2026-10-01_4356ea3d81c8ca6cc0388f2fa527f1a1_icedid_luca-stealer_njrat_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-01_4356ea3d81c8ca6cc0388f2fa527f1a1_icedid_luca-stealer_njrat_stealc
Size 3.9MB
Sample261002-s85sysywaw
SHA256 b594640325b2358e381af8e664e7cef84a22f3ac5940bb2a108c26f3563788a5
MD5 4356ea3d81c8ca6cc0388f2fa527f1a1
SHA1 2b935cbfa6a0be750113453dd76efd79bf58520c
SHA512 ed4fa35c18ad349d2dfad44025abd3b624f18a73559f1d9c49081e8f74fea771c59b23002bc69bcb28d4057f752e931b8e7a7407de5512a2c6a0c75235448d13
SSDEEP 49152:Gc9zeNbhkGfinGQTT8+HELMvAs8pWy4y3VLuxPNyA+2dmKrTZJ2hIS/LBi:hYHQARjVqxDmGTZUhIS/
TLSH
T14A16F006E1974268DF72AB3888666623C2B13CC507B0C7D72BDC4AB45F679F42A7E741
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-01_4356ea3d81c8ca6cc0388f2fa527f1a1_icedid_luca-stealer_njrat_stealc

File Explorer

2026-10-01_4356ea3d81c8ca6cc0388f2fa527f1a1_icedid_luca-stealer_njrat_stealc

.exe 3.9MB

2026-10-01_4356ea3d81c8ca6cc0388f2fa527f1a1_icedid_luca-stealer_njrat_stealc

IMPHASH 8efb17d007e0ad1e0af96ededf5c5b3b
SHA256 b594640325b2358e381af8e664e7cef84a22f3ac5940bb2a108c26f3563788a5
MD5 4356ea3d81c8ca6cc0388f2fa527f1a1
SHA1 2b935cbfa6a0be750113453dd76efd79bf58520c
SHA512 ed4fa35c18ad349d2dfad44025abd3b624f18a73559f1d9c49081e8f74fea771c59b23002bc69bcb28d4057f752e931b8e7a7407de5512a2c6a0c75235448d13
SSDEEP 49152:Gc9zeNbhkGfinGQTT8+HELMvAs8pWy4y3VLuxPNyA+2dmKrTZJ2hIS/LBi:hYHQARjVqxDmGTZUhIS/
TLSH
T14A16F006E1974268DF72AB3888666623C2B13CC507B0C7D72BDC4AB45F679F42A7E741
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

744900

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

d3d11

D3D11CreateDeviceAndSwapChain

kernel32

GlobalFree MultiByteToWideChar WideCharToMultiByte QueryPerformanceCounter QueryPerformanceFrequency FreeLibrary GetProcAddress LoadLibraryA GetLocaleInfoA GetCommandLineA GetCurrentProcessId ExitProcess CreateProcessA GetModuleFileNameA GetModuleHandleW GetFileAttributesA GetLocalTime GetExitCodeProcess FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetOEMCP GetACP IsValidCodePage GetFileSizeEx SetFilePointerEx ReadConsoleW GetConsoleMode GetConsoleOutputCP GetFileAttributesW HeapReAlloc GetFileType EnumSystemLocalesW GetUserDefaultLCID GlobalLock GetLocaleInfoW LCMapStringW VirtualProtect FlsFree FlsSetValue FlsGetValue FlsAlloc HeapFree HeapAlloc WriteFile GetStdHandle ReadFile GetModuleHandleExW FreeLibraryAndExitThread ExitThread CreateThread LoadLibraryExW TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount SetLastError RtlUnwindEx RaiseException RtlPcToFileHeader InitializeSListHead GlobalUnlock GlobalAlloc lstrlenW lstrcmpW GetModuleFileNameW GetCurrentProcess GetDriveTypeW FindNextFileW FindFirstFileW FindClose DeleteFileW CreateFileW GetEnvironmentVariableW GetTickCount64 Sleep GetTickCount WriteConsoleW DeviceIoControl GetLastError CloseHandle SetFileAttributesW RemoveDirectoryW IsValidLocale GetLogicalDriveStringsW RtlUnwind FlushFileBuffers SetEndOfFile TerminateProcess HeapSize SetStdHandle GetCurrentThreadId ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive SleepConditionVariableSRW FormatMessageA LocalFree GetLocaleInfoEx GetCurrentDirectoryW FindFirstFileExW AreFileApisANSI GetStringTypeW InitializeCriticalSectionEx GetSystemTimeAsFileTime WakeAllConditionVariable EnterCriticalSection LeaveCriticalSection DeleteCriticalSection EncodePointer DecodePointer CompareStringEx GetCPInfo LCMapStringEx RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent GetProcessHeap

user32

GetWindowThreadProcessId EnumWindows GetWindowTextLengthW GetWindowTextW MapWindowPoints UpdateWindow MoveWindow SetLayeredWindowAttributes EnumDisplayMonitors MapVirtualKeyA GetKeyNameTextA GetWindowRect SetWindowRgn GetSystemMetrics SetWindowPos ShowWindow DestroyWindow IsWindow CreateWindowExW RegisterClassExW UnregisterClassW DefWindowProcW SetWindowLongW SetForegroundWindow LoadCursorW ScreenToClient ClientToScreen GetCursorPos SetCursor SetCursorPos GetClientRect GetForegroundWindow IsWindowUnicode ReleaseCapture SetCapture GetCapture GetKeyState GetMessageExtraInfo TrackMouseEvent GetKeyboardLayout EmptyClipboard GetClipboardData SetClipboardData CloseClipboard OpenClipboard PeekMessageW DispatchMessageW TranslateMessage

gdi32

CreateRoundRectRgn GetStockObject

advapi32

RegCloseKey ClearEventLogW RegOpenKeyExW RegEnumValueW RegEnumKeyExW RegDeleteValueW AdjustTokenPrivileges LookupPrivilegeValueW OpenEventLogW CloseEventLog

dnsapi

DnsFlushResolverCache

imm32

ImmReleaseContext ImmSetCompositionWindow ImmSetCandidateWindow ImmGetContext

d3dcompiler_47

D3DCompile

dwmapi

DwmExtendFrameIntoClientArea

Name

.text

Size

927KB

Virtual Size

926KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

2.9MB

Virtual Size

2.9MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

20KB

Virtual Size

40KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

39KB

Virtual Size

39KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-01_4356ea3d81c8ca6cc0388f2fa527f1a1_icedid_luca-stealer_njrat_stealc

d3d11

kernel32

user32

gdi32

advapi32

dnsapi

imm32

d3dcompiler_47

dwmapi

generic