2026-10-01_5430c44f3e2cdcaaec0fb0433aaaf073_icedid_luca-stealer_njrat_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-01_5430c44f3e2cdcaaec0fb0433aaaf073_icedid_luca-stealer_njrat_stealc
Size 8.6MB
Sample261002-rx7mqs1brf
SHA256 c17b6ec247adeb960f677071e403a1a6ef5775a5c5446804ec8931294c04486b
MD5 5430c44f3e2cdcaaec0fb0433aaaf073
SHA1 5eea0a33cc82adb4e31e90db4f3955a1bdf57622
SHA512 df662f220cebdfca3ca8fcef3a993805f88c2b779b9e04bf91ea295f7817a524611835ff0addc2445413a9d6efd8beebeab62ff7988a97c42b01c5defe854143
SSDEEP 98304:zOtTR3j2raPgmcbOex85RPgYqfAGNcF2723qt6Wb2+KcgSZTWRWrM72yqYqOc:zOXT2kc6RPVGNtDyfcgbRWcNqO
TLSH
T1E996E139558B02D9E2F2D2B8D75E8107E3B33D4983219BEF4BDC8D589E42EE9413E521
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-01_5430c44f3e2cdcaaec0fb0433aaaf073_icedid_luca-stealer_njrat_stealc

File Explorer

2026-10-01_5430c44f3e2cdcaaec0fb0433aaaf073_icedid_luca-stealer_njrat_stealc

.exe 8.6MB

2026-10-01_5430c44f3e2cdcaaec0fb0433aaaf073_icedid_luca-stealer_njrat_stealc

IMPHASH 8b89c19f63ce8f91f0a78d82f6c2430b
SHA256 c17b6ec247adeb960f677071e403a1a6ef5775a5c5446804ec8931294c04486b
MD5 5430c44f3e2cdcaaec0fb0433aaaf073
SHA1 5eea0a33cc82adb4e31e90db4f3955a1bdf57622
SHA512 df662f220cebdfca3ca8fcef3a993805f88c2b779b9e04bf91ea295f7817a524611835ff0addc2445413a9d6efd8beebeab62ff7988a97c42b01c5defe854143
SSDEEP 98304:zOtTR3j2raPgmcbOex85RPgYqfAGNcF2723qt6Wb2+KcgSZTWRWrM72yqYqOc:zOXT2kc6RPVGNtDyfcgbRWcNqO
TLSH
T1E996E139558B02D9E2F2D2B8D75E8107E3B33D4983219BEF4BDC8D589E42EE9413E521
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

3139752

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

shlwapi

StrStrIW StrCmpW StrCmpNIW

d3d11

D3D11CreateDeviceAndSwapChain

d3dcompiler_47

D3DCompile

kernel32

SetConsoleTextAttribute GetCurrentThreadId GetModuleHandleA LoadLibraryA LoadLibraryW CreateThread HeapAlloc HeapFree GetProcessHeap CreateEventA GetCurrentThread RaiseException OpenProcess VirtualProtect TerminateProcess lstrcmpA lstrcmpiA lstrcpyA lstrcatA MultiByteToWideChar K32GetDeviceDriverBaseNameW GetFileAttributesW GetComputerNameExW LocalAlloc GetComputerNameW CreateDirectoryA CreateFileA DeleteFileA FindClose FindFirstFileA FindNextFileA GetFileAttributesA GetFullPathNameA GetTempPathA GetLocalTime CopyFileA MoveFileA FileTimeToSystemTime AllocConsole AttachConsole GetConsoleWindow GlobalAlloc GlobalUnlock GlobalLock GlobalFree QueryPerformanceCounter QueryPerformanceFrequency FreeLibrary GetLocaleInfoA SetEndOfFile WriteConsoleW HeapSize SetStdHandle SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP GetACP IsValidCodePage CreateProcessW GetCurrentProcessId WaitForSingleObject HeapReAlloc GetTimeZoneInformation ReadConsoleW SetFilePointerEx GetConsoleMode GetConsoleOutputCP FlushFileBuffers GetFileType EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW FlsSetValue FlsGetValue FlsAlloc GetCommandLineW GetCommandLineA GetModuleFileNameW WriteFile FreeLibraryAndExitThread ExitThread LoadLibraryExW TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount SetUnhandledExceptionFilter GetStdHandle K32GetModuleInformation WideCharToMultiByte LocalFree GetProcAddress GetModuleHandleW VirtualFree VirtualAlloc GetTickCount64 GetSystemInfo ExitProcess GetCurrentProcess Sleep GetLastError SetHandleInformation CloseHandle ReadFile GetFileSizeEx CreateFileW GetFileInformationByHandleEx AreFileApisANSI SetFileInformationByHandle RtlUnwind SetLastError RtlUnwindEx GetStartupInfoW IsDebuggerPresent InitializeSListHead UnhandledExceptionFilter GetStringTypeW GetCPInfo CompareStringEx LCMapStringEx DecodePointer EncodePointer GetSystemTimeAsFileTime DeleteCriticalSection InitializeCriticalSectionEx LeaveCriticalSection EnterCriticalSection IsProcessorFeaturePresent GetModuleHandleExW GetExitCodeProcess FlsFree FormatMessageA GetLocaleInfoEx WaitForSingleObjectEx GetExitCodeThread ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW FindFirstFileW FindFirstFileExW FindNextFileW GetFileAttributesExW

