2026-10-01_43df62faec84e53e9b5e2f7e0f939cc8_icedid_luca-stealer_njrat_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-01_43df62faec84e53e9b5e2f7e0f939cc8_icedid_luca-stealer_njrat_stealc
Size 4.7MB
Sample261002-s8ea1aveqa
SHA256 9b9bb4416631666372cf343f2a92b94f06a4a3f00cf1f6db30917e2e6f6a978e
MD5 43df62faec84e53e9b5e2f7e0f939cc8
SHA1 0311d0067183da37ae8c8760068485bbe93b385c
SHA512 bf12265f020264629b6a4620251dffda5d4b76c9bbcb9c1347a21d4d40b09dc110d3cbe9bcea4a529a4b4a5bb98f34c138c3f478bc1dccd8805237073b5ab1e4
SSDEEP 49152:WhTKPypxi2Li0mPiJI7BZVKO7WyVnN2PbsFyi7p9lXDMKw4nD6YHNThy0TeAOo1w:WhOCLO7KbsFH19lVeAOo7/u
TLSH
T14F36AE07A2A502E8D037C178CABADA03F775385547705BEF36AC4A6A1F636E01E7B711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-01_43df62faec84e53e9b5e2f7e0f939cc8_icedid_luca-stealer_njrat_stealc

File Explorer

2026-10-01_43df62faec84e53e9b5e2f7e0f939cc8_icedid_luca-stealer_njrat_stealc

.exe 4.7MB

2026-10-01_43df62faec84e53e9b5e2f7e0f939cc8_icedid_luca-stealer_njrat_stealc

IMPHASH 2428a5bfafba7790c4743854ab8f7421
SHA256 9b9bb4416631666372cf343f2a92b94f06a4a3f00cf1f6db30917e2e6f6a978e
MD5 43df62faec84e53e9b5e2f7e0f939cc8
SHA1 0311d0067183da37ae8c8760068485bbe93b385c
SHA512 bf12265f020264629b6a4620251dffda5d4b76c9bbcb9c1347a21d4d40b09dc110d3cbe9bcea4a529a4b4a5bb98f34c138c3f478bc1dccd8805237073b5ab1e4
SSDEEP 49152:WhTKPypxi2Li0mPiJI7BZVKO7WyVnN2PbsFyi7p9lXDMKw4nD6YHNThy0TeAOo1w:WhOCLO7KbsFH19lVeAOo7/u
TLSH
T14F36AE07A2A502E8D037C178CABADA03F775385547705BEF36AC4A6A1F636E01E7B711
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2807492

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

vesta.pdb

d3d11

D3D11CreateDevice

d3dcompiler_47

D3DCompile

ole32

CoInitializeEx CoCreateInstance CoUninitialize

dxgi

CreateDXGIFactory1

dwmapi

DwmGetWindowAttribute DwmExtendFrameIntoClientArea

dcomp

DCompositionCreateDevice

winmm

timeBeginPeriod timeEndPeriod

ntdll

RtlPcToFileHeader RtlUnwindEx RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind RtlUnwind

comdlg32

GetSaveFileNameW GetOpenFileNameW

advapi32

SetTokenInformation RegQueryValueExA RegOpenKeyExA OpenProcessToken GetTokenInformation LookupPrivilegeValueW PrivilegeCheck DuplicateTokenEx SetThreadToken RegCloseKey CreateProcessAsUserW RevertToSelf

