2026-10-06_9692b6997c8731b58fd4b24333cb8449_icedid_luca-stealer_njrat_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-06_9692b6997c8731b58fd4b24333cb8449_icedid_luca-stealer_njrat_stealc
Size 2.5MB
Sample261007-23ybcsfw3s
SHA256 9a155193dee062128e48baa2c8868da2af59cc0550190d8f76d9c0ec09a2f170
MD5 9692b6997c8731b58fd4b24333cb8449
SHA1 cabc3c7b7d56e614eff2a450389e470090adb348
SHA512 da66fd19a7317fe834e4fc4678f7a6d99c9217c37a8c70b71287136ddfb3301bc38dabd382b5485218bb2cfb966c2d2ac969d1eaa0294fa50fb99388d753c2ff
SSDEEP 49152:uD9eukWVfiRUXh8b01tXkQ0z96u6eX7KyJhhyNJF:/WiUM0Xwzgu6eJfyNJ
TLSH
T155C5E05AF7A401F9D0BBC175CD125947EBB2B8461B70AB8F13E05B962F23A705E2E311
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_Binary_References_Browsers

Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL

Detects executables Discord URL observed in first stage droppers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_DiscordURL

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-06_9692b6997c8731b58fd4b24333cb8449_icedid_luca-stealer_njrat_stealc

File Explorer

2026-10-06_9692b6997c8731b58fd4b24333cb8449_icedid_luca-stealer_njrat_stealc

.exe 2.5MB

2026-10-06_9692b6997c8731b58fd4b24333cb8449_icedid_luca-stealer_njrat_stealc

IMPHASH 5c1a0e7ae8e73d7d0fd6765471a00fc3
SHA256 9a155193dee062128e48baa2c8868da2af59cc0550190d8f76d9c0ec09a2f170
MD5 9692b6997c8731b58fd4b24333cb8449
SHA1 cabc3c7b7d56e614eff2a450389e470090adb348
SHA512 da66fd19a7317fe834e4fc4678f7a6d99c9217c37a8c70b71287136ddfb3301bc38dabd382b5485218bb2cfb966c2d2ac969d1eaa0294fa50fb99388d753c2ff
SSDEEP 49152:uD9eukWVfiRUXh8b01tXkQ0z96u6eX7KyJhhyNJF:/WiUM0Xwzgu6eJfyNJ
TLSH
T155C5E05AF7A401F9D0BBC175CD125947EBB2B8461B70AB8F13E05B962F23A705E2E311
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers
Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion
Detects executables Discord URL observed in first stage droppers
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

753664

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

bcrypt

BCryptSetProperty BCryptCloseAlgorithmProvider BCryptOpenAlgorithmProvider BCryptDecrypt BCryptGenerateSymmetricKey BCryptDestroyKey

crypt32

CryptUnprotectData CryptStringToBinaryA

winhttp

WinHttpQueryHeaders WinHttpAddRequestHeaders WinHttpOpen WinHttpReceiveResponse WinHttpReadData WinHttpConnect WinHttpSetTimeouts WinHttpSendRequest WinHttpCloseHandle WinHttpOpenRequest

iphlpapi

GetAdaptersInfo

gdiplus

GdipDisposeImage GdipCreateBitmapFromHBITMAP GdipAlloc GdipFree GdipGetImageEncodersSize GdipCloneImage GdipGetImageEncoders GdiplusShutdown GdiplusStartup GdipSaveImageToFile

gdi32

BitBlt CreateCompatibleBitmap SelectObject CreateCompatibleDC GetDeviceCaps DeleteDC DeleteObject

advapi32

RegQueryValueExA GetUserNameA RegOpenKeyExA RegOpenKeyExW RegQueryValueExW RegCloseKey

shell32

SHFileOperationW

user32

SetProcessDPIAware ReleaseDC GetSystemMetrics GetDC

kernel32

LCMapStringW GetLocaleInfoW IsValidLocale CompareStringW GetUserDefaultLCID VirtualProtect FlsFree FlsSetValue FlsGetValue FlsAlloc GetConsoleMode GetConsoleOutputCP EnumSystemLocalesW ReadConsoleW GetTimeZoneInformation FindFirstFileExW IsValidCodePage GetACP GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle WriteConsoleW HeapReAlloc GetFileType SetFilePointerEx GetFileSizeEx GetCommandLineW GetCommandLineA GetStdHandle GetModuleFileNameW CreateDirectoryW SizeofResource FindFirstFileW FindNextFileW ExpandEnvironmentStringsW GetEnvironmentVariableW GetTempPathW FindClose WaitForSingleObject GetFileAttributesW MultiByteToWideChar Sleep GetTickCount64 GetLastError LockResource DeleteFileW CloseHandle GetNativeSystemInfo LoadResource FindResourceW GetProcAddress LocalFree GetCurrentProcessId GlobalMemoryStatusEx CreateProcessW GetModuleHandleW CopyFileW WideCharToMultiByte GetComputerNameA GetModuleHandleA GetCurrentThread GetThreadContext ExitProcess FlushFileBuffers GetTickCount QueryPerformanceCounter MapViewOfFile CreateFileMappingW FormatMessageA GetSystemTime GetSystemTimeAsFileTime FreeLibrary SystemTimeToFileTime GetProcessHeap GetFileSize LockFileEx UnlockFile HeapDestroy HeapCompact HeapAlloc LoadLibraryW GetSystemInfo RtlUnwind DeleteFileA WaitForSingleObjectEx LoadLibraryA CreateFileA FlushViewOfFile OutputDebugStringW GetFileAttributesExW GetFileAttributesA GetDiskFreeSpaceA FormatMessageW GetTempPathA HeapSize HeapValidate UnmapViewOfFile CreateFileW CreateMutexW UnlockFileEx SetEndOfFile GetFullPathNameA SetFilePointer LockFile OutputDebugStringA GetDiskFreeSpaceW WriteFile GetFullPathNameW HeapFree HeapCreate ReadFile AreFileApisANSI RaiseException InitializeCriticalSection EnterCriticalSection LeaveCriticalSection TryEnterCriticalSection DeleteCriticalSection GetCurrentThreadId GetModuleHandleExW LCMapStringEx InitializeCriticalSectionEx EncodePointer DecodePointer CompareStringEx GetCPInfo GetStringTypeW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW InitializeSListHead RtlUnwindEx RtlPcToFileHeader SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW CreateThread ExitThread FreeLibraryAndExitThread

Name

.text

Size

887KB

Virtual Size

886KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

161KB

Virtual Size

161KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

19KB

Virtual Size

25KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

31KB

Virtual Size

31KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1.4MB

Virtual Size

1.4MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-06_9692b6997c8731b58fd4b24333cb8449_icedid_luca-stealer_njrat_stealc

bcrypt

crypt32

winhttp

iphlpapi

gdiplus

gdi32

advapi32

shell32

user32

kernel32

generic