2026-10-16_ebac6a9211470b950631bc9e8e9d02ae_akira_icedid_luca-stealer_njrat_rusty-stealer_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-16_ebac6a9211470b950631bc9e8e9d02ae_akira_icedid_luca-stealer_njrat_rusty-stealer_stealc
Size 2.1MB
Sample261017-d7fecawvbz
SHA256 c7aca072a3ce176e24fab5652c4d3fcdec58002987cefde3394b0a5a924e9a7d
MD5 ebac6a9211470b950631bc9e8e9d02ae
SHA1 8c3e361e67ddb3f71e90c80d1af21320a12879f8
SHA512 5be2aeea995cbcbdab25cbd46efd2deed59ad8efd35226e6b7b1f8f39841171ee09ceebe4713fba73cdda879efb23c6fe1c0f86a79dbb5cf9f9093127ad275ca
SSDEEP 24576:xlYALGebrggti8dgyYyu6HwwpG+PZZNzk8jc/mmGEDqHKliE9JdpTCePo9L9QIE:xlYALGgggtndgyYXc/NAuu3DqqldPx
TLSH
T149A53A0E654548E7C25BC47CA246F73299213C8E0F26F59F02C53DA73EBE5AC1A29637
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-16_ebac6a9211470b950631bc9e8e9d02ae_akira_icedid_luca-stealer_njrat_rusty-stealer_stealc

File Explorer

2026-10-16_ebac6a9211470b950631bc9e8e9d02ae_akira_icedid_luca-stealer_njrat_rusty-stealer_stealc

.exe 2.1MB

2026-10-16_ebac6a9211470b950631bc9e8e9d02ae_akira_icedid_luca-stealer_njrat_rusty-stealer_stealc

IMPHASH c85385ef7ea90cd7e6e448254a32d42d
SHA256 c7aca072a3ce176e24fab5652c4d3fcdec58002987cefde3394b0a5a924e9a7d
MD5 ebac6a9211470b950631bc9e8e9d02ae
SHA1 8c3e361e67ddb3f71e90c80d1af21320a12879f8
SHA512 5be2aeea995cbcbdab25cbd46efd2deed59ad8efd35226e6b7b1f8f39841171ee09ceebe4713fba73cdda879efb23c6fe1c0f86a79dbb5cf9f9093127ad275ca
SSDEEP 24576:xlYALGebrggti8dgyYyu6HwwpG+PZZNzk8jc/mmGEDqHKliE9JdpTCePo9L9QIE:xlYALGgggtndgyYXc/NAuu3DqqldPx
TLSH
T149A53A0E654548E7C25BC47CA246F73299213C8E0F26F59F02C53DA73EBE5AC1A29637
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

