2026-10-17_9d40558f5eb3a182f375c611526d4e4c_icedid_luca-stealer_njrat_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-17_9d40558f5eb3a182f375c611526d4e4c_icedid_luca-stealer_njrat_stealc
Size 5.1MB
Sample261018-21tkdstx9p
SHA256 fed50478535a29b40525cb48217a6f4a3c50b7f2b50e2f383aab0cd38c388cb8
MD5 9d40558f5eb3a182f375c611526d4e4c
SHA1 ea86204096433247a01158c79a555e6a5f8488e1
SHA512 acccbefa67208a19e8b1fbb3483eb91c6aa6fcc84dc304a67405ef409725dc6cb133c7fc6e2c9022a95b3a4f8514b1dedbf4d4f523e306bf9a548d0c1c213043
SSDEEP 49152:DVu6EMDwAHHG5AXYCNps4r2z+tSXgWf3QwWtny4+DwamPmbWUFvx/nhgob4RR8V:DCEROxx/n1bY8V
TLSH
T141367C96B24403A8F0EEC4B98A86D733E7F178050B7056DB26D056716E5B7EF4A3A3C1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-17_9d40558f5eb3a182f375c611526d4e4c_icedid_luca-stealer_njrat_stealc

File Explorer

2026-10-17_9d40558f5eb3a182f375c611526d4e4c_icedid_luca-stealer_njrat_stealc

.exe 5.1MB

2026-10-17_9d40558f5eb3a182f375c611526d4e4c_icedid_luca-stealer_njrat_stealc

IMPHASH 1f12e93471c1d13df274fbe0a86866ea
SHA256 fed50478535a29b40525cb48217a6f4a3c50b7f2b50e2f383aab0cd38c388cb8
MD5 9d40558f5eb3a182f375c611526d4e4c
SHA1 ea86204096433247a01158c79a555e6a5f8488e1
SHA512 acccbefa67208a19e8b1fbb3483eb91c6aa6fcc84dc304a67405ef409725dc6cb133c7fc6e2c9022a95b3a4f8514b1dedbf4d4f523e306bf9a548d0c1c213043
SSDEEP 49152:DVu6EMDwAHHG5AXYCNps4r2z+tSXgWf3QwWtny4+DwamPmbWUFvx/nhgob4RR8V:DCEROxx/n1bY8V
TLSH
T141367C96B24403A8F0EEC4B98A86D733E7F178050B7056DB26D056716E5B7EF4A3A3C1
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2239268

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

ReSkateLauncher.pdb

winhttp

WinHttpOpenRequest WinHttpSendRequest WinHttpReceiveResponse WinHttpQueryHeaders WinHttpSetTimeouts WinHttpConnect WinHttpCloseHandle WinHttpOpen WinHttpSetStatusCallback WinHttpReadData WinHttpWriteData WinHttpSetOption WinHttpCrackUrl

shell32

SHFileOperationW DragQueryFileW DragFinish DragAcceptFiles SHGetKnownFolderPath ShellExecuteW CommandLineToArgvW

dwmapi

DwmSetWindowAttribute

ole32

CoTaskMemFree CoUninitialize CoCreateInstance CoInitializeEx

dbghelp

MiniDumpWriteDump

d3d12

ord101

dxgi

CreateDXGIFactory2

d3dcompiler_47

D3DCompile

hid

HidP_GetCaps HidD_GetAttributes HidD_GetHidGuid HidD_FreePreparsedData HidD_GetPreparsedData

cfgmgr32

CM_Get_Device_Interface_List_SizeW CM_Get_Device_Interface_ListW

bcrypt

BCryptHash BCryptDestroyKey BCryptDecrypt BCryptGenRandom BCryptSetProperty BCryptDestroyHash BCryptFinishHash BCryptHashData BCryptGenerateSymmetricKey BCryptCreateHash BCryptCloseAlgorithmProvider BCryptGetProperty BCryptOpenAlgorithmProvider

