2026-10-23_e16bf169054c3fe853e6ca7c04461664_icedid_luca-stealer_njrat_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-23_e16bf169054c3fe853e6ca7c04461664_icedid_luca-stealer_njrat_stealc
Size 1.0MB
Sample261023-he1xsscd29
SHA256 a2b7187128b533ef1d7bf61c466a69280d575235f2c76a700bc5fa50774c0d77
MD5 e16bf169054c3fe853e6ca7c04461664
SHA1 9b12a39fd117c79e4c3f4ae66a3c4debeeac51a9
SHA512 68900eb87c3abdd1d9bd3546a80494895b16602495adfe4e793a75536b6eb7f010a6f104d5824c59c75610d56ed5de5425759e9877b8fbe9f0ecd44329e77dd4
SSDEEP 24576:rqpJzOKQPBjRmebzPXgrjOjOIa13KifnCt7:0LONzPX48O1jfnC
TLSH
T1DB35AF19B2F501F8E1BB9134D965611BDA3638550B308BDF17E006692F73BE05BBBB22
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-23_e16bf169054c3fe853e6ca7c04461664_icedid_luca-stealer_njrat_stealc

File Explorer

2026-10-23_e16bf169054c3fe853e6ca7c04461664_icedid_luca-stealer_njrat_stealc

.exe 1.0MB

2026-10-23_e16bf169054c3fe853e6ca7c04461664_icedid_luca-stealer_njrat_stealc

IMPHASH 398c29d4f4b2a0dcf4b7c077401f6e81
SHA256 a2b7187128b533ef1d7bf61c466a69280d575235f2c76a700bc5fa50774c0d77
MD5 e16bf169054c3fe853e6ca7c04461664
SHA1 9b12a39fd117c79e4c3f4ae66a3c4debeeac51a9
SHA512 68900eb87c3abdd1d9bd3546a80494895b16602495adfe4e793a75536b6eb7f010a6f104d5824c59c75610d56ed5de5425759e9877b8fbe9f0ecd44329e77dd4
SSDEEP 24576:rqpJzOKQPBjRmebzPXgrjOjOIa13KifnCt7:0LONzPX48O1jfnC
TLSH
T1DB35AF19B2F501F8E1BB9134D965611BDA3638550B308BDF17E006692F73BE05BBBB22
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

540796

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

d3d11

D3D11CreateDeviceAndSwapChain

dwmapi

DwmExtendFrameIntoClientArea

user32

GetMessageW SetProcessDPIAware LoadCursorA SetCursor SetCursorPos IsWindowUnicode ReleaseCapture SetCapture GetCapture GetKeyState GetMessageExtraInfo TrackMouseEvent GetKeyboardLayout EmptyClipboard GetClipboardData SetClipboardData CloseClipboard OpenClipboard RegisterRawInputDevices GetRawInputData GetWindowThreadProcessId FindWindowW SetWindowLongPtrW GetWindowLongPtrW ScreenToClient ClientToScreen GetCursorPos GetClientRect GetForegroundWindow GetAsyncKeyState IsIconic SetWindowPos SetLayeredWindowAttributes ShowWindow CreateWindowExW RegisterClassExW RegisterClassW PostQuitMessage DefWindowProcW PostThreadMessageW PeekMessageW DispatchMessageW TranslateMessage

shell32

ShellExecuteW

d3dcompiler_47

D3DCompile

kernel32

IsValidCodePage FindNextFileW FindFirstFileExW FindClose HeapReAlloc OutputDebugStringW ReadConsoleW SetFilePointerEx GetFileSizeEx GetConsoleMode GetConsoleOutputCP FlushFileBuffers EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW VirtualProtect FlsFree FlsSetValue FlsGetValue FlsAlloc GetTimeZoneInformation HeapFree HeapAlloc GetCommandLineW GetCommandLineA WriteFile ExitProcess ReadFile WriteConsoleW GetModuleFileNameW GetFileType GetStdHandle GetModuleHandleExW FreeLibraryAndExitThread GetACP GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW ExitThread CreateThread SetEnvironmentVariableW GetProcessHeap GetFileAttributesA CloseHandle QueryPerformanceCounter QueryPerformanceFrequency Sleep GetProcessTimes GetCurrentProcess GetThreadId OpenProcess GlobalMemoryStatusEx GetSystemInfo GetLocalTime ReadProcessMemory GetModuleHandleW SetStdHandle CreateToolhelp32Snapshot Process32FirstW Process32NextW Module32FirstW Module32NextW GlobalAlloc GlobalUnlock GlobalLock GlobalFree MultiByteToWideChar WideCharToMultiByte VerSetConditionMask FreeLibrary GetModuleHandleA GetProcAddress LoadLibraryA GetLocaleInfoA WaitForSingleObjectEx GetCurrentThreadId GetExitCodeThread ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection RtlUnwind GetSystemTimeAsFileTime WakeAllConditionVariable SleepConditionVariableSRW EncodePointer DecodePointer LCMapStringEx GetStringTypeW GetCPInfo RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW GetCurrentProcessId InitializeSListHead LoadLibraryExW CreateFileW HeapSize SetEndOfFile K32GetProcessMemoryInfo RtlPcToFileHeader RaiseException RtlUnwindEx GetLastError SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree

imm32

ImmGetContext ImmReleaseContext ImmSetCompositionWindow ImmSetCandidateWindow

Name

.text

Size

764KB

Virtual Size

764KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

227KB

Virtual Size

226KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

8KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

34KB

Virtual Size

34KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-23_e16bf169054c3fe853e6ca7c04461664_icedid_luca-stealer_njrat_stealc

d3d11

dwmapi

user32

shell32

d3dcompiler_47

kernel32

imm32

generic