2026-10-10_2688dd9d319b2eff0364fba7c082034b_icedid_luca-stealer_njrat

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-10_2688dd9d319b2eff0364fba7c082034b_icedid_luca-stealer_njrat
Size 58.4MB
Sample261011-xa9fpseg56
SHA256 cb29c63493284a2c08bee8a93d171640d5283fb9273be682b02043ff5566a970
MD5 2688dd9d319b2eff0364fba7c082034b
SHA1 269e3fec7e3ebe8f9f2cf7e87685a461b8d03a2b
SHA512 3495095c1c311f1715573c683d4d3e2e16e369f7a96987763ad7cd03fc3703d084d50c95b21e4c61c049834ace39b9b5c176c0bc15ca79648b0b052bea39c086
SSDEEP 98304:siUiAwxALHg6tJCQrBH3Z1DfwLDCXvfXK20c/2QKFLODsWxbCf5k8TM/eehqgPOz:siUiTxALHg3QL1rvi21uLqwW84o
TLSH
T1FBD7CC98C6CB123FCD762CB85F3CE34EDA5A47A893245785687E5E8413712A51BE0EF0
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_Binary_References_Browsers

Detects executables Discord URL observed in first stage droppers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_DiscordURL

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-10_2688dd9d319b2eff0364fba7c082034b_icedid_luca-stealer_njrat

File Explorer

2026-10-10_2688dd9d319b2eff0364fba7c082034b_icedid_luca-stealer_njrat

.exe 58.4MB

2026-10-10_2688dd9d319b2eff0364fba7c082034b_icedid_luca-stealer_njrat

IMPHASH 7d222574cc9690c40e5c0eeb8c9e8745
SHA256 cb29c63493284a2c08bee8a93d171640d5283fb9273be682b02043ff5566a970
MD5 2688dd9d319b2eff0364fba7c082034b
SHA1 269e3fec7e3ebe8f9f2cf7e87685a461b8d03a2b
SHA512 3495095c1c311f1715573c683d4d3e2e16e369f7a96987763ad7cd03fc3703d084d50c95b21e4c61c049834ace39b9b5c176c0bc15ca79648b0b052bea39c086
SSDEEP 98304:siUiAwxALHg6tJCQrBH3Z1DfwLDCXvfXK20c/2QKFLODsWxbCf5k8TM/eehqgPOz:siUiTxALHg3QL1rvi21uLqwW84o
TLSH
T1FBD7CC98C6CB123FCD762CB85F3CE34EDA5A47A893245785687E5E8413712A51BE0EF0
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers
Detects executables Discord URL observed in first stage droppers
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

60202148

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

version

VerQueryValueW GetFileVersionInfoSizeW GetFileVersionInfoW

shell32

SHGetKnownFolderPath

advapi32

RegOpenKeyExW GetUserNameW RegCloseKey RegQueryValueExW

bcrypt

BCryptCloseAlgorithmProvider BCryptOpenAlgorithmProvider BCryptDecrypt BCryptDestroyKey BCryptDeriveKeyPBKDF2 BCryptSetProperty BCryptGenerateSymmetricKey BCryptHash

ole32

CoCreateInstance CoSetProxyBlanket CoInitializeEx CoUninitialize CoTaskMemFree

oleaut32

SysStringByteLen SysAllocStringByteLen SysFreeString

winhttp

WinHttpConnect WinHttpOpenRequest WinHttpQueryHeaders WinHttpCrackUrl WinHttpQueryDataAvailable WinHttpReceiveResponse WinHttpSendRequest WinHttpOpen WinHttpAddRequestHeaders WinHttpReadData WinHttpCloseHandle

crypt32

CryptStringToBinaryA CryptUnprotectData

kernel32

GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetCommandLineW GetCommandLineA GetOEMCP GetACP IsValidCodePage GetTimeZoneInformation ReadConsoleW EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW SetStdHandle VirtualProtect FlsFree FlsSetValue FlsGetValue FlsAlloc GetConsoleMode GetConsoleOutputCP SetFilePointerEx GetFileSizeEx GetFileType ExitProcess GetModuleHandleExW FreeLibraryAndExitThread ExitThread CreateThread LoadLibraryExW WriteConsoleW CompareStringW GetFileSize GetConsoleScreenBufferInfo SetConsoleTextAttribute GetStdHandle Sleep CloseHandle WideCharToMultiByte SetConsoleOutputCP GetTempPathW MultiByteToWideChar GetLocalTime GetComputerNameW GlobalMemoryStatusEx GetTickCount FindFirstFileW FindNextFileW GetModuleFileNameW FindClose LocalFree GetSystemTimeAsFileTime ExpandEnvironmentStringsW GetEnvironmentVariableW GetLogicalDriveStringsW GetDriveTypeW WaitForSingleObject ReadFile SetFilePointer CreateFileW GetLastError CreateProcessW WriteFile CreateNamedPipeW PeekNamedPipe GetCurrentThreadId GetCurrentProcessId ConnectNamedPipe GetModuleHandleW AreFileApisANSI TryEnterCriticalSection HeapCreate HeapFree EnterCriticalSection GetFullPathNameW GetDiskFreeSpaceW OutputDebugStringA LockFile LeaveCriticalSection InitializeCriticalSection GetFullPathNameA SetEndOfFile UnlockFileEx CreateMutexW GetFileAttributesW UnmapViewOfFile HeapValidate HeapSize GetTempPathA FormatMessageW GetDiskFreeSpaceA GetFileAttributesA GetFileAttributesExW OutputDebugStringW FlushViewOfFile CreateFileA WaitForSingleObjectEx DeleteFileA DeleteFileW HeapReAlloc RaiseException GetSystemInfo HeapAlloc HeapCompact HeapDestroy UnlockFile LockFileEx RtlUnwind DeleteCriticalSection GetProcessHeap SystemTimeToFileTime GetSystemTime FormatMessageA CreateFileMappingW MapViewOfFile QueryPerformanceCounter FlushFileBuffers GetLocaleInfoEx GetCurrentDirectoryW CreateDirectoryW FindFirstFileExW GetFileInformationByHandle GetFinalPathNameByHandleW SetFileInformationByHandle DeviceIoControl GetProcAddress CopyFileW MoveFileExW CreateHardLinkW GetFileInformationByHandleEx CreateSymbolicLinkW GetExitCodeThread ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive InitializeCriticalSectionEx EncodePointer DecodePointer GetStringTypeW LCMapStringEx WakeAllConditionVariable CompareStringEx GetCPInfo RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent InitializeSListHead GetCurrentProcess TerminateProcess FreeLibrary RtlUnwindEx RtlPcToFileHeader SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree

Name

.text

Size

57.7MB

Virtual Size

57.7MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

20KB

Virtual Size

34KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

42KB

Virtual Size

42KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

7KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

280KB

Virtual Size

279KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

386KB

Virtual Size

385KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-10_2688dd9d319b2eff0364fba7c082034b_icedid_luca-stealer_njrat

version

shell32

advapi32

bcrypt

ole32

oleaut32

winhttp

crypt32

kernel32

generic