shell32

ShellExecuteExW

kernel32

GetUserDefaultLCID EnumSystemLocalesW GetFileType FlushFileBuffers GetConsoleOutputCP GetConsoleMode SetFilePointerEx ReadConsoleW GetExitCodeProcess CreatePipe GetTimeZoneInformation DeleteFileW FlsSetValue FlsGetValue CreateMutexW GetLastError CloseHandle WaitForSingleObject ExitProcess SetThreadPriority GetCurrentThread SwitchToThread SetWaitableTimer Sleep SetThreadInformation CreateWaitableTimerExW CreateWaitableTimerW GetTempPathW CreateDirectoryW CreateFileW GetFileSizeEx SetFilePointer SetEndOfFile GetCurrentProcessId GetTickCount64 WriteFile MoveFileExW CreateToolhelp32Snapshot Process32FirstW OpenProcess QueryFullProcessImageNameW Process32NextW MultiByteToWideChar CompareStringOrdinal ReadProcessMemory Module32FirstW Module32NextW VirtualQueryEx LoadLibraryExA GetProcAddress WideCharToMultiByte GetModuleHandleW GetCurrentThreadId SetLastError OutputDebugStringW GetSystemInfo GetProcessTimes GetCurrentProcess GetSystemTimeAsFileTime lstrcmpW CreateProcessW GlobalAlloc GlobalLock GlobalUnlock GlobalFree GetLocaleInfoA QueryPerformanceFrequency QueryPerformanceCounter LoadLibraryA FreeLibrary GetModuleFileNameW lstrcmpiW IsValidCodePage GetModuleFileNameA FormatMessageA CreateFileA ReadFile HeapAlloc HeapReAlloc HeapFree GetProcessHeap MapViewOfFile UnmapViewOfFile CreateFileMappingA FlsAlloc GetCommandLineA GetStdHandle DuplicateHandle FreeLibraryAndExitThread ExitThread CreateThread LoadLibraryExW TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount GetStartupInfoW IsDebuggerPresent InitializeSListHead TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter GetCPInfo GetStringTypeW LCMapStringEx FlsFree DeleteCriticalSection InitializeCriticalSectionEx LeaveCriticalSection EnterCriticalSection DecodePointer EncodePointer GetModuleHandleExW CloseThreadpoolWork SubmitThreadpoolWork CreateThreadpoolWork FreeLibraryWhenCallbackReturns InitOnceComplete InitOnceBeginInitialize IsProcessorFeaturePresent RaiseException GetLocaleInfoEx LocalFree GetFileInformationByHandleEx CopyFileW AreFileApisANSI SetFileInformationByHandle GetFinalPathNameByHandleW GetFileInformationByHandle GetFileAttributesExW GetFileAttributesW FindNextFileW FindFirstFileExW FindFirstFileW FindClose WakeConditionVariable AcquireSRWLockShared IsValidLocale GetACP GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle HeapSize GetCommandLineW WriteConsoleW GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW VirtualProtect WaitForSingleObjectEx GetExitCodeThread ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW TryAcquireSRWLockExclusive ReleaseSRWLockShared

user32

CallNextHookEx SendInput GetClassNameA GetClipboardData SetClipboardData CloseClipboard EmptyClipboard OpenClipboard UnhookWinEvent SetWinEventHook IntersectRect GetWindowPlacement IsWindowVisible IsIconic SetWindowPos MonitorFromRect EnumWindows GetClassNameW PostQuitMessage LoadCursorA SetCursor DefWindowProcW GetDpiForWindow EnumThreadWindows GetParent SetWindowLongPtrW GetCursorInfo GetKeyboardLayout SetWindowsHookExW ScreenToClient GetMonitorInfoW MonitorFromWindow UnregisterClassW DestroyWindow ShowWindow SetWindowDisplayAffinity PostMessageW MsgWaitForMultipleObjectsEx DispatchMessageW TranslateMessage PeekMessageW RegisterClassExW GetClassInfoExW SetLayeredWindowAttributes CreateWindowExW GetWindow IsWindowEnabled GetWindowLongPtrW WindowFromPoint EnumDisplaySettingsW GetKeyNameTextW MapVirtualKeyW GetWindowThreadProcessId GetForegroundWindow GetCursorPos FindWindowW IsWindow SetCursorPos ClientToScreen GetAncestor GetGUIThreadInfo GetClientRect GetAsyncKeyState MessageBoxW SetProcessDpiAwarenessContext PostThreadMessageW ClipCursor UnhookWindowsHookEx ToUnicodeEx GetMessageW GetKeyboardState

imm32

ImmSetCandidateWindow ImmGetContext ImmSetCompositionWindow ImmReleaseContext

Name

.text

Size

3.0MB

Virtual Size

3.0MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1021KB

Virtual Size

1020KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

568KB

Virtual Size

689KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

122KB

Virtual Size

121KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

13KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-01_43df62faec84e53e9b5e2f7e0f939cc8_icedid_luca-stealer_njrat_stealc

d3d11

d3dcompiler_47

ole32

dxgi

dwmapi

dcomp

winmm

ntdll

comdlg32

advapi32

shell32

kernel32

user32

imm32

generic