2026-09-30_805161852412ce55c03c500ba09bbe98_icedid_luca-stealer_njrat_stealc

General

Target
2026-09-30_805161852412ce55c03c500ba09bbe98_icedid_luca-stealer_njrat_stealc
Size 5.2MB
Sample261001-nfph2ssvbt
SHA256 39d2ebf968d083cdb01f8793402fb95aa75aee15c1f17e6327d0bd738b141279
MD5 805161852412ce55c03c500ba09bbe98
SHA1 8702c0f06c813901b7590e9f108d39c485169894
SHA512 b561381c4d982cf9b7e829b5843edb109154ee6b975150edd5a20a5b398eeb7f1734fc096120c330be7d261c98a3ab7ac436adc4d3b24141defaca4c34207b71
SSDEEP 49152:8Aw0C0bwQVaXdUMM+eUBWxMUmBB806NkRzBEufpbksj2r4ceGQpsi+A6pEiDaWFM:Lra7BS4RjHceG86pFqdEX2/
TLSH
T16646AD0F71D51DA8F372C37D86A2A622E6723C010F3059CB16E1719D5FABAD09E7A712
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects executables containing URLs to raw contents of a Github gist 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-30_805161852412ce55c03c500ba09bbe98_icedid_luca-stealer_njrat_stealc

File Explorer

2026-09-30_805161852412ce55c03c500ba09bbe98_icedid_luca-stealer_njrat_stealc

.exe 5.2MB

2026-09-30_805161852412ce55c03c500ba09bbe98_icedid_luca-stealer_njrat_stealc

IMPHASH 41cd11916bcc956ce2392f20e32fee65
SHA256 39d2ebf968d083cdb01f8793402fb95aa75aee15c1f17e6327d0bd738b141279
MD5 805161852412ce55c03c500ba09bbe98
SHA1 8702c0f06c813901b7590e9f108d39c485169894
SHA512 b561381c4d982cf9b7e829b5843edb109154ee6b975150edd5a20a5b398eeb7f1734fc096120c330be7d261c98a3ab7ac436adc4d3b24141defaca4c34207b71
SSDEEP 49152:8Aw0C0bwQVaXdUMM+eUBWxMUmBB806NkRzBEufpbksj2r4ceGQpsi+A6pEiDaWFM:Lra7BS4RjHceG86pFqdEX2/
TLSH
T16646AD0F71D51DA8F372C37D86A2A622E6723C010F3059CB16E1719D5FABAD09E7A712
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects executables containing URLs to raw contents of a Github gist
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

12332

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

shell32

ShellExecuteW

advapi32

GetTokenInformation OpenProcessToken

kernel32

WriteConsoleW TlsAlloc GetStdHandle CreateFileW DeleteFileW GetFileSizeEx SetFilePointer WriteFile GetTempPathW CloseHandle GetLastError QueryPerformanceCounter HeapAlloc HeapFree GetProcessHeap WaitForSingleObject Sleep GetCurrentProcess GetCurrentProcessId CreateProcessW GetModuleFileNameW LoadResource LockResource SizeofResource FindResourceW SetConsoleTextAttribute SetConsoleWindowInfo SetConsoleTitleW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW GetModuleHandleW RtlPcToFileHeader RaiseException RtlUnwindEx SetLastError EncodePointer EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsGetValue TlsSetValue TlsFree FreeLibrary GetProcAddress LoadLibraryExW ExitProcess GetModuleHandleExW GetCommandLineA GetCommandLineW FlsAlloc FlsGetValue FlsSetValue FlsFree InitializeCriticalSectionEx VirtualProtect CompareStringW LCMapStringW GetFileType GetExitCodeProcess GetFileAttributesExW FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle GetStringTypeW FlushFileBuffers GetConsoleOutputCP GetConsoleMode SetFilePointerEx HeapSize HeapReAlloc

Name

.text

Size

107KB

Virtual Size

108KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

47KB

Virtual Size

48KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.data

Size

4KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

6KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

5.1MB

Virtual Size

5.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-30_805161852412ce55c03c500ba09bbe98_icedid_luca-stealer_njrat_stealc

shell32

advapi32

kernel32

generic