2026-09-30_70c21bf2badbaccaf9c43d08a61a768c_icedid_luca-stealer_njrat_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-30_70c21bf2badbaccaf9c43d08a61a768c_icedid_luca-stealer_njrat_stealc
Size 2.7MB
Sample261001-pj4b2sbf92
SHA256 8223cb1c0699e94fca51c046090a4311d1e6d020d78255709633acb04112d8b5
MD5 70c21bf2badbaccaf9c43d08a61a768c
SHA1 ce532463585e50f0ff243e983fd039c9f8ea7750
SHA512 d935a44e84678723ad3063e973471284f7cc64699778ebfc03c7350acffffe0f7193f87f8429a5aad708dfe3e99d9e6a6fcfb85b0e261b133326fecd767bb42e
SSDEEP 49152:DHbi0I2zXdvU/lTM8t+18/In/96rBt1BadNEsYbMcbwbQFsHvkS0BYiE1QzGxubz:ni0I2lURH+18/In/96rBqEs8bw8FscSH
TLSH
T1C6D5AE125AE861A8E1F6F2B4C9AB4506EA737C495F3182CF2254694E1F336E09D3D733
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-30_70c21bf2badbaccaf9c43d08a61a768c_icedid_luca-stealer_njrat_stealc

File Explorer

2026-09-30_70c21bf2badbaccaf9c43d08a61a768c_icedid_luca-stealer_njrat_stealc

.exe 2.7MB

2026-09-30_70c21bf2badbaccaf9c43d08a61a768c_icedid_luca-stealer_njrat_stealc

IMPHASH 655eb7ec95c450cbecda945389b25cd8
SHA256 8223cb1c0699e94fca51c046090a4311d1e6d020d78255709633acb04112d8b5
MD5 70c21bf2badbaccaf9c43d08a61a768c
SHA1 ce532463585e50f0ff243e983fd039c9f8ea7750
SHA512 d935a44e84678723ad3063e973471284f7cc64699778ebfc03c7350acffffe0f7193f87f8429a5aad708dfe3e99d9e6a6fcfb85b0e261b133326fecd767bb42e
SSDEEP 49152:DHbi0I2zXdvU/lTM8t+18/In/96rBt1BadNEsYbMcbwbQFsHvkS0BYiE1QzGxubz:ni0I2lURH+18/In/96rBqEs8bw8FscSH
TLSH
T1C6D5AE125AE861A8E1F6F2B4C9AB4506EA737C495F3182CF2254694E1F336E09D3D733
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

603632

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\agent\_work\20\s\x64\Release\HotkeyServiceUWP.pdb

rpcrt4

RpcServerUseProtseqEpW RpcServerUnregisterIf RpcServerRegisterIf3 RpcServerListen RpcMgmtStopServerListening NdrClientCall3 NdrServerCallAll NdrServerCall2

api-ms-win-core-processenvironment-l1-1-0

ExpandEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA SetStdHandle GetStdHandle SetEnvironmentVariableW GetEnvironmentVariableW

api-ms-win-core-errorhandling-l1-1-0

RaiseException SetLastError UnhandledExceptionFilter GetLastError SetUnhandledExceptionFilter

api-ms-win-core-heap-l1-1-0

GetProcessHeap HeapReAlloc HeapSize HeapFree HeapAlloc HeapDestroy

api-ms-win-core-synch-l1-2-0

SleepConditionVariableSRW Sleep WakeAllConditionVariable

api-ms-win-core-libraryloader-l1-2-0

FreeLibrary FreeLibraryAndExitThread LoadLibraryExW LoadStringW GetProcAddress GetModuleHandleExW LockResource GetModuleHandleW GetModuleFileNameW LoadResource FindResourceExW SizeofResource

api-ms-win-core-libraryloader-l1-2-1

FindResourceW

api-ms-win-core-string-l1-1-0

CompareStringW CompareStringEx GetStringTypeW WideCharToMultiByte MultiByteToWideChar

