2026-10-22_6eb757875eb27174cfc3246b532ad8a3_icedid_luca-stealer_njrat

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-22_6eb757875eb27174cfc3246b532ad8a3_icedid_luca-stealer_njrat
Size 4.7MB
Sample261024-k9ts3sys3m
SHA256 20af7f1e86926340ccb6ec247e4f9939740c87f989fb218cfbee1daea070a346
MD5 6eb757875eb27174cfc3246b532ad8a3
SHA1 06c04e6489a12e13fd5e3f89ed92aadde3b86d5e
SHA512 417d17c19d326d60753301cd08436282cedfa8ae4167f84a0fcfcc73b9462b52bd6a4e8aa121cc0b816b01648f0e0a528e7f8a938d9c74f8a0cfc25c978737ef
SSDEEP 49152:PTm8y0VBNmlfewyZNEJVJ29Kqj8Z8HQvxi7mObVsve3akh2IuLNiXicJFFRGNzj3:BKBmbG7wRGpj3
TLSH
T19C369D16725942E8C0B8D0F89E0BC81BE7727C1643356AE712E5D75A1F639E48EBF321
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-22_6eb757875eb27174cfc3246b532ad8a3_icedid_luca-stealer_njrat

File Explorer

2026-10-22_6eb757875eb27174cfc3246b532ad8a3_icedid_luca-stealer_njrat

.exe 4.7MB

2026-10-22_6eb757875eb27174cfc3246b532ad8a3_icedid_luca-stealer_njrat

IMPHASH 1df092bd9a196cf019f35f9f3fec51e5
SHA256 20af7f1e86926340ccb6ec247e4f9939740c87f989fb218cfbee1daea070a346
MD5 6eb757875eb27174cfc3246b532ad8a3
SHA1 06c04e6489a12e13fd5e3f89ed92aadde3b86d5e
SHA512 417d17c19d326d60753301cd08436282cedfa8ae4167f84a0fcfcc73b9462b52bd6a4e8aa121cc0b816b01648f0e0a528e7f8a938d9c74f8a0cfc25c978737ef
SSDEEP 49152:PTm8y0VBNmlfewyZNEJVJ29Kqj8Z8HQvxi7mObVsve3akh2IuLNiXicJFFRGNzj3:BKBmbG7wRGpj3
TLSH
T19C369D16725942E8C0B8D0F89E0BC81BE7727C1643356AE712E5D75A1F639E48EBF321
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2529728

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

NisSrv.pdb

mpclient

MpFreeMemory MpManagerOpen MpNotificationRegister MpHandleClose MpConfigGetValueAlloc MpConfigClose MpConfigOpen MpConfigInitialize MpClientUtilExportFunctions MpUtilsExportFunctions MpConfigUninitialize

ntdll

RtlIpv4StringToAddressExW RtlIpv6StringToAddressExW VerSetConditionMask RtlPcToFileHeader RtlCaptureContext RtlUnwind RtlLookupFunctionEntry RtlVirtualUnwind RtlUnwindEx

