2026-10-02_2c15d2f81648cab45f6f16ae4fc37e73_icedid_luca-stealer_njrat_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-02_2c15d2f81648cab45f6f16ae4fc37e73_icedid_luca-stealer_njrat_stealc
Size 2.3MB
Sample261003-sr5fvsdh58
SHA256 250e7be7da43ee0ee9367f4a890cc9430d346fe16d86df2a30677cf6e1b3c823
MD5 2c15d2f81648cab45f6f16ae4fc37e73
SHA1 518968bd0373e92ddb7741aab6382e636bfc0d02
SHA512 2439719897ae51180d156ed990c49376b38b69baad649e767a3c87c6997cf01494c94dcbb915a5b030f06338b07f46124ef7f8fc8703ee8a6a5e984db2923f97
SSDEEP 49152:jqRzkhoRLDqC0gRyAR1b0iUCiNoKRaxC3YhweoMLa:noRLpb0kixRaxC3Y1oe
TLSH
T159B5C05A669402E8F4B7D239CA964B65EF72BC09432096CB13E476E51F177E04B3E323
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-02_2c15d2f81648cab45f6f16ae4fc37e73_icedid_luca-stealer_njrat_stealc

File Explorer

2026-10-02_2c15d2f81648cab45f6f16ae4fc37e73_icedid_luca-stealer_njrat_stealc

.exe 2.3MB

2026-10-02_2c15d2f81648cab45f6f16ae4fc37e73_icedid_luca-stealer_njrat_stealc

IMPHASH 308dbb0840ee593e5d16a87b841cefe8
SHA256 250e7be7da43ee0ee9367f4a890cc9430d346fe16d86df2a30677cf6e1b3c823
MD5 2c15d2f81648cab45f6f16ae4fc37e73
SHA1 518968bd0373e92ddb7741aab6382e636bfc0d02
SHA512 2439719897ae51180d156ed990c49376b38b69baad649e767a3c87c6997cf01494c94dcbb915a5b030f06338b07f46124ef7f8fc8703ee8a6a5e984db2923f97
SSDEEP 49152:jqRzkhoRLDqC0gRyAR1b0iUCiNoKRaxC3YhweoMLa:noRLpb0kixRaxC3Y1oe
TLSH
T159B5C05A669402E8F4B7D239CA964B65EF72BC09432096CB13E476E51F177E04B3E323
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

525936

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\A147\installer\Build\x64\UnicodeRelease\SamanLauncher\SamanLauncher.pdb

kernel32

GetModuleHandleW GetProcAddress LoadLibraryExW LocalFree FormatMessageW MoveFileW MoveFileExW MultiByteToWideChar VerSetConditionMask GetStdHandle GetEnvironmentVariableW GetCurrentDirectoryW DeleteFileW FindClose FindFirstFileW FindNextFileW GetDiskFreeSpaceExW GetFileAttributesW GetFinalPathNameByHandleW GetLogicalDriveStringsW QueryDosDeviceW RemoveDirectoryW SetFileAttributesW DecodePointer InitializeCriticalSectionEx DeleteCriticalSection CreateMutexW GetCurrentProcessId TerminateProcess GetCurrentThreadId GetSystemDirectoryW GetVersionExW GetModuleFileNameW OpenProcess LockResource SizeofResource FindResourceW lstrlenW VerifyVersionInfoW WideCharToMultiByte AllocConsole CreateToolhelp32Snapshot Process32FirstW Process32NextW K32EnumProcessModules K32GetModuleFileNameExW K32GetProcessImageFileNameW WaitForMultipleObjects SetDllDirectoryW GetUserDefaultUILanguage HeapAlloc GetProcessHeap CreateDirectoryW LocalFileTimeToFileTime ReadFile SetFilePointer SetFileTime SystemTimeToFileTime LoadLibraryExA VirtualQuery GetSystemInfo WriteConsoleW SetEndOfFile HeapSize SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW CreateProcessW GetExitCodeProcess GetCurrentProcess Sleep CreateEventW WaitForSingleObject SetEvent WaitNamedPipeW SetNamedPipeHandleState GetLastError CloseHandle WriteFile LoadResource CreateFileW GetCommandLineA GetOEMCP GetACP IsValidCodePage FindFirstFileExW SetConsoleCtrlHandler HeapReAlloc ReadConsoleW SetFilePointerEx GetFileSizeEx GetConsoleMode RtlUnwind GetConsoleOutputCP FlushFileBuffers EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW VirtualProtect IsThreadAFiber FlsFree FlsSetValue FlsGetValue FlsAlloc GetTempPathW HeapFree GetCurrentThread FormatMessageA EnterCriticalSection LeaveCriticalSection GetLocaleInfoEx EncodePointer LCMapStringEx GetStringTypeW CompareStringEx GetCPInfo ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW QueryPerformanceCounter GetSystemTimeAsFileTime InitializeSListHead OutputDebugStringW RaiseException RtlPcToFileHeader RtlUnwindEx InterlockedPushEntrySList InterlockedFlushSList SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary SetStdHandle GetFileType GetTimeZoneInformation ExitProcess GetModuleHandleExW

