2026-09-30_73930ff79b7ef6ff7f78858e9d5a297d_icedid_luca-stealer_njrat

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-30_73930ff79b7ef6ff7f78858e9d5a297d_icedid_luca-stealer_njrat
Size 4.1MB
Sample260930-mgws3sce76
SHA256 75d8ed7d3dcb930e0d28930964bb93be3e8aa26e3952da84d96927cea0be3210
MD5 73930ff79b7ef6ff7f78858e9d5a297d
SHA1 063b1773f3df7ffc381dcbef648d3f07434c4525
SHA512 e209f23f335f493e49dc32bcf37cbe526f82811397e906670a58cbd2bfbb1fcc9d45cf4a897cde96368825b586bcdbbb38e491946a20b1bef54f01d55104fb74
SSDEEP 49152:lt/MLYKy75Fbv5iUk2sY3K9jiRPgVZ9VQjW1+OsEq2hxSMmT8oWgBCaXmyMRYmJR:lrxVqjCPgjV+M4FHXzYbJzl8l+M4FHX
TLSH
T15A16D02E6EA902E8D177C17CC9525507EBB17C050360AADF0EA47676EF37AE05A7E301
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-30_73930ff79b7ef6ff7f78858e9d5a297d_icedid_luca-stealer_njrat

File Explorer

2026-09-30_73930ff79b7ef6ff7f78858e9d5a297d_icedid_luca-stealer_njrat

.exe 4.1MB

2026-09-30_73930ff79b7ef6ff7f78858e9d5a297d_icedid_luca-stealer_njrat

IMPHASH ecebfc2778eef6d2422c4401eff46bc6
SHA256 75d8ed7d3dcb930e0d28930964bb93be3e8aa26e3952da84d96927cea0be3210
MD5 73930ff79b7ef6ff7f78858e9d5a297d
SHA1 063b1773f3df7ffc381dcbef648d3f07434c4525
SHA512 e209f23f335f493e49dc32bcf37cbe526f82811397e906670a58cbd2bfbb1fcc9d45cf4a897cde96368825b586bcdbbb38e491946a20b1bef54f01d55104fb74
SSDEEP 49152:lt/MLYKy75Fbv5iUk2sY3K9jiRPgVZ9VQjW1+OsEq2hxSMmT8oWgBCaXmyMRYmJR:lrxVqjCPgjV+M4FHXzYbJzl8l+M4FHX
TLSH
T15A16D02E6EA902E8D177C17CC9525507EBB17C050360AADF0EA47676EF37AE05A7E301
MD5 SHA1 SHA512 SSDEEP TLSH

windows:10 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1431808

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

SAUcli.pdb

shell32

SHGetFolderPathW SHGetKnownFolderPath CommandLineToArgvW

kernel32

OutputDebugStringA InitializeSRWLock WakeConditionVariable InitializeConditionVariable ReleaseSRWLockExclusive AcquireSRWLockExclusive SleepConditionVariableSRW GetModuleHandleA VirtualAlloc GetSystemInfo Sleep GetCurrentThreadId GetLogicalProcessorInformation FreeLibrary LoadLibraryExW GetCurrentProcess TerminateProcess OutputDebugStringW GetCurrentProcessId OpenProcess LoadLibraryExA SetEnvironmentVariableW GetEnvironmentVariableW SetSearchPathMode HeapSetInformation GetProcessHeap SetDllDirectoryW CreateFileW ExpandEnvironmentStringsW ExitThread CreateThread EnterCriticalSection LeaveCriticalSection InitializeCriticalSection WideCharToMultiByte GetSystemTimeAsFileTime WriteFile GetConsoleMode WriteConsoleW UnlockFileEx GetOverlappedResult GetOverlappedResultEx LockFileEx GetFileInformationByHandleEx DeviceIoControl SetFilePointer SetEndOfFile GetFileInformationByHandle MoveFileExW ReplaceFileW FlushFileBuffers GetModuleFileNameW GetFileAttributesW GetStdHandle FileTimeToSystemTime FreeEnvironmentStringsW FormatMessageW RaiseException VirtualProtect VirtualQuery GetACP MultiByteToWideChar FindClose FindNextFileW SetLastError ReadFile GetModuleHandleW DeleteCriticalSection LocalFree GetProcAddress DecodePointer InitializeCriticalSectionEx GetCommandLineW CreateIoCompletionPort CancelIoEx GetQueuedCompletionStatus RtlUnwind CloseHandle SetEvent GetLastError CreateEventW WaitForSingleObject GetOEMCP GetEnvironmentStringsW HeapSize IsValidCodePage HeapReAlloc SetStdHandle SetFilePointerEx GetFileSizeEx GetTimeZoneInformation EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW WakeAllConditionVariable RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW QueryPerformanceCounter InitializeSListHead FormatMessageA GetLocaleInfoEx FindFirstFileExW GetTempPathW AreFileApisANSI GetStringTypeW WaitForSingleObjectEx SwitchToThread GetExitCodeThread QueryPerformanceFrequency TryAcquireSRWLockExclusive ReleaseSRWLockShared AcquireSRWLockShared EncodePointer LCMapStringEx CompareStringEx GetCPInfo RtlUnwindEx RtlPcToFileHeader InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree GetFileType ReadConsoleW GetConsoleOutputCP ExitProcess GetModuleHandleExW FreeLibraryAndExitThread GetCommandLineA HeapFree HeapAlloc FlsAlloc FlsGetValue FlsSetValue FlsFree GetDateFormatW GetTimeFormatW CompareStringW

advapi32

IsWellKnownSid FreeSid RegDeleteKeyExW RegSetKeySecurity RegCopyTreeW ConvertStringSecurityDescriptorToSecurityDescriptorW ConvertSidToStringSidA OpenProcessToken GetTokenInformation AllocateAndInitializeSid CheckTokenMembership RegQueryInfoKeyW RegDeleteKeyW RegEnumKeyExW RegDeleteTreeW RegDeleteValueW RegEnumValueW RegCloseKey RegCreateKeyExW RegSetValueExW RegOpenKeyExW RegQueryValueExW

ole32

CoTaskMemFree

bcrypt

BCryptCloseAlgorithmProvider BCryptOpenAlgorithmProvider BCryptGetProperty BCryptCreateHash BCryptHashData BCryptDestroyHash BCryptFinishHash

version

GetFileVersionInfoSizeW VerQueryValueW GetFileVersionInfoW

Name

.text

Size

1.6MB

Virtual Size

1.6MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

463KB

Virtual Size

462KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

35KB

Virtual Size

55KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

71KB

Virtual Size

71KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.didat

Size

512B

Virtual Size

64B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

106KB

Virtual Size

106KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1.9MB

Virtual Size

1.9MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-30_73930ff79b7ef6ff7f78858e9d5a297d_icedid_luca-stealer_njrat

shell32

kernel32

advapi32

ole32

bcrypt

version

generic