api-ms-win-core-com-l1-1-0

CoSetProxyBlanket CoCreateInstance CoInitializeSecurity CoInitializeEx CoUninitialize

oleaut32

SafeArrayPutElement SafeArrayDestroy SafeArrayCreateVector GetErrorInfo SafeArrayGetElement VariantClear VariantInit SysAllocString SysFreeString

api-ms-win-core-handle-l1-1-0

CloseHandle SetHandleInformation

api-ms-win-core-processthreads-l1-1-0

ExitProcess QueueUserAPC CreateThread ProcessIdToSessionId TlsFree TlsSetValue TlsGetValue TlsAlloc GetThreadId TerminateProcess OpenProcessToken CreateProcessAsUserW ExitThread GetCurrentThreadId CreateProcessW GetCurrentProcessId GetStartupInfoW GetCurrentProcess GetExitCodeProcess GetCurrentThread OpenThreadToken

api-ms-win-core-processthreads-l1-1-1

OpenProcess IsProcessorFeaturePresent

api-ms-win-security-base-l1-1-0

AllocateAndInitializeSid GetAclInformation AdjustTokenPrivileges DuplicateTokenEx GetAce CreateWellKnownSid GetLengthSid CopySid RevertToSelf AddAccessAllowedAce GetTokenInformation AddAce FreeSid ImpersonateLoggedOnUser SetTokenInformation SetSecurityDescriptorOwner SetSecurityDescriptorGroup SetSecurityDescriptorDacl IsValidSid InitializeSecurityDescriptor InitializeAcl

api-ms-win-security-lsalookup-l2-1-0

LookupPrivilegeValueW

api-ms-win-core-kernel32-legacy-l1-1-0

MoveFileW WTSGetActiveConsoleSessionId

userenv

CreateEnvironmentBlock GetUserProfileDirectoryW DestroyEnvironmentBlock

api-ms-win-core-synch-l1-1-0

ResetEvent InitializeCriticalSection AcquireSRWLockExclusive ReleaseSRWLockExclusive InitializeCriticalSectionAndSpinCount InitializeCriticalSectionEx ReleaseMutex ReleaseSemaphore CreateMutexW EnterCriticalSection WaitForMultipleObjectsEx LeaveCriticalSection SleepEx SetEvent DeleteCriticalSection WaitForSingleObjectEx CreateEventW TryAcquireSRWLockExclusive WaitForSingleObject

api-ms-win-core-registry-l1-1-0

RegGetValueW RegCreateKeyExW RegSetValueExW RegNotifyChangeKeyValue RegOpenKeyExW RegCloseKey RegQueryValueExW

api-ms-win-core-file-l1-1-0

FindFirstFileW FlushFileBuffers CreateDirectoryW GetFileSizeEx SetFilePointerEx GetFileType DeleteFileW GetFileAttributesW ReadFile WriteFile FindClose FindNextFileW GetFileAttributesExW GetFileInformationByHandle CreateFileW GetFullPathNameW RemoveDirectoryW GetLongPathNameW FindFirstFileExW GetTempFileNameW SetEndOfFile

api-ms-win-core-io-l1-1-0

DeviceIoControl GetOverlappedResult

api-ms-win-core-heap-l2-1-0

LocalFree LocalAlloc

api-ms-win-core-localization-l1-2-0

GetCPInfo IsValidLocale GetLocaleInfoEx LCMapStringW FormatMessageW GetLocaleInfoW EnumSystemLocalesW LCMapStringEx GetUserDefaultLCID IsValidCodePage GetACP GetOEMCP FormatMessageA

