2026-10-16_61f8e0e01cc9ae7f5e535ed7ca1a30c9_icedid_luca-stealer_njrat_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-16_61f8e0e01cc9ae7f5e535ed7ca1a30c9_icedid_luca-stealer_njrat_stealc
Size 2.6MB
Sample261017-tle5fsfg75
SHA256 9819f6dd56ab9ca2e733778e0a148817d21f5ec7f7e1d4327fc4b17d7973684b
MD5 61f8e0e01cc9ae7f5e535ed7ca1a30c9
SHA1 b3d17689e2d3c2f20d91e497dac4eb0097e89286
SHA512 0e5392a4190be145c7b6ca1d95c973157e253916896c07f20c3fe85b6bf9d022260af2e1bf85732c9870d45199223e498e90b512a45f1cfdc634c0e5e69a2baf
SSDEEP 49152:3Z4ytRiyk/+doCaEucW/RrmptarSj8RoTCCRCaEucW/Rrmp:26c6nudRSptJT0nudRSp
TLSH
T138C50126ABD812F9E0BBD2768C634516FBB27C165771878F03A4525A1F3BB904E3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-16_61f8e0e01cc9ae7f5e535ed7ca1a30c9_icedid_luca-stealer_njrat_stealc

File Explorer

2026-10-16_61f8e0e01cc9ae7f5e535ed7ca1a30c9_icedid_luca-stealer_njrat_stealc

.exe 2.6MB

2026-10-16_61f8e0e01cc9ae7f5e535ed7ca1a30c9_icedid_luca-stealer_njrat_stealc

IMPHASH b52bd34300fe569ecf3993d50ae07436
SHA256 9819f6dd56ab9ca2e733778e0a148817d21f5ec7f7e1d4327fc4b17d7973684b
MD5 61f8e0e01cc9ae7f5e535ed7ca1a30c9
SHA1 b3d17689e2d3c2f20d91e497dac4eb0097e89286
SHA512 0e5392a4190be145c7b6ca1d95c973157e253916896c07f20c3fe85b6bf9d022260af2e1bf85732c9870d45199223e498e90b512a45f1cfdc634c0e5e69a2baf
SSDEEP 49152:3Z4ytRiyk/+doCaEucW/RrmptarSj8RoTCCRCaEucW/Rrmp:26c6nudRSptJT0nudRSp
TLSH
T138C50126ABD812F9E0BBD2768C634516FBB27C165771878F03A4525A1F3BB904E3E311
MD5 SHA1 SHA512 SSDEEP TLSH

windows:10 windows x64 arch:x64

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

282672

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

MsSense.pdb

kernel32

CloseThreadpoolTimer WaitForThreadpoolTimerCallbacks SetThreadpoolTimer GetModuleFileNameW DeleteCriticalSection InitializeCriticalSectionEx LeaveCriticalSection CreateFileW FindFirstVolumeW FindNextVolumeW FindVolumeClose GetDriveTypeW GetLogicalDrives GetVolumeInformationW QueryDosDeviceW GetVolumeNameForVolumeMountPointW GetVolumePathNamesForVolumeNameW DeviceIoControl MultiByteToWideChar QueryPerformanceCounter CompareFileTime CreateThreadpoolTimer GetSystemTimeAsFileTime GetProductInfo GetVersionExW Sleep AcquireSRWLockShared DeleteFileW FindClose FindFirstFileW FindNextFileW FlushFileBuffers GetFileAttributesW RemoveDirectoryW SetFileAttributesW SetFilePointerEx WriteFile AcquireSRWLockExclusive ReleaseSRWLockShared ReleaseSRWLockExclusive VerSetConditionMask LoadLibraryW FreeLibrary MoveFileExW WriteConsoleW GetWindowsDirectoryW GetComputerNameExW EnterCriticalSection GetTempPathW GlobalAlloc GetTempFileNameW SetStdHandle SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW FindFirstFileExW GetOEMCP GetLongPathNameW TerminateProcess GetCurrentProcess InitOnceComplete InitOnceBeginInitialize WideCharToMultiByte FormatMessageW GetProcAddress GetModuleHandleExW GetModuleHandleW GetACP IsValidCodePage GetModuleFileNameA CompareStringW GetConsoleMode GetConsoleOutputCP EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW DecodePointer HeapReAlloc HeapSize GetCurrentThreadId GetCurrentProcessId CreateSemaphoreExW CreateMutexExW LCMapStringW OpenSemaphoreW WaitForSingleObjectEx FlsFree WaitForSingleObject ReleaseMutex ReleaseSemaphore FlsSetValue FlsGetValue FlsAlloc GetFileType ExpandEnvironmentStringsW GetCommandLineW GetCommandLineA GetStdHandle ExitProcess LoadLibraryExW GlobalFree TlsFree TlsSetValue VerifyVersionInfoW TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount InterlockedPushEntrySList RtlUnwindEx GetStartupInfoW IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext InitializeSListHead GetProcessHeap HeapFree HeapAlloc SetLastError GetLastError CloseHandle OutputDebugStringW DebugBreak IsDebuggerPresent RaiseException GetSystemInfo VirtualProtect VirtualQuery LoadLibraryExA LCMapStringEx GetCPInfo CompareStringEx RtlPcToFileHeader GetStringTypeW WakeAllConditionVariable SleepConditionVariableSRW EncodePointer