user32

CloseClipboard SetClipboardData GetClipboardData OpenClipboard IsWindowUnicode EmptyClipboard GetKeyboardLayout MessageBoxA GetWindowTextA GetCursorPos GetSystemMetrics GetDC ReleaseDC GetWindowRect EnumDisplayDevicesA GetAsyncKeyState SetWindowDisplayAffinity TranslateMessage DispatchMessageW PeekMessageW DefWindowProcW PostQuitMessage UnregisterClassW RegisterClassExW CreateWindowExW DestroyWindow ShowWindow SetLayeredWindowAttributes SetWindowPos UpdateWindow SetForegroundWindow ShowCursor GetWindowLongPtrW TrackMouseEvent LoadCursorW ScreenToClient ClientToScreen SetCursor SetCursorPos GetClientRect GetForegroundWindow GetMessageExtraInfo ReleaseCapture SetCapture GetCapture GetKeyState SetWindowLongPtrW

gdi32

CreateCompatibleDC CreateCompatibleBitmap DeleteDC BitBlt DeleteObject SelectObject

advapi32

ConvertSidToStringSidA ConvertSidToStringSidW RegCloseKey LookupAccountNameA GetUserNameW LookupPrivilegeValueA RegQueryValueExA RegOpenKeyExA LookupPrivilegeValueW EqualSid

shell32

ShellExecuteW SHGetFolderPathA ShellExecuteA

ole32

CreateStreamOnHGlobal CoCreateInstance CoSetProxyBlanket CoInitializeSecurity CoInitialize CoInitializeEx CoUninitialize

oleaut32

SysFreeString SysAllocString VariantClear

ntdll

RtlInitUnicodeString NtClose NtMapViewOfSection NtUnmapViewOfSection RtlPcToFileHeader RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind

gdiplus

GdipGetImageEncoders GdipGetImageEncodersSize GdipCreateBitmapFromHBITMAP GdipSaveImageToStream GdipDisposeImage GdipCloneImage GdipAlloc GdiplusStartup GdiplusShutdown GdipFree

dwmapi

DwmExtendFrameIntoClientArea

imm32

ImmReleaseContext ImmSetCompositionWindow ImmSetCandidateWindow ImmGetContext

Name

.text

Size

3.7MB

Virtual Size

3.7MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

3.9MB

Virtual Size

3.9MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

864KB

Virtual Size

905KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

100KB

Virtual Size

100KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.winlice

Size

512B

Virtual Size

35B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.ccg

Size

512B

Virtual Size

63B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.kkrunch

Size

512B

Virtual Size

71B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.eazfuc

Size

512B

Virtual Size

44B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.securom

Size

512B

Virtual Size

61B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.seau

Size

512B

Virtual Size

24B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.neolite

Size

512B

Virtual Size

59B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.andpak

Size

512B

Virtual Size

36B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.obsid

Size

512B

Virtual Size

67B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.cig

Size

512B

Virtual Size

44B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pespin

Size

512B

Virtual Size

60B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.codev

Size

512B

Virtual Size

25B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.mpress

Size

512B

Virtual Size

54B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

8KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-01_5430c44f3e2cdcaaec0fb0433aaaf073_icedid_luca-stealer_njrat_stealc

shlwapi

d3d11

d3dcompiler_47

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

ntdll

gdiplus

dwmapi

imm32

generic