2026-10-01_bbeacc98b8d8f53557736e2f3bebf86c_icedid_luca-stealer_njrat_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-01_bbeacc98b8d8f53557736e2f3bebf86c_icedid_luca-stealer_njrat_stealc
Size 1.3MB
Sample261002-e1fbfavape
SHA256 994841644f10d232a37f8a6d0f8d1f62d6a8ceb8df96993f30bc5ef82f3c1db3
MD5 bbeacc98b8d8f53557736e2f3bebf86c
SHA1 2d45b74a17bfa0b35c98b1b42e237d08da4865cc
SHA512 1693e3d2799f4dc159f5ed8b93985cbad75b4885c858dafe8ed89bd71d1ba0ab9340333a5d9ad34d251d08baf387a8d693c9fdf51f2c32106b46ff572af3cd3d
SSDEEP 24576:87W+K0yqkRiOO8NckmMT+df7ixOFthHE8MEX1XsdIAhb0VECwN:uWUytRzyk/+17ixO3hHE8MEXWI4bMQN
TLSH
T12C55D016A7E811F9E0BBD276CC634516FBB2BC165B7096CF03A1425A1F37A904E3E721
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-01_bbeacc98b8d8f53557736e2f3bebf86c_icedid_luca-stealer_njrat_stealc

File Explorer

2026-10-01_bbeacc98b8d8f53557736e2f3bebf86c_icedid_luca-stealer_njrat_stealc

.exe 1.3MB

2026-10-01_bbeacc98b8d8f53557736e2f3bebf86c_icedid_luca-stealer_njrat_stealc

IMPHASH b52bd34300fe569ecf3993d50ae07436
SHA256 994841644f10d232a37f8a6d0f8d1f62d6a8ceb8df96993f30bc5ef82f3c1db3
MD5 bbeacc98b8d8f53557736e2f3bebf86c
SHA1 2d45b74a17bfa0b35c98b1b42e237d08da4865cc
SHA512 1693e3d2799f4dc159f5ed8b93985cbad75b4885c858dafe8ed89bd71d1ba0ab9340333a5d9ad34d251d08baf387a8d693c9fdf51f2c32106b46ff572af3cd3d
SSDEEP 24576:87W+K0yqkRiOO8NckmMT+df7ixOFthHE8MEX1XsdIAhb0VECwN:uWUytRzyk/+17ixO3hHE8MEXWI4bMQN
TLSH
T12C55D016A7E811F9E0BBD276CC634516FBB2BC165B7096CF03A1425A1F37A904E3E721
MD5 SHA1 SHA512 SSDEEP TLSH