kernel32

IsThreadAFiber ConvertThreadToFiber CreateFiberEx DeleteFiber GetModuleFileNameA CreateSemaphoreExW HeapFree SetLastError ReleaseSemaphore ReleaseMutex OpenSemaphoreW HeapAlloc DecodePointer CreateMutexExW GetCurrentProcessId DebugBreak GetSystemTimeAsFileTime CreateFileW GetLocaleInfoW DeviceIoControl GetFileAttributesW FindFirstFileW FindNextFileW FindClose GetProcessTimes QueryProcessCycleTime GetLongPathNameW GetProcessId DuplicateHandle OpenProcess QueryFullProcessImageNameW QueryUnbiasedInterruptTime StartThreadpoolIo CreateThreadpoolIo WaitForThreadpoolIoCallbacks CancelThreadpoolIo CancelIoEx GetOverlappedResult CloseThreadpoolIo InitializeSRWLock TryAcquireSRWLockExclusive ReleaseSRWLockExclusive ConvertFiberToThread ReleaseSRWLockShared AcquireSRWLockShared GetExitCodeProcess InitializeCriticalSection ResetEvent GetModuleHandleA GlobalFree VerifyVersionInfoW ExpandEnvironmentStringsW Sleep LocalFree SwitchToThread GetTickCount64 FormatMessageA GetCurrentDirectoryW GetSystemDirectoryW VirtualQuery GetProcessMitigationPolicy SetProcessMitigationPolicy InitializeCriticalSectionAndSpinCount SetEnvironmentVariableW CreateDirectoryW FindFirstFileExW GetFileInformationByHandle GetFileSizeEx ReadFile SetFilePointerEx WriteFile CreateFileMappingW MapViewOfFile QueryPerformanceFrequency GetCommandLineW WideCharToMultiByte SwitchToFiber GetCurrentProcess TerminateProcess WaitForSingleObject WaitForSingleObjectEx SetEvent CreateEventW GetProcessHeap HeapSetInformation DeleteCriticalSection InitializeCriticalSectionEx LoadLibraryExW FindResourceW LoadResource SizeofResource EnterCriticalSection LeaveCriticalSection lstrcmpiW GetModuleHandleW GetProcAddress FreeLibrary CloseHandle RaiseException SystemTimeToFileTime GetSystemTime SubmitThreadpoolWork CreateThreadpoolWork SetThreadpoolThreadMaximum CreateThreadpool CloseThreadpoolWork WaitForThreadpoolWorkCallbacks CloseThreadpool MultiByteToWideChar GetLastError IsDebuggerPresent GetCurrentThreadId OutputDebugStringW CreateThreadpoolTimer CloseThreadpoolTimer WaitForThreadpoolTimerCallbacks SetThreadpoolTimer FormatMessageW GetModuleHandleExW GetModuleFileNameW RemoveVectoredExceptionHandler AddVectoredExceptionHandler SetErrorMode SetUnhandledExceptionFilter GetFileType FlsAlloc FlsGetValue FlsSetValue FlsFree CompareStringW LCMapStringW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW HeapReAlloc HeapSize HeapQueryInformation GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle FlushFileBuffers GetConsoleOutputCP GetConsoleMode ReadConsoleW SetEndOfFile WriteConsoleW UnmapViewOfFile GetSystemInfo VirtualProtect LoadLibraryExA GetVersionExW CreateMutexW AcquireSRWLockExclusive GetCommandLineA GetStdHandle ExitProcess GetOEMCP GetACP IsValidCodePage FreeLibraryAndExitThread ExitThread CreateThread SetConsoleCtrlHandler TlsFree TlsSetValue TlsGetValue GetLocaleInfoEx GetThreadPreferredUILanguages GetUserPreferredUILanguages GetSystemPreferredUILanguages QueryPerformanceCounter SleepConditionVariableSRW WakeConditionVariable WakeAllConditionVariable InitOnceComplete InitOnceBeginInitialize GetFileAttributesExW SetFileInformationByHandle AreFileApisANSI CopyFileW MoveFileExW GetFileInformationByHandleEx GetStringTypeW EncodePointer LCMapStringEx CompareStringEx GetCPInfo UnhandledExceptionFilter IsProcessorFeaturePresent GetStartupInfoW InitializeSListHead TlsAlloc

advapi32

RegSetKeyValueW RegOpenCurrentUser RegGetValueW ImpersonateLoggedOnUser CloseServiceHandle OpenSCManagerW StartServiceW OpenServiceW RevertToSelf SetThreadToken DuplicateTokenEx RegQueryValueExW SetServiceStatus RegisterServiceCtrlHandlerExW StartServiceCtrlDispatcherW RegDeleteValueW RegCreateKeyExW RegSetValueExW RegOpenKeyExW RegEnumKeyExW RegQueryInfoKeyW RegCloseKey RegDeleteKeyW UnregisterTraceGuids RegisterTraceGuidsW GetTraceEnableFlags GetTraceEnableLevel GetTraceLoggerHandle TraceMessage EventWriteTransfer EventUnregister EventRegister

user32

CharNextW

Name

.text

Size

2.7MB

Virtual Size

2.7MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

688KB

Virtual Size

687KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

644KB

Virtual Size

723KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

104KB

Virtual Size

100KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.didat

Size

4KB

Virtual Size

520B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

4KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

596KB

Virtual Size

600KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-22_6eb757875eb27174cfc3246b532ad8a3_icedid_luca-stealer_njrat

mpclient

ntdll

kernel32

advapi32

user32

generic