api-ms-win-core-sidebyside-l1-1-0

ActivateActCtx ReleaseActCtx DeactivateActCtx CreateActCtxW

api-ms-win-core-version-l1-1-1

GetFileVersionInfoSizeW GetFileVersionInfoW

api-ms-win-core-version-l1-1-0

VerQueryValueW

api-ms-win-service-management-l1-1-0

OpenServiceW DeleteService CreateServiceW CloseServiceHandle OpenSCManagerW

api-ms-win-service-management-l2-1-0

QueryServiceStatusEx QueryServiceConfigW ChangeServiceConfig2W

ext-ms-win-shell32-shellfolders-l1-1-0

SHGetFolderPathW

api-ms-win-core-toolhelp-l1-1-0

CreateToolhelp32Snapshot Process32NextW Process32FirstW

api-ms-win-core-file-l2-1-0

CreateSymbolicLinkW ReadDirectoryChangesW MoveFileExW CreateHardLinkW

api-ms-win-core-registry-l2-1-0

RegDeleteKeyW

api-ms-win-security-sddl-l1-1-0

ConvertSidToStringSidW

api-ms-win-core-namedpipe-l1-1-0

CreatePipe

api-ms-win-core-io-l1-1-1

CancelIo

api-ms-win-core-synch-l1-2-1

CreateSemaphoreW WaitForMultipleObjects

api-ms-win-core-string-obsolete-l1-1-0

lstrcmpiW lstrlenW

api-ms-win-core-shlwapi-legacy-l1-1-0

PathFindFileNameW

api-ms-win-security-base-l1-2-2

DeriveCapabilitySidsFromName

api-ms-win-security-provider-l1-1-0

SetEntriesInAclW

api-ms-win-core-threadpool-legacy-l1-1-0

QueueUserWorkItem

api-ms-win-core-threadpool-l1-2-0

SubmitThreadpoolWork CreateThreadpoolWork

api-ms-win-eventlog-legacy-l1-1-0

RegisterEventSourceW DeregisterEventSource ReportEventW

api-ms-win-service-core-l1-1-0

RegisterServiceCtrlHandlerExW SetServiceStatus StartServiceCtrlDispatcherW

api-ms-win-service-winsvc-l1-1-0

QueryServiceStatus ControlService

api-ms-win-core-util-l1-1-0

DecodePointer EncodePointer

user32

MsgWaitForMultipleObjectsEx

ole32

OleRun

hppkanalyticclientlib

?GetInstance@CAnalyticsManager@Analytics@ProgrammableKey@@SAPEAV123@XZ ?ReleaseAnalyticsManager@CAnalyticsManager@Analytics@ProgrammableKey@@SAXXZ ?RegisterDataClass@CAnalyticsManager@Analytics@ProgrammableKey@@QEAA?AW4AnalyticsResult@Emitters@2HP@@XZ ?CollectAndSendEvent@CAnalyticsManager@Analytics@ProgrammableKey@@QEAA?AW4AnalyticsResult@Emitters@2HP@@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z ?GenerateProgKeyJsonString@AnalyticsEventFactory@Analytics@ProgrammableKey@@SA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@U_PROGKEY_EVENTDATA_@23@@Z ?InitializeAnalyticsSession@CAnalyticsManager@Analytics@ProgrammableKey@@QEAAXXZ

notificationmanager

?BroadcastEvent@EventHandler@ServiceNotification@@SAXW4ServiceEvent@2@PEB_W@Z ?Subscribe@CallbackSubscriber@ServiceNotification@@SA_N_JV?$vector@W4ServiceEvent@ServiceNotification@@V?$allocator@W4ServiceEvent@ServiceNotification@@@std@@@std@@@Z ?UnSubscribe@CallbackSubscriber@ServiceNotification@@SA_N_J@Z ?Notify@EventHandler@ServiceNotification@@SAH_JP6AHIPEA_W0@Z@Z

wtsapi32

WTSFreeMemory WTSSendMessageW WTSQuerySessionInformationW WTSQueryUserToken WTSEnumerateProcessesW WTSEnumerateSessionsW