windows:10 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

282672

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

MsSense.pdb

kernel32

CloseThreadpoolTimer WaitForThreadpoolTimerCallbacks SetThreadpoolTimer GetModuleFileNameW DeleteCriticalSection InitializeCriticalSectionEx LeaveCriticalSection CreateFileW FindFirstVolumeW FindNextVolumeW FindVolumeClose GetDriveTypeW GetLogicalDrives GetVolumeInformationW QueryDosDeviceW GetVolumeNameForVolumeMountPointW GetVolumePathNamesForVolumeNameW DeviceIoControl MultiByteToWideChar QueryPerformanceCounter CompareFileTime CreateThreadpoolTimer GetSystemTimeAsFileTime GetProductInfo GetVersionExW Sleep AcquireSRWLockShared DeleteFileW FindClose FindFirstFileW FindNextFileW FlushFileBuffers GetFileAttributesW RemoveDirectoryW SetFileAttributesW SetFilePointerEx WriteFile AcquireSRWLockExclusive ReleaseSRWLockShared ReleaseSRWLockExclusive VerSetConditionMask LoadLibraryW FreeLibrary MoveFileExW WriteConsoleW GetWindowsDirectoryW GetComputerNameExW EnterCriticalSection GetTempPathW GlobalAlloc GetTempFileNameW SetStdHandle SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW FindFirstFileExW GetOEMCP GetLongPathNameW TerminateProcess GetCurrentProcess InitOnceComplete InitOnceBeginInitialize WideCharToMultiByte FormatMessageW GetProcAddress GetModuleHandleExW GetModuleHandleW GetACP IsValidCodePage GetModuleFileNameA CompareStringW GetConsoleMode GetConsoleOutputCP EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW DecodePointer HeapReAlloc HeapSize GetCurrentThreadId GetCurrentProcessId CreateSemaphoreExW CreateMutexExW LCMapStringW OpenSemaphoreW WaitForSingleObjectEx FlsFree WaitForSingleObject ReleaseMutex ReleaseSemaphore FlsSetValue FlsGetValue FlsAlloc GetFileType ExpandEnvironmentStringsW GetCommandLineW GetCommandLineA GetStdHandle ExitProcess LoadLibraryExW GlobalFree TlsFree TlsSetValue VerifyVersionInfoW TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount InterlockedPushEntrySList RtlUnwindEx GetStartupInfoW IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext InitializeSListHead GetProcessHeap HeapFree HeapAlloc SetLastError GetLastError CloseHandle OutputDebugStringW DebugBreak IsDebuggerPresent RaiseException GetSystemInfo VirtualProtect VirtualQuery LoadLibraryExA LCMapStringEx GetCPInfo CompareStringEx RtlPcToFileHeader GetStringTypeW WakeAllConditionVariable SleepConditionVariableSRW EncodePointer

advapi32

RegGetValueW RegDeleteKeyValueW RegOpenKeyExW RegCreateKeyExW OpenSCManagerW CloseServiceHandle RegSetValueExW StartServiceCtrlDispatcherW EventRegister EventUnregister EventSetInformation EventWriteTransfer GetSecurityDescriptorOwner GetSecurityDescriptorGroup GetSecurityDescriptorDacl LookupPrivilegeValueW AdjustTokenPrivileges OpenProcessToken SetNamedSecurityInfoW ConvertStringSecurityDescriptorToSecurityDescriptorW GetSecurityDescriptorSacl DestroyPrivateObjectSecurity ChangeServiceConfigW OpenServiceW StartServiceW RegCloseKey QueryServiceConfigW ControlService

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

api-ms-win-core-featurestaging-l1-1-0

SubscribeFeatureStateChangeNotification RecordFeatureError RecordFeatureUsage UnsubscribeFeatureStateChangeNotification GetFeatureEnabledState

api-ms-win-core-featurestaging-l1-1-1

GetFeatureVariant

api-ms-win-core-path-l1-1-0

PathCchCombine

userenv

GetAllUsersProfileDirectoryW

ws2_32

InetNtopW

iphlpapi

GetUnicastIpAddressEntry GetIfEntry2 FreeMibTable GetUnicastIpAddressTable

setupapi

SetupDiDestroyDeviceInfoList SetupDiEnumDeviceInfo SetupDiGetDeviceInterfaceDetailW SetupDiGetClassDevsW SetupDiGetDevicePropertyW SetupDiGetDeviceRegistryPropertyW SetupOpenInfFileW SetupDiEnumDeviceInterfaces SetupInstallFromInfSectionW SetupInstallServicesFromInfSectionW

bcrypt

BCryptCloseAlgorithmProvider BCryptDestroyHash

ntdll

RtlInitUnicodeString

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleExA

Name

.text

Size

476KB

Virtual Size

472KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

188KB

Virtual Size

186KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

16KB

Virtual Size

30KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

28KB

Virtual Size

24KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.didat

Size

4KB

Virtual Size

32B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

44KB

Virtual Size

40KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

576KB

Virtual Size

580KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-01_bbeacc98b8d8f53557736e2f3bebf86c_icedid_luca-stealer_njrat_stealc

kernel32

advapi32

version

api-ms-win-core-featurestaging-l1-1-0

api-ms-win-core-featurestaging-l1-1-1

api-ms-win-core-path-l1-1-0

userenv

ws2_32

iphlpapi

setupapi

bcrypt

ntdll

api-ms-win-core-libraryloader-l1-2-0

generic