2026-09-29_cf2c8227ea956f228e9bfec9c2754ae6_icedid_luca-stealer_njrat_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-29_cf2c8227ea956f228e9bfec9c2754ae6_icedid_luca-stealer_njrat_stealc
Size 2.5MB
Sample260930-tzwpcsx12q
SHA256 c637b5c82a7920aeedcf9b6eb5344c211373097c6f73125187574383be60922f
MD5 cf2c8227ea956f228e9bfec9c2754ae6
SHA1 6a1a24627efdad4420c3e132eafa0254ce8397aa
SHA512 fedfbcd0bb15ae62439d03b061ce9ef7e523d5fed79df8628fc9e9a15a5a08ec9d93f0f62568ad65bbfd54216ae75103501bb320ef548ba4417fae254f51235b
SSDEEP 49152:VJT48K/mJfPAmI7yRzw7t162tw7YFb3wSqB1Y/TauUzH8AdYm0TnC6Q:VJM8Kkfy3/64w7Y1xqB14/4xdYm0rx
TLSH
T161C5235BB1F554FDC0A69538CC629A24E37BB8261351AFDF029093769E22C81DE3D732
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-29_cf2c8227ea956f228e9bfec9c2754ae6_icedid_luca-stealer_njrat_stealc

File Explorer

2026-09-29_cf2c8227ea956f228e9bfec9c2754ae6_icedid_luca-stealer_njrat_stealc

.exe 2.5MB

2026-09-29_cf2c8227ea956f228e9bfec9c2754ae6_icedid_luca-stealer_njrat_stealc

IMPHASH e9ea0e0ae77a2451cc1cca81fbe95677
SHA256 c637b5c82a7920aeedcf9b6eb5344c211373097c6f73125187574383be60922f
MD5 cf2c8227ea956f228e9bfec9c2754ae6
SHA1 6a1a24627efdad4420c3e132eafa0254ce8397aa
SHA512 fedfbcd0bb15ae62439d03b061ce9ef7e523d5fed79df8628fc9e9a15a5a08ec9d93f0f62568ad65bbfd54216ae75103501bb320ef548ba4417fae254f51235b
SSDEEP 49152:VJT48K/mJfPAmI7yRzw7t162tw7YFb3wSqB1Y/TauUzH8AdYm0TnC6Q:VJM8Kkfy3/64w7Y1xqB14/4xdYm0rx
TLSH
T161C5235BB1F554FDC0A69538CC629A24E37BB8261351AFDF029093769E22C81DE3D732
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

32564

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

user32

wsprintfA

shell32

SHGetFolderPathA ShellExecuteExA

advapi32

OpenProcessToken GetTokenInformation

oleaut32

SafeArrayCreate VariantInit SafeArrayPutElement SafeArrayUnaccessData SafeArrayAccessData SafeArrayDestroy

kernel32

CreateFileW GetConsoleMode GetConsoleOutputCP WriteConsoleW EnterCriticalSection FlushFileBuffers HeapReAlloc HeapSize SetFilePointerEx LCMapStringW CreateDirectoryA CreateFileA WriteFile IsDebuggerPresent CloseHandle GetLastError HeapAlloc HeapFree GetProcessHeap GetCurrentProcess CreateThread FlushInstructionCache GetSystemDirectoryA FreeLibrary GetModuleHandleA GetProcAddress LoadLibraryA QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent GetModuleHandleW RtlPcToFileHeader RaiseException RtlUnwindEx SetLastError LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW EncodePointer TerminateProcess GetStdHandle GetModuleFileNameW ExitProcess GetModuleHandleExW GetFileType FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle GetStringTypeW FlsAlloc FlsGetValue FlsSetValue FlsFree InitializeCriticalSectionEx VirtualProtect

Name

.dSNJ

Size

105KB

Virtual Size

105KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.hant

Size

47KB

Virtual Size

46KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.Sqmt

Size

3KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.BPck

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.wvqp

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.TTqT

Size

2.3MB

Virtual Size

2.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.KaBO

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-29_cf2c8227ea956f228e9bfec9c2754ae6_icedid_luca-stealer_njrat_stealc

user32

shell32

advapi32

oleaut32

kernel32

generic