api-ms-win-core-debug-l1-1-0

OutputDebugStringW IsDebuggerPresent

api-ms-win-core-sysinfo-l1-2-0

VerSetConditionMask

api-ms-win-core-file-l1-2-2

AreFileApisANSI

api-ms-win-core-file-l2-1-2

CopyFileW

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetLocalTime GetSystemTimeAsFileTime

api-ms-win-core-interlocked-l1-1-0

InterlockedPushEntrySList InitializeSListHead

api-ms-win-core-rtlsupport-l1-1-0

RtlUnwindEx RtlPcToFileHeader RtlCaptureContext RtlVirtualUnwind RtlUnwind RtlLookupFunctionEntry

setupapi

SetupDiEnumDriverInfoW SetupDiEnumDeviceInfo SetupDiBuildDriverInfoList SetupDiDestroyDeviceInfoList SetupDiEnumDeviceInterfaces SetupDiGetClassDevsW SetupDiGetDeviceInterfaceDetailW

api-ms-win-core-realtime-l1-1-0

QueryUnbiasedInterruptTime

api-ms-win-shell-shdirectory-l1-1-0

ord290

api-ms-win-core-kernel32-legacy-l1-1-1

VerifyVersionInfoW

api-ms-win-core-timezone-l1-1-0

GetTimeZoneInformation

api-ms-win-core-fibers-l1-1-0

FlsGetValue FlsSetValue FlsFree FlsAlloc

api-ms-win-core-memory-l1-1-0

VirtualProtect

api-ms-win-core-datetime-l1-1-0

GetTimeFormatW GetDateFormatW

api-ms-win-core-console-l1-1-0

ReadConsoleW WriteConsoleW GetConsoleOutputCP GetConsoleMode

shlwapi

StrCmpNIW StrTrimW

??0AnalyticsSession@@QEAA@$$QEAV0@@Z ??0AnalyticsSession@@QEAA@AEBV0@@Z ??0AppSession@Session@Analytics@HP@@QEAA@$$QEAV0123@@Z ??0AppSession@Session@Analytics@HP@@QEAA@AEBV0123@@Z ??0BaseDataClass@DataClass@Analytics@HP@@QEAA@$$QEAV0123@@Z ??0BaseDataClass@DataClass@Analytics@HP@@QEAA@AEBV0123@@Z ??0ConsentObject@@QEAA@$$QEAV0@@Z ??0ConsentObject@@QEAA@AEBV0@@Z ??0DataClassFieldInfo@DataClass@Analytics@HP@@QEAA@$$QEAV0123@@Z ??0DataClassFieldInfo@DataClass@Analytics@HP@@QEAA@AEBV0123@@Z ??0DataClassFieldInfo@DataClass@Analytics@HP@@QEAA@XZ ??0PrivacyDocuments@@QEAA@$$QEAV0@@Z ??0PrivacyDocuments@@QEAA@AEBV0@@Z ??1AnalyticsSession@@QEAA@XZ ??1AppSession@Session@Analytics@HP@@QEAA@XZ ??1BaseDataClass@DataClass@Analytics@HP@@QEAA@XZ ??1ConsentObject@@QEAA@XZ ??1DataClassFieldInfo@DataClass@Analytics@HP@@QEAA@XZ ??1PrivacyDocuments@@QEAA@XZ ??4AnalyticsSession@@QEAAAEAV0@$$QEAV0@@Z ??4AnalyticsSession@@QEAAAEAV0@AEBV0@@Z ??4AppSession@Session@Analytics@HP@@QEAAAEAV0123@$$QEAV0123@@Z ??4AppSession@Session@Analytics@HP@@QEAAAEAV0123@AEBV0123@@Z ??4BaseDataClass@DataClass@Analytics@HP@@QEAAAEAV0123@$$QEAV0123@@Z ??4BaseDataClass@DataClass@Analytics@HP@@QEAAAEAV0123@AEBV0123@@Z ??4ConsentObject@@QEAAAEAV0@$$QEAV0@@Z ??4ConsentObject@@QEAAAEAV0@AEBV0@@Z ??4DataClassFieldInfo@DataClass@Analytics@HP@@QEAAAEAV0123@$$QEAV0123@@Z ??4DataClassFieldInfo@DataClass@Analytics@HP@@QEAAAEAV0123@AEBV0123@@Z ??4PrivacyDocuments@@QEAAAEAV0@$$QEAV0@@Z ??4PrivacyDocuments@@QEAAAEAV0@AEBV0@@Z ??4ProcessingPermissions@@QEAAAEAV0@$$QEAV0@@Z ??4ProcessingPermissions@@QEAAAEAV0@AEBV0@@Z ??_7BaseDataClass@DataClass@Analytics@HP@@6B@ ?__autoclassinit2@AnalyticsSession@@QEAAX_K@Z