advapi32

RegGetValueW RegDeleteKeyValueW RegOpenKeyExW RegCreateKeyExW OpenSCManagerW CloseServiceHandle RegSetValueExW StartServiceCtrlDispatcherW EventRegister EventUnregister EventSetInformation EventWriteTransfer GetSecurityDescriptorOwner GetSecurityDescriptorGroup GetSecurityDescriptorDacl LookupPrivilegeValueW AdjustTokenPrivileges OpenProcessToken SetNamedSecurityInfoW ConvertStringSecurityDescriptorToSecurityDescriptorW GetSecurityDescriptorSacl DestroyPrivateObjectSecurity ChangeServiceConfigW OpenServiceW StartServiceW RegCloseKey QueryServiceConfigW ControlService

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

api-ms-win-core-featurestaging-l1-1-0

SubscribeFeatureStateChangeNotification RecordFeatureError RecordFeatureUsage UnsubscribeFeatureStateChangeNotification GetFeatureEnabledState

api-ms-win-core-featurestaging-l1-1-1

GetFeatureVariant

api-ms-win-core-path-l1-1-0

PathCchCombine

userenv

GetAllUsersProfileDirectoryW

ws2_32

InetNtopW

iphlpapi

GetUnicastIpAddressEntry GetIfEntry2 FreeMibTable GetUnicastIpAddressTable

setupapi

SetupDiDestroyDeviceInfoList SetupDiEnumDeviceInfo SetupDiGetDeviceInterfaceDetailW SetupDiGetClassDevsW SetupDiGetDevicePropertyW SetupDiGetDeviceRegistryPropertyW SetupOpenInfFileW SetupDiEnumDeviceInterfaces SetupInstallFromInfSectionW SetupInstallServicesFromInfSectionW

bcrypt

BCryptCloseAlgorithmProvider BCryptDestroyHash

ntdll

RtlInitUnicodeString

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleExA

Name

.text

Size

476KB

Virtual Size

472KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

188KB

Virtual Size

186KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

16KB

Virtual Size

30KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

28KB

Virtual Size

24KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.didat

Size

4KB

Virtual Size

32B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

44KB

Virtual Size

40KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

UPX1

Size

1.9MB

Virtual Size

1.9MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-16_61f8e0e01cc9ae7f5e535ed7ca1a30c9_icedid_luca-stealer_njrat_stealc

kernel32

advapi32

version

api-ms-win-core-featurestaging-l1-1-0

api-ms-win-core-featurestaging-l1-1-1

api-ms-win-core-path-l1-1-0

userenv

ws2_32

iphlpapi

setupapi

bcrypt

ntdll

api-ms-win-core-libraryloader-l1-2-0

generic