2026-10-18_32ef080b58191a8e61a166f1e1497111_icedid_luca-stealer_njrat_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-18_32ef080b58191a8e61a166f1e1497111_icedid_luca-stealer_njrat_stealc
Size 3.5MB
Sample261018-tkf1cs1zc1
SHA256 5bb5204a4651812d68da19f918661cf0da6551462373b3afc551b95bc8aeeed5
MD5 32ef080b58191a8e61a166f1e1497111
SHA1 4217dc88533aefb4c57871bf2d04b5e0cb8410bc
SHA512 97de575560f9c2ccc77fb4462a0ff317db4443797e14646a9d05158e4a884e7aa8e76780232a988e6f380a6088ab482745bc8cf8550a41a4cdfceae51eb9afbf
SSDEEP 49152:Vph2lwOsns6h+92ZbI1DGpRw5wF3vXNDmnarSj8RoTCC+rqwH6Pcy0uhSjWUC:V9JbI1OlDeJTMcUDuhSjW
TLSH
T1DBF5D007ABA412E8E1B3D17DC9574A46EBB2BC151331D7CF02A446D61F272F14EBA722
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-18_32ef080b58191a8e61a166f1e1497111_icedid_luca-stealer_njrat_stealc

File Explorer

2026-10-18_32ef080b58191a8e61a166f1e1497111_icedid_luca-stealer_njrat_stealc

.exe 3.5MB

2026-10-18_32ef080b58191a8e61a166f1e1497111_icedid_luca-stealer_njrat_stealc

IMPHASH cd13eca80fc28b00e0054d78cdd9694e
SHA256 5bb5204a4651812d68da19f918661cf0da6551462373b3afc551b95bc8aeeed5
MD5 32ef080b58191a8e61a166f1e1497111
SHA1 4217dc88533aefb4c57871bf2d04b5e0cb8410bc
SHA512 97de575560f9c2ccc77fb4462a0ff317db4443797e14646a9d05158e4a884e7aa8e76780232a988e6f380a6088ab482745bc8cf8550a41a4cdfceae51eb9afbf
SSDEEP 49152:Vph2lwOsns6h+92ZbI1DGpRw5wF3vXNDmnarSj8RoTCC+rqwH6Pcy0uhSjWUC:V9JbI1OlDeJTMcUDuhSjW
TLSH
T1DBF5D007ABA412E8E1B3D17DC9574A46EBB2BC151331D7CF02A446D61F272F14EBA722
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1000048

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\A147\installer\Build\x64\UnicodeRelease\SamanUninstaller\SamanUninstaller.pdb

kernel32

WaitForMultipleObjects GetExitCodeProcess SetDllDirectoryW GetUserDefaultUILanguage HeapAlloc GetProcessHeap DuplicateHandle TerminateThread LoadLibraryExA VirtualQuery GetSystemInfo WriteConsoleW SetEndOfFile HeapSize SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP IsValidCodePage FindFirstFileExW SetConsoleCtrlHandler GetFileSizeEx GetConsoleOutputCP FlushFileBuffers SetFilePointerEx ReadConsoleW GetConsoleMode EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW VirtualProtect IsThreadAFiber FlsFree FlsSetValue FlsGetValue FlsAlloc GetTempPathW HeapReAlloc HeapFree GetCurrentThread CreateEventW FreeLibraryAndExitThread ResumeThread ExitThread CreateThread GetTimeZoneInformation GetFileType SetStdHandle GetCommandLineW GetCommandLineA FreeLibrary TlsFree TlsSetValue TlsGetValue TlsAlloc SetLastError InterlockedFlushSList InterlockedPushEntrySList RtlUnwindEx RtlPcToFileHeader RaiseException OutputDebugStringW InitializeSListHead GetSystemTimeAsFileTime QueryPerformanceCounter GetStartupInfoW IsDebuggerPresent IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext SleepConditionVariableSRW WakeAllConditionVariable AcquireSRWLockExclusive ReleaseSRWLockExclusive GetCPInfo CompareStringEx GetStringTypeW LCMapStringEx EncodePointer GetLocaleInfoEx LeaveCriticalSection EnterCriticalSection FormatMessageA WaitForSingleObject K32GetProcessImageFileNameW K32GetModuleFileNameExW K32EnumProcessModules Process32NextW Process32FirstW CreateToolhelp32Snapshot AllocConsole VerifyVersionInfoW GetVersionExW GetSystemDirectoryW GetCurrentThreadId TerminateProcess GetCurrentProcess CreateMutexW SetFileAttributesW QueryDosDeviceW GetLogicalDriveStringsW GetFinalPathNameByHandleW GetDiskFreeSpaceExW FindNextFileW FindFirstFileW FindClose GetEnvironmentVariableW GetStdHandle VerSetConditionMask lstrcmpiW lstrcpyW lstrcpynW GetLocalTime GlobalFree DeleteFileW CreateFileA GlobalAlloc LockResource SizeofResource FreeResource LoadResource FindResourceW SystemTimeToFileTime LocalFileTimeToFileTime GetFileAttributesW SetFilePointer SetFileTime WriteFile CreateDirectoryW LocalFree FormatMessageW InitializeCriticalSectionAndSpinCount ExitProcess GlobalUnlock GlobalLock CloseHandle ReadFile GetFileSize CreateFileW lstrlenW GetTickCount WideCharToMultiByte GetCurrentDirectoryW GetModuleFileNameW OpenProcess MulDiv GetProcAddress LoadLibraryW GetACP MultiByteToWideChar LoadLibraryExW MoveFileW CopyFileW Sleep DeleteCriticalSection InitializeCriticalSectionEx DecodePointer RemoveDirectoryW SetCurrentDirectoryW MoveFileExW GetModuleHandleW GetCurrentProcessId GetLastError GetModuleHandleExW RtlUnwind