Name

.text

Size

911KB

Virtual Size

911KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

306KB

Virtual Size

306KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

15KB

Virtual Size

24KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

38KB

Virtual Size

38KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

154KB

Virtual Size

154KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

UPX1

Size

1.3MB

Virtual Size

1.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-30_70c21bf2badbaccaf9c43d08a61a768c_icedid_luca-stealer_njrat_stealc

rpcrt4

api-ms-win-core-processenvironment-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-libraryloader-l1-2-1

api-ms-win-core-string-l1-1-0

api-ms-win-core-com-l1-1-0

oleaut32

api-ms-win-core-handle-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-processthreads-l1-1-1

api-ms-win-security-base-l1-1-0

api-ms-win-security-lsalookup-l2-1-0

api-ms-win-core-kernel32-legacy-l1-1-0

userenv

api-ms-win-core-synch-l1-1-0

api-ms-win-core-registry-l1-1-0

api-ms-win-core-file-l1-1-0

api-ms-win-core-io-l1-1-0

api-ms-win-core-heap-l2-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-sidebyside-l1-1-0

api-ms-win-core-version-l1-1-1

api-ms-win-core-version-l1-1-0

api-ms-win-service-management-l1-1-0

api-ms-win-service-management-l2-1-0

ext-ms-win-shell32-shellfolders-l1-1-0

api-ms-win-core-toolhelp-l1-1-0

api-ms-win-core-file-l2-1-0

api-ms-win-core-registry-l2-1-0

api-ms-win-security-sddl-l1-1-0

api-ms-win-core-namedpipe-l1-1-0

api-ms-win-core-io-l1-1-1

api-ms-win-core-synch-l1-2-1

api-ms-win-core-string-obsolete-l1-1-0

api-ms-win-core-shlwapi-legacy-l1-1-0

api-ms-win-security-base-l1-2-2

api-ms-win-security-provider-l1-1-0

api-ms-win-core-threadpool-legacy-l1-1-0

api-ms-win-core-threadpool-l1-2-0

api-ms-win-eventlog-legacy-l1-1-0

api-ms-win-service-core-l1-1-0

api-ms-win-service-winsvc-l1-1-0

api-ms-win-core-util-l1-1-0

user32

ole32

hppkanalyticclientlib

notificationmanager

wtsapi32

api-ms-win-core-debug-l1-1-0

api-ms-win-core-sysinfo-l1-2-0

api-ms-win-core-file-l1-2-2

api-ms-win-core-file-l2-1-2

api-ms-win-core-profile-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-interlocked-l1-1-0

api-ms-win-core-rtlsupport-l1-1-0

setupapi

api-ms-win-core-realtime-l1-1-0

api-ms-win-shell-shdirectory-l1-1-0

api-ms-win-core-kernel32-legacy-l1-1-1

api-ms-win-core-timezone-l1-1-0

api-ms-win-core-fibers-l1-1-0

api-ms-win-core-memory-l1-1-0

api-ms-win-core-datetime-l1-1-0

api-ms-win-core-console-l1-1-0

shlwapi

generic