36289d339f541d34a863d529a3b7de960c3c
MD5 9000a7f344bda0f38d0a7e6c23119977
SHA1 ef374e59ef35e1af592dc89d691f60353a94dc02
SHA512 0a3ed333dccc5103340d772b2f77ff26338e7729b27e2b16c24bfa009e8e61437d5290f1a678a3ffc85fdaa1ac708f99454ebc1778f7ca66bb1d240516fa10eb
SSDEEP 49152:uPsn1pJthxSMmT8oWgBCaXuyMRYmJzxj8Z7hxSMmT8oWgBCaX:uUd+M4FHXLYbJzl8l+M4FHX
TLSH
T14DC5016DEE5803F9E066D238C9434503E6B27C4943619ACF0FA17ABADF376E14D7A601
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-30_9000a7f344bda0f38d0a7e6c23119977_icedid_luca-stealer_njrat

File Explorer

2026-09-30_9000a7f344bda0f38d0a7e6c23119977_icedid_luca-stealer_njrat

.exe 2.4MB

2026-09-30_9000a7f344bda0f38d0a7e6c23119977_icedid_luca-stealer_njrat

IMPHASH 1fc82518786c87aa7836923597f90fcc
SHA256 396a973ff011b6b7d038b4b056ce36289d339f541d34a863d529a3b7de960c3c
MD5 9000a7f344bda0f38d0a7e6c23119977
SHA1 ef374e59ef35e1af592dc89d691f60353a94dc02
SHA512 0a3ed333dccc5103340d772b2f77ff26338e7729b27e2b16c24bfa009e8e61437d5290f1a678a3ffc85fdaa1ac708f99454ebc1778f7ca66bb1d240516fa10eb
SSDEEP 49152:uPsn1pJthxSMmT8oWgBCaXuyMRYmJzxj8Z7hxSMmT8oWgBCaX:uUd+M4FHXLYbJzl8l+M4FHX
TLSH
T14DC5016DEE5803F9E066D238C9434503E6B27C4943619ACF0FA17ABADF376E14D7A601
MD5 SHA1 SHA512 SSDEEP TLSH

windows:10 windows x64 arch:x64

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

10

Entry point

200624

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

SophosUITelemetry.pdb

kernel32

WriteConsoleW GetFileInformationByHandleEx DeviceIoControl SetFilePointer SetEndOfFile CreateFileW GetFileInformationByHandle MoveFileExW ReplaceFileW FlushFileBuffers GetStdHandle FileTimeToSystemTime Sleep GetConsoleMode FindClose FreeEnvironmentStringsW LocalFree FreeLibrary MultiByteToWideChar WideCharToMultiByte FormatMessageW HeapSize WriteFile GetCurrentThreadId ExpandEnvironmentStringsW OutputDebugStringA SetDllDirectoryW GetModuleHandleW GetProcessHeap GetProcAddress HeapSetInformation SetSearchPathMode GetEnvironmentVariableW SetEnvironmentVariableW LoadLibraryExA GetLastError OpenProcess GetCurrentProcessId CloseHandle OutputDebugStringW TerminateProcess GetCurrentProcess HeapReAlloc RaiseException GetSystemInfo VirtualProtect VirtualQuery ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent QueryPerformanceCounter GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW FormatMessageA GetLocaleInfoEx FindFirstFileW FindFirstFileExW FindNextFileW GetFileAttributesExW AreFileApisANSI TryAcquireSRWLockExclusive WakeConditionVariable WaitForSingleObjectEx GetExitCodeThread ReleaseSRWLockShared AcquireSRWLockShared GetStringTypeW EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer LCMapStringEx GetCPInfo RtlUnwindEx RtlPcToFileHeader SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW GetModuleHandleExW GetModuleFileNameW ExitProcess GetCommandLineA GetCommandLineW GetFileSizeEx SetFilePointerEx GetFileType GetConsoleOutputCP HeapFree HeapAlloc FlsAlloc FlsGetValue FlsSetValue FlsFree GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW ReadFile ReadConsoleW GetTimeZoneInformation SetStdHandle IsValidCodePage GetACP GetOEMCP GetEnvironmentStringsW RtlUnwind

advapi32

RegCloseKey RegDeleteKeyExW RegCreateKeyExW RegEnumKeyExW RegSetKeySecurity RegDeleteTreeW RegSetValueExW RegCopyTreeW RegOpenKeyExW RegDeleteValueW ConvertStringSecurityDescriptorToSecurityDescriptorW RegEnumValueW RegQueryValueExW ConvertSidToStringSidA IsWellKnownSid OpenProcessToken GetTokenInformation

shell32

SHGetFolderPathW

Name

.text

Size

364KB

Virtual Size

364KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

118KB

Virtual Size

117KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

7KB

Virtual Size

14KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

18KB

Virtual Size

18KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

106KB

Virtual Size

106KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

UPX1

Size

1.8MB

Virtual Size

1.9MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-30_9000a7f344bda0f38d0a7e6c23119977_icedid_luca-stealer_njrat

kernel32

advapi32

shell32

generic