user32

GetKeyboardLayout GetKeyNameTextW GetShellWindow SetFocus SetWindowTextW GetWindowRect MapVirtualKeyExW InflateRect UnionRect SetCursor LoadCursorW MonitorFromPoint MonitorFromWindow EnumWindows GetWindowThreadProcessId EnumChildWindows PostQuitMessage UnregisterClassW TrackPopupMenu EnableMenuItem AppendMenuW CreatePopupMenu MessageBoxW SetForegroundWindow DestroyMenu IsWindowEnabled UpdateWindow EqualRect GetWindowTextLengthW GetWindowTextW InvalidateRgn CreateAcceleratorTableW GetGUIThreadInfo OffsetRect DrawTextA GetCaretBlinkTime ClientToScreen SetCaretPos GetCaretPos HideCaret ShowCaret CreateCaret CharPrevW SetRect DrawTextW FillRect GetWindowRgn UpdateLayeredWindow SetWindowRgn MoveWindow GetMenu AdjustWindowRectEx GetPropW SetPropW CallWindowProcW GetWindowLongPtrW RegisterClassExW GetClassInfoExW RegisterClassW GetSystemMetrics EnableWindow ShowWindow SetWindowLongPtrW DefWindowProcW LoadImageW GetParent PostMessageW SetCapture KillTimer SetTimer GetFocus IsZoomed DispatchMessageW TranslateMessage GetMessageW InvalidateRect GetSysColor ReleaseCapture PtInRect GetCursorPos CreateWindowExW GetMonitorInfoW MapWindowPoints IntersectRect IsWindowVisible IsWindow IsRectEmpty GetUpdateRect EndPaint BeginPaint GetWindow GetActiveWindow IsIconic SetWindowLongW GetWindowLongW SetWindowPos GetClientRect DestroyWindow CharNextW GetKeyState ScreenToClient SendMessageW RegisterWindowMessageW ReleaseDC GetDC

gdi32

StretchBlt CombineRgn ExtSelectClipRgn CreateRectRgnIndirect GetClipBox SelectClipRgn PtInRegion CreateRectRgn CreateDIBSection CreateRoundRectRgn PlayEnhMetaFile CreateCompatibleBitmap GetEnhMetaFileHeader CreateDIBitmap AddFontMemResourceEx CreateDCA CloseEnhMetaFile CreateEnhMetaFileW SetWindowOrgEx Rectangle RestoreDC BitBlt SaveDC SelectObject CreateCompatibleDC RemoveFontMemResourceEx DeleteObject CreatePen CreateFontIndirectW GetStockObject GetObjectW GetDeviceCaps SelectPalette RealizePalette GetDIBits GetCurrentObject SetStretchBltMode CreateSolidBrush CreatePenIndirect MoveToEx LineTo GetObjectA SetBkMode SetTextColor SetBkColor GetCharABCWidthsW GetTextExtentPoint32W TextOutW GdiFlush EnumFontFamiliesExW CreatePatternBrush GetTextExtentPointA GetBitmapBits SetBitmapBits GetTextMetricsW DeleteDC