757260

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

xplat_launcher_win_con.pdb

kernel32

SleepConditionVariableSRW WakeAllConditionVariable ReadConsoleW GetCPInfo GetStringTypeW LCMapStringEx IsValidCodePage IsProcessorFeaturePresent GetOEMCP EncodePointer TlsSetValue GetProcessHeap HeapFree HeapAlloc FormatMessageW GetStartupInfoW TlsFree TlsAlloc InitializeSListHead UnhandledExceptionFilter EnterCriticalSection LoadLibraryW GetProcessHandleCount SetEvent LeaveCriticalSection UpdateProcThreadAttribute InitializeProcThreadAttributeList DeleteProcThreadAttributeList InitializeCriticalSectionEx DeleteCriticalSection DecodePointer LocalFree AcquireSRWLockExclusive SetThreadAffinityMask GetCurrentProcessorNumber IsWow64Process SetProcessMitigationPolicy GetProcessMitigationPolicy SetHandleInformation SetThreadInformation GetThreadId Sleep UnregisterWaitEx ReleaseSRWLockExclusive TryAcquireSRWLockExclusive RegisterWaitForSingleObject EnumSystemLocalesEx GetUserDefaultLocaleName GetUserDefaultLCID GetUserDefaultLangID TerminateProcess GetCurrentThreadId SetStdHandle DuplicateHandle AddDllDirectory SetDefaultDllDirectories InitializeCriticalSectionAndSpinCount GetCommandLineA SwitchToThread LoadLibraryExA HeapSize ExitProcess FlsFree CompareStringW SetThreadErrorMode LCMapStringW GetLocaleInfoW FlsSetValue FlsGetValue FlsAlloc GetModuleHandleW VirtualProtect GetModuleHandleA WriteConsoleW HeapQueryInformation WaitForSingleObject GetConsoleOutputCP GetConsoleMode GetStdHandle ReleaseMutex CloseHandle GetCurrentProcessId TlsGetValue IsValidLocale lstrlenW GetCurrentProcess LoadLibraryA WaitForSingleObjectEx SetLastError GetCurrentThread SetThreadStackGuarantee GetACP MultiByteToWideChar WideCharToMultiByte GetModuleHandleExW FreeLibrary LoadLibraryExW AddVectoredExceptionHandler HeapReAlloc GetCurrentDirectoryW CreateMutexA GetEnvironmentVariableW QueryPerformanceFrequency GetCommandLineW GetFullPathNameW CreateFileW SetFileInformationByHandle GetFileInformationByHandle GetFileInformationByHandleEx FindFirstFileExW FindClose QueryPerformanceCounter SetEnvironmentVariableW GetFinalPathNameByHandleW GetFileType SetCurrentDirectoryW CreateThread CreateIoCompletionPort GetQueuedCompletionStatus TerminateJobObject PostQueuedCompletionStatus SetInformationJobObject HeapDestroy GetTickCount IsDebuggerPresent RaiseException WriteProcessMemory FindNextFileW HeapSetInformation GetVersionExW GetProductInfo GetNativeSystemInfo GetEnvironmentStringsW FreeEnvironmentStringsW CreateFileMappingW MapViewOfFile ReadProcessMemory CreateEventW VirtualFree GetProcessHeaps GetSystemTimeAsFileTime GetModuleFileNameW GetLocalTime OutputDebugStringA WriteFile CreateJobObjectW QueryInformationJobObject VirtualAllocEx VirtualProtectEx FlushFileBuffers GetFileSizeEx SetFilePointerEx ExpandEnvironmentStringsW CreateMutexW UnmapViewOfFile GetFileAttributesW QueryDosDeviceW GetLongPathNameW VirtualFreeEx DebugBreak GetProcAddress GetLastError EnumSystemLocalesW SetUnhandledExceptionFilter CreateRemoteThread ReadFile

api-ms-win-core-synch-l1-2-0

WakeByAddressAll WaitOnAddress WakeByAddressSingle

ntdll

RtlUnwind RtlUnwindEx RtlNtStatusToDosError RtlDllShutdownInProgress RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind NtWriteFile RtlPcToFileHeader NtReadFile RtlInitUnicodeString RtlCaptureStackBackTrace

oleaut32

SysFreeString GetErrorInfo SysStringLen

user32

GetUserObjectInformationW CreateDesktopW CloseDesktop CloseWindowStation GetProcessWindowStation CreateWindowStationW SetProcessWindowStation MessageBoxA GetThreadDesktop

userenv

GetUserProfileDirectoryW DeriveAppContainerSidFromAppContainerName CreateAppContainerProfile

shell32

SHGetKnownFolderPath

advapi32

OpenSCManagerW OpenServiceW SetThreadToken CloseServiceHandle AdjustTokenPrivileges RegCloseKey RegOpenKeyExW RegQueryValueExW RevertToSelf RegDisablePredefinedCache GetTokenInformation OpenProcessToken DuplicateTokenEx OpenThreadToken SetTokenInformation LookupPrivilegeValueW CreateRestrictedToken CreateProcessAsUserW FreeSid IsValidSid GetLengthSid ConvertStringSidToSidW ConvertSidToStringSidW EqualSid GetAce IsValidSecurityDescriptor GetSecurityDescriptorControl GetSecurityDescriptorOwner GetSecurityDescriptorGroup GetSecurityDescriptorDacl GetSecurityDescriptorSacl GetNamedSecurityInfoW GetSecurityInfo RegCreateKeyExW SetEntriesInAclW BuildTrusteeWithSidW AddMandatoryAce InitializeAcl IsValidAcl AccessCheck MapGenericMask SetSecurityInfo

bcryptprimitives

ProcessPrng

dbghelp

SymFromAddr SymSetSearchPathW SymGetSearchPathW SymSetOptions SymCleanup SymGetLineFromAddr64 SymInitialize

winmm

timeGetTime

Name

.text

Size

911KB

Virtual Size

911KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

269KB

Virtual Size

269KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

19KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

45KB

Virtual Size

44KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

301KB

Virtual Size

301KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

572KB

Virtual Size

576KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-16_ebac6a9211470b950631bc9e8e9d02ae_akira_icedid_luca-stealer_njrat_rusty-stealer_stealc

kernel32

api-ms-win-core-synch-l1-2-0

ntdll

oleaut32

user32

userenv

shell32

advapi32

bcryptprimitives

dbghelp

winmm

generic