2026-10-02_78b3f91f77ab6bb797cca27732a6ae5d_amadey_icedid_luca-stealer_njrat_smoke-loader_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-02_78b3f91f77ab6bb797cca27732a6ae5d_amadey_icedid_luca-stealer_njrat_smoke-loader_stealc
Size 2.7MB
Sample261003-ltgdgswbmf
SHA256 07ffd9ab263a0a0cbb2e713e1d79bc8efe10c70069290c2d6a07628930899efa
MD5 78b3f91f77ab6bb797cca27732a6ae5d
SHA1 f632e20633014e2c51d0859d090426ffbfeb6eee
SHA512 34a03f49805fc01c3129fe98547ab08ad12cc1cbfe5094f5504d81e76b468877bd225ce6723f1561921e8f69711407b3d21ce266a307cf687945bb618058f9ba
SSDEEP 49152:/7DqOz6tVfyxb1tYvTnwxX2J8xIcxmKbOX93Dh4:c0bnYjBJiIujitd4
TLSH
T12ED51216B69087B9E067C134CA564F12FB36784A47B0ADDF13D059AA9F336D05F3AB02
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-02_78b3f91f77ab6bb797cca27732a6ae5d_amadey_icedid_luca-stealer_njrat_smoke-loader_stealc

File Explorer

2026-10-02_78b3f91f77ab6bb797cca27732a6ae5d_amadey_icedid_luca-stealer_njrat_smoke-loader_stealc

.exe 2.7MB

2026-10-02_78b3f91f77ab6bb797cca27732a6ae5d_amadey_icedid_luca-stealer_njrat_smoke-loader_stealc

IMPHASH 4d569594a38dc78a9568c96d51a2c357
SHA256 07ffd9ab263a0a0cbb2e713e1d79bc8efe10c70069290c2d6a07628930899efa
MD5 78b3f91f77ab6bb797cca27732a6ae5d
SHA1 f632e20633014e2c51d0859d090426ffbfeb6eee
SHA512 34a03f49805fc01c3129fe98547ab08ad12cc1cbfe5094f5504d81e76b468877bd225ce6723f1561921e8f69711407b3d21ce266a307cf687945bb618058f9ba
SSDEEP 49152:/7DqOz6tVfyxb1tYvTnwxX2J8xIcxmKbOX93Dh4:c0bnYjBJiIujitd4
TLSH
T12ED51216B69087B9E067C134CA564F12FB36784A47B0ADDF13D059AA9F336D05F3AB02
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

232292

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

gdiplus

GdipFree GdipAlloc GdiplusStartup GdiplusShutdown GdipCreatePath GdipSetStringFormatLineAlign GdipSetStringFormatAlign GdipDeleteStringFormat GdipCreateStringFormat GdipDrawString GdipDeleteFont GdipCreateFont GdipDeleteFontFamily GdipCreateFontFamilyFromName GdipGetClip GdipSetClipRegion GdipSetClipPath GdipDrawImageRectRectI GdipFillPath GdipFillRectangleI GdipDrawPath GdipDrawLineI GdipSetTextRenderingHint GdipSetSmoothingMode GdipDeleteGraphics GdipSetImageAttributesColorMatrix GdipDisposeImageAttributes GdipCreateImageAttributes GdipCreateHBITMAPFromBitmap GdipCreateBitmapFromScan0 GdipGetImageHeight GdipGetImageWidth GdipGetImageGraphicsContext GdipDisposeImage GdipCloneImage GdipLoadImageFromFile GdipLoadImageFromStream GdipDeletePen GdipCreatePen2 GdipCreatePen1 GdipCreateLineBrushFromRectI GdipCreateSolidFill GdipDeleteBrush GdipCloneBrush GdipDeleteRegion GdipCreateRegion GdipAddPathRectangleI GdipAddPathArcI GdipClosePathFigure GdipDeletePath

urlmon

URLDownloadToFileA

winhttp

WinHttpQueryHeaders WinHttpReceiveResponse WinHttpSendRequest WinHttpSetTimeouts WinHttpQueryDataAvailable WinHttpReadData WinHttpConnect WinHttpCloseHandle WinHttpOpenRequest WinHttpOpen