advapi32

CheckTokenMembership RegDeleteKeyExW RegDeleteValueW RegEnumValueW GetUserNameW RegSetValueExW LookupPrivilegeValueW GetTokenInformation FreeSid EqualSid DuplicateTokenEx RegCloseKey AllocateAndInitializeSid AdjustTokenPrivileges OpenProcessToken RegDeleteTreeW RegQueryValueExW RegQueryInfoKeyW RegOpenKeyExW

shell32

SHGetSpecialFolderPathW SHGetSpecialFolderLocation SHCreateDirectoryExW DragQueryFileW SHChangeNotify ShellExecuteW

ole32

CoInitializeSecurity CoTaskMemFree CoTaskMemAlloc CoCreateGuid CLSIDFromProgID CLSIDFromString OleLockRunning CreateStreamOnHGlobal ReleaseStgMedium RegisterDragDrop DoDragDrop CoCreateInstance OleDuplicateData CoInitialize CoUninitialize StringFromGUID2

oleaut32

SysAllocString SysFreeString VariantClear VariantChangeType SetErrorInfo CreateErrorInfo GetErrorInfo VariantInit

comctl32

_TrackMouseEvent InitCommonControlsEx ord17

shlwapi

SHGetValueW PathIsDirectoryW PathFindExtensionW PathFindFileNameW SHDeleteKeyW SHDeleteValueW SHSetValueW PathIsRelativeW StrChrW StrStrIW PathFileExistsW PathIsNetworkPathW

cJSON_AddArrayToObject cJSON_AddBoolToObject cJSON_AddFalseToObject cJSON_AddItemReferenceToArray cJSON_AddItemReferenceToObject cJSON_AddItemToArray cJSON_AddItemToObject cJSON_AddItemToObjectCS cJSON_AddNullToObject cJSON_AddNumberToObject cJSON_AddObjectToObject cJSON_AddRawToObject cJSON_AddStringToObject cJSON_AddTrueToObject cJSON_Compare cJSON_CreateArray cJSON_CreateArrayReference cJSON_CreateBool cJSON_CreateDoubleArray cJSON_CreateFalse cJSON_CreateFloatArray cJSON_CreateIntArray cJSON_CreateNull cJSON_CreateNumber cJSON_CreateObject cJSON_CreateObjectReference cJSON_CreateRaw cJSON_CreateString cJSON_CreateStringArray cJSON_CreateStringReference cJSON_CreateTrue cJSON_Delete cJSON_DeleteItemFromArray cJSON_DeleteItemFromObject cJSON_DeleteItemFromObjectCaseSensitive cJSON_DetachItemFromArray cJSON_DetachItemFromObject cJSON_DetachItemFromObjectCaseSensitive cJSON_DetachItemViaPointer cJSON_Duplicate cJSON_GetArrayItem cJSON_GetArraySize cJSON_GetErrorPtr cJSON_GetObjectItem cJSON_GetObjectItemCaseSensitive cJSON_GetStringValue cJSON_HasObjectItem cJSON_InitHooks cJSON_InsertItemInArray cJSON_IsArray cJSON_IsBool cJSON_IsFalse cJSON_IsInvalid cJSON_IsNull cJSON_IsNumber cJSON_IsObject cJSON_IsRaw cJSON_IsString cJSON_IsTrue cJSON_Minify cJSON_Parse cJSON_ParseWithOpts cJSON_Print cJSON_PrintBuffered cJSON_PrintPreallocated cJSON_PrintUnformatted cJSON_ReplaceItemInArray cJSON_ReplaceItemInObject cJSON_ReplaceItemInObjectCaseSensitive cJSON_ReplaceItemViaPointer cJSON_SetNumberHelper cJSON_Version cJSON_free cJSON_malloc

Name

.text

Size

1.5MB

Virtual Size

1.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

451KB

Virtual Size

451KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

16KB

Virtual Size

26KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

73KB

Virtual Size

73KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.didat

Size

1024B

Virtual Size

624B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

108KB

Virtual Size

108KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

UPX1

Size

1.3MB

Virtual Size

1.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-18_32ef080b58191a8e61a166f1e1497111_icedid_luca-stealer_njrat_stealc

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

comctl32

shlwapi

generic