kernel32

CompareStringW GetTimeFormatW GetDateFormatW VirtualProtect FlsFree FlsSetValue FlsGetValue FlsAlloc HeapAlloc ExitProcess FreeLibraryAndExitThread ExitThread TlsFree LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetFileType GetConsoleOutputCP ReadConsoleW GetTimeZoneInformation HeapReAlloc TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount RtlUnwindEx InitializeSListHead GetStartupInfoW IsProcessorFeaturePresent UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext GetCommandLineW GetLastError SetLastError GetModuleFileNameW LocalFree MultiByteToWideChar GetEnvironmentVariableW SetEnvironmentVariableW CreateFileW GetFileInformationByHandle CloseHandle HeapFree GetProcessHeap WaitForSingleObject TerminateProcess GetExitCodeProcess CreateRemoteThread GetExitCodeThread CreateProcessW OpenProcess GetSystemDirectoryW VirtualAllocEx ReadProcessMemory WriteProcessMemory VirtualFreeEx GetModuleHandleW GetProcAddress FormatMessageW QueryFullProcessImageNameW WideCharToMultiByte K32EnumProcessModulesEx K32GetModuleFileNameExW K32GetModuleInformation Sleep GetWindowsDirectoryW LoadResource LockResource SizeofResource FindResourceW CreateEventW GetTickCount64 FreeLibrary LoadLibraryExW DeleteFileW MoveFileExW FlushFileBuffers ReadFile WriteFile SetHandleInformation CreatePipe PeekNamedPipe ResumeThread CreateJobObjectW AssignProcessToJobObject SetInformationJobObject GetDiskFreeSpaceExW GetFileSizeEx GetHandleInformation SetErrorMode SetEvent WaitForMultipleObjects GetCurrentProcessId IsValidCodePage MapViewOfFile UnmapViewOfFile CopyFileW GetStdHandle IsDebuggerPresent OutputDebugStringA GetCurrentThreadId AllocConsole FreeConsole GetConsoleMode SetConsoleMode WriteConsoleW GetConsoleScreenBufferInfo SetConsoleTextAttribute SetConsoleTitleW SetUnhandledExceptionFilter CompareStringOrdinal DuplicateHandle GetCurrentProcess OpenThread SuspendThread GetThreadId GetThreadContext FlushInstructionCache VirtualQuery VirtualProtectEx VirtualQueryEx CreateToolhelp32Snapshot Thread32First Thread32Next Module32FirstW Module32NextW CreateFileMappingW GetCurrentThread SetThreadPriority CreateHardLinkW GlobalAlloc GlobalUnlock GlobalLock GlobalFree GetModuleHandleA LoadLibraryA QueryPerformanceCounter QueryPerformanceFrequency GetLocaleInfoA GetOverlappedResult CancelIoEx ResetEvent CreateThread GetProcessTimes SetFilePointerEx InitializeProcThreadAttributeList DeleteProcThreadAttributeList RtlUnwind GetModuleHandleExW GetCPInfo LCMapStringEx GetSystemTimeAsFileTime DecodePointer EncodePointer DeleteCriticalSection InitializeCriticalSectionEx LeaveCriticalSection EnterCriticalSection InitOnceComplete InitOnceBeginInitialize RaiseException RtlPcToFileHeader SleepConditionVariableSRW WakeAllConditionVariable WakeConditionVariable TryAcquireSRWLockExclusive AcquireSRWLockExclusive ReleaseSRWLockExclusive GetNativeSystemInfo WaitForSingleObjectEx GetStringTypeW GetFileInformationByHandleEx AreFileApisANSI SetFileInformationByHandle GetFullPathNameW GetFinalPathNameByHandleW GetFileAttributesExW FindNextFileW FindFirstFileExW GetACP GetOEMCP GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle HeapSize SetEndOfFile GetProcessId UpdateProcThreadAttribute FindFirstFileW FindClose FormatMessageA GetLocaleInfoEx CreateDirectoryW

user32

GetClientRect IsWindowUnicode ReleaseCapture SetCapture GetCapture GetKeyState GetMessageExtraInfo TrackMouseEvent GetKeyboardLayout EmptyClipboard GetClipboardData SetClipboardData CloseClipboard OpenClipboard GetKeyNameTextW EnumDisplaySettingsW PostMessageW SetProcessDpiAwarenessContext GetDpiForSystem SetCursorPos LoadImageW LoadIconW LoadCursorW GetWindowThreadProcessId GetClassNameW EnumWindows ScreenToClient SetForegroundWindow GetForegroundWindow UpdateWindow GetSystemMetrics MapVirtualKeyW IsIconic IsWindowVisible ShowWindow DestroyWindow CreateWindowExW RegisterClassExW PostQuitMessage DefWindowProcW PeekMessageW DispatchMessageW SetCursor MessageBoxW GetCursorPos ClientToScreen SystemParametersInfoW TranslateMessage

advapi32

RegGetValueW

imm32

ImmReleaseContext ImmGetContext ImmSetCandidateWindow ImmSetCompositionWindow

Name

.text

Size

2.4MB

Virtual Size

2.4MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

592KB

Virtual Size

591KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

32KB

Virtual Size

119KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

95KB

Virtual Size

94KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1.9MB

Virtual Size

1.9MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

7KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-17_9d40558f5eb3a182f375c611526d4e4c_icedid_luca-stealer_njrat_stealc

winhttp

shell32

dwmapi

ole32

dbghelp

d3d12

dxgi

d3dcompiler_47

hid

cfgmgr32

bcrypt

kernel32

user32

advapi32

imm32

generic