2026-10-01_a4154de1592cb4954dd585820d859022_icedid_luca-stealer_njrat_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-01_a4154de1592cb4954dd585820d859022_icedid_luca-stealer_njrat_stealc
Size 1.4MB
Sample261003-ybb29swdla
SHA256 1f3ee556a8b8d5f6249e5cea7bb81b69e490a310dd28b046858d34ed49b9449c
MD5 a4154de1592cb4954dd585820d859022
SHA1 4255940d157b70f5c5f646004647c29a3aa3721a
SHA512 86b1238d7a44cf14a5b39193b54c8ea92069ca3dc882b5ab6874a5cddc7422c039d898ab5e1d2c2e06114bd4795a3b4999632d9ab574cb3faf3d401f4d64dd79
SSDEEP 24576:bSdrpcAjhzPOA9TdhudciPn5RMKkCHc65wvGNQ7gw6b4NEpEMgPF:bS7zP19LQPn5RMAGgh/EM0
TLSH
T11C65E00EF3E942E8D1775536C661621BEA72B8190B3087DF63A406786F736E04EB7712
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-01_a4154de1592cb4954dd585820d859022_icedid_luca-stealer_njrat_stealc

File Explorer

2026-10-01_a4154de1592cb4954dd585820d859022_icedid_luca-stealer_njrat_stealc

.exe 1.4MB

2026-10-01_a4154de1592cb4954dd585820d859022_icedid_luca-stealer_njrat_stealc

IMPHASH 5f20d2259fe44a4f194e070c610eb262
SHA256 1f3ee556a8b8d5f6249e5cea7bb81b69e490a310dd28b046858d34ed49b9449c
MD5 a4154de1592cb4954dd585820d859022
SHA1 4255940d157b70f5c5f646004647c29a3aa3721a
SHA512 86b1238d7a44cf14a5b39193b54c8ea92069ca3dc882b5ab6874a5cddc7422c039d898ab5e1d2c2e06114bd4795a3b4999632d9ab574cb3faf3d401f4d64dd79
SSDEEP 24576:bSdrpcAjhzPOA9TdhudciPn5RMKkCHc65wvGNQ7gw6b4NEpEMgPF:bS7zP19LQPn5RMAGgh/EM0
TLSH
T11C65E00EF3E942E8D1775536C661621BEA72B8190B3087DF63A406786F736E04EB7712
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

407576

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

d3d11

D3D11CreateDeviceAndSwapChain

d3dcompiler_47

D3DCompile

ole32

CoUninitialize CoCreateInstance CoInitializeEx

kernel32

WideCharToMultiByte GlobalUnlock GetLocaleInfoA LoadLibraryA QueryPerformanceFrequency GetProcAddress FreeLibrary QueryPerformanceCounter Sleep WriteProcessMemory GetProcessId OpenProcess CreateToolhelp32Snapshot Process32NextW K32GetModuleBaseNameW Process32FirstW CloseHandle GetSystemInfo K32GetModuleInformation VirtualProtectEx ReadProcessMemory K32EnumProcessModules VirtualQueryEx GetStringTypeW SetStdHandle SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCPInfo GetOEMCP GetACP IsValidCodePage FindNextFileW GlobalLock FindClose OutputDebugStringW GetFileSizeEx GetConsoleOutputCP FlushFileBuffers LCMapStringW CompareStringW VirtualProtect FlsFree FlsSetValue FlsGetValue FlsAlloc HeapFree HeapAlloc ReadConsoleW GetConsoleMode SetFilePointerEx GetCommandLineW GetCommandLineA ExitProcess WriteFile FreeLibraryAndExitThread ExitThread CreateThread WriteConsoleW GlobalFree GlobalAlloc MultiByteToWideChar GetProcessHeap CreateFileW GetModuleHandleExW GetModuleFileNameW HeapSize HeapReAlloc SetEndOfFile FindFirstFileExW WakeAllConditionVariable GetFileType GetStdHandle ReadFile LoadLibraryExW TlsFree GetCurrentThreadId ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive SleepConditionVariableSRW InitializeCriticalSectionEx GetSystemTimeAsFileTime GetModuleHandleW GetCurrentProcessId InitializeSListHead RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent GetCurrentProcess TerminateProcess RtlUnwindEx RtlPcToFileHeader RaiseException GetLastError SetLastError EncodePointer EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue

user32

EmptyClipboard GetClipboardData SetClipboardData OpenClipboard GetWindowLongW DefWindowProcW GetWindowRect DestroyWindow SetWindowRgn CreateWindowExW GetSystemMetrics UnregisterClassW RegisterClassExW ShowWindow DispatchMessageW SetWindowLongA PeekMessageW MoveWindow SetLayeredWindowAttributes TranslateMessage LoadIconW PostQuitMessage UpdateWindow GetKeyState GetMessageExtraInfo GetCursorPos ScreenToClient GetCapture ClientToScreen TrackMouseEvent GetKeyboardLayout GetForegroundWindow LoadCursorW SetCapture SetCursor GetClientRect IsWindowUnicode ReleaseCapture SetCursorPos CloseClipboard

gdi32

CreateRoundRectRgn

shell32

ShellExecuteW

imm32

ImmReleaseContext ImmSetCandidateWindow ImmSetCompositionWindow ImmGetContext

dwmapi

DwmExtendFrameIntoClientArea

Name

.text

Size

561KB

Virtual Size

561KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

159KB

Virtual Size

159KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

652KB

Virtual Size

657KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

24KB

Virtual Size

23KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-01_a4154de1592cb4954dd585820d859022_icedid_luca-stealer_njrat_stealc

d3d11

d3dcompiler_47

ole32

kernel32

user32

gdi32

shell32

imm32

dwmapi

generic