user32

MessageBoxW GetSystemMetrics MessageBoxIndirectW EnumWindows UnregisterClassW SendMessageW GetWindowThreadProcessId GetShellWindow

advapi32

GetUserNameW RegSetValueExW RegOpenKeyExW RegCloseKey GetTokenInformation FreeSid EqualSid CheckTokenMembership AllocateAndInitializeSid LookupPrivilegeValueW DuplicateTokenEx AdjustTokenPrivileges OpenProcessToken

shell32

ShellExecuteW SHGetSpecialFolderLocation SHCreateDirectoryExW SHGetSpecialFolderPathW SHChangeNotify

ole32

CoCreateInstance CoTaskMemAlloc CoTaskMemFree CoInitializeSecurity CoCreateGuid CoUninitialize CoInitialize

oleaut32

SysAllocString VariantClear SysFreeString CreateErrorInfo GetErrorInfo VariantChangeType SetErrorInfo VariantInit

shlwapi

PathFileExistsW PathFindExtensionW PathIsNetworkPathW PathIsDirectoryW PathFindFileNameW PathIsRelativeW SHDeleteKeyW SHDeleteValueW StrStrIW SHGetValueW SHSetValueW

cJSON_AddArrayToObject cJSON_AddBoolToObject cJSON_AddFalseToObject cJSON_AddItemReferenceToArray cJSON_AddItemReferenceToObject cJSON_AddItemToArray cJSON_AddItemToObject cJSON_AddItemToObjectCS cJSON_AddNullToObject cJSON_AddNumberToObject cJSON_AddObjectToObject cJSON_AddRawToObject cJSON_AddStringToObject cJSON_AddTrueToObject cJSON_Compare cJSON_CreateArray cJSON_CreateArrayReference cJSON_CreateBool cJSON_CreateDoubleArray cJSON_CreateFalse cJSON_CreateFloatArray cJSON_CreateIntArray cJSON_CreateNull cJSON_CreateNumber cJSON_CreateObject cJSON_CreateObjectReference cJSON_CreateRaw cJSON_CreateString cJSON_CreateStringArray cJSON_CreateStringReference cJSON_CreateTrue cJSON_Delete cJSON_DeleteItemFromArray cJSON_DeleteItemFromObject cJSON_DeleteItemFromObjectCaseSensitive cJSON_DetachItemFromArray cJSON_DetachItemFromObject cJSON_DetachItemFromObjectCaseSensitive cJSON_DetachItemViaPointer cJSON_Duplicate cJSON_GetArrayItem cJSON_GetArraySize cJSON_GetErrorPtr cJSON_GetObjectItem cJSON_GetObjectItemCaseSensitive cJSON_GetStringValue cJSON_HasObjectItem cJSON_InitHooks cJSON_InsertItemInArray cJSON_IsArray cJSON_IsBool cJSON_IsFalse cJSON_IsInvalid cJSON_IsNull cJSON_IsNumber cJSON_IsObject cJSON_IsRaw cJSON_IsString cJSON_IsTrue cJSON_Minify cJSON_Parse cJSON_ParseWithOpts cJSON_Print cJSON_PrintBuffered cJSON_PrintPreallocated cJSON_PrintUnformatted cJSON_ReplaceItemInArray cJSON_ReplaceItemInObject cJSON_ReplaceItemInObjectCaseSensitive cJSON_ReplaceItemViaPointer cJSON_SetNumberHelper cJSON_Version cJSON_free cJSON_malloc

Name

.text

Size

1.0MB

Virtual Size

1.0MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

247KB

Virtual Size

246KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

11KB

Virtual Size

19KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

47KB

Virtual Size

47KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.didat

Size

512B

Virtual Size

200B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

411KB

Virtual Size

410KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

572KB

Virtual Size

576KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-02_2c15d2f81648cab45f6f16ae4fc37e73_icedid_luca-stealer_njrat_stealc

kernel32

user32

advapi32

shell32

ole32

oleaut32

shlwapi

generic