advapi32

RegCreateKeyExA AdjustTokenPrivileges AllocateAndInitializeSid CheckTokenMembership FreeSid LookupPrivilegeValueA RegGetValueA RegSetValueExA OpenProcessToken RegCloseKey

shell32

ShellExecuteA

user32

PostMessageA DispatchMessageA PostQuitMessage RegisterClassExA CreateWindowExA TranslateMessage DefWindowProcA SendMessageA UpdateWindow TrackMouseEvent IsWindow LoadImageA LoadIconA LoadCursorA GetWindow GetWindowThreadProcessId GetClassNameA EnumWindows FindWindowA SetWindowLongPtrA GetWindowLongPtrA SetWindowLongA GetWindowLongA ScreenToClient MessageBoxW GetClientRect GetWindowTextA InvalidateRect EndPaint BeginPaint DestroyWindow GetSystemMetrics IsWindowEnabled KillTimer SetTimer IsWindowVisible SetLayeredWindowAttributes ShowWindow GetMessageA

gdi32

CreateCompatibleDC DeleteDC DeleteObject SelectObject BitBlt

wininet

InternetConnectA InternetCloseHandle InternetFindNextFileA FtpFindFirstFileA FtpGetFileA FtpOpenFileA FtpGetFileSize InternetOpenA

winmm

mciSendStringA

ole32

CreateStreamOnHGlobal

kernel32

ReadConsoleW SetFilePointerEx GetFileSizeEx ReadFile GetConsoleMode GetConsoleOutputCP FlushFileBuffers GetFileType EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW VirtualProtect FlsFree FlsSetValue FlsGetValue FlsAlloc CreateProcessW HeapFree HeapAlloc WriteFile GetModuleFileNameW ExitProcess GetModuleHandleExW FreeLibraryAndExitThread ExitThread CreateThread LoadLibraryExW FreeLibrary TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount SetLastError HeapReAlloc RaiseException RtlPcToFileHeader InitializeSListHead IsValidCodePage GetACP GetOEMCP GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetProcessHeap GetCurrentProcessId TerminateProcess IsProcessorFeaturePresent GetStartupInfoW SetUnhandledExceptionFilter UnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext GetCPInfo GetStringTypeW GetSystemTimeAsFileTime LCMapStringEx DecodePointer EncodePointer SleepConditionVariableSRW WakeAllConditionVariable TryAcquireSRWLockExclusive AcquireSRWLockExclusive ReleaseSRWLockExclusive QueryPerformanceCounter DeleteCriticalSection InitializeCriticalSectionEx LeaveCriticalSection EnterCriticalSection SetStdHandle HeapSize WriteConsoleW SetEndOfFile RtlUnwindEx LockResource CreateSymbolicLinkW GetFileInformationByHandleEx CreateHardLinkW CopyFileW GetModuleHandleW DeviceIoControl GetLastError AreFileApisANSI SetFileInformationByHandle GetStdHandle GetEnvironmentVariableA CreateFileA DeleteFileA GetFileAttributesA GetFileSize RemoveDirectoryA SetFileAttributesA GetTempPathA Beep CloseHandle WaitForSingleObject Sleep GetCurrentProcess GetExitCodeProcess CreateRemoteThread CreateProcessA OpenProcess VirtualAllocEx WriteProcessMemory VirtualFreeEx GetModuleFileNameA GetModuleHandleA GetProcAddress LoadResource RtlUnwind SizeofResource GlobalAlloc GlobalUnlock GlobalLock GlobalFree QueryFullProcessImageNameA FindResourceA MoveFileExA MultiByteToWideChar WideCharToMultiByte GetConsoleWindow CreateToolhelp32Snapshot Process32FirstW Process32NextW Process32First Process32Next LocalFree FormatMessageA GetLocaleInfoEx GetCurrentThreadId CreateDirectoryW CreateFileW FindClose FindFirstFileW FindFirstFileExW FindNextFileW GetFileAttributesExW GetFileInformationByHandle

Name

.text

Size

404KB

Virtual Size

403KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

117KB

Virtual Size

117KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

6KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

16KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

2.2MB

Virtual Size

2.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-02_78b3f91f77ab6bb797cca27732a6ae5d_amadey_icedid_luca-stealer_njrat_smoke-loader_stealc

gdiplus

urlmon

winhttp

advapi32

shell32

user32

gdi32

wininet

winmm

ole32

kernel32

generic