2026-10-26_e0d29695451e18d993c17f3f02b27071_icedid_luca-stealer_njrat_stealc

General

Target
2026-10-26_e0d29695451e18d993c17f3f02b27071_icedid_luca-stealer_njrat_stealc
Size 2.0MB
Sample261027-faegws1wdv
SHA256 aaa54932f0bfe0d1cc106d3d44924f5f915954a8de334d30bc31d59783a344d9
MD5 e0d29695451e18d993c17f3f02b27071
SHA1 64056a979ff1f89f6bac4080be2cdb318783e57c
SHA512 5a0ac1537f1cf2aa4ccbda88d6e1f183dc0472a8e7cdc48b922008d643c17785ca82163c4472dd559e1ad3a9ee631be7926b6474edbf619c772d3957e1388b0a
SSDEEP 24576:Rg1gg6C2hiHkC7bLlulsnOjYCE4YNlC5yX6okpU13j6xKMKDZp+p:rCxkC7/CBE4YNlC5yyU1+xKT9
TLSH
T134A5E929D9A25F27D43D477D81F74161F624E08CEB97AF5B2228F53835933B016EA328
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-26_e0d29695451e18d993c17f3f02b27071_icedid_luca-stealer_njrat_stealc

File Explorer

2026-10-26_e0d29695451e18d993c17f3f02b27071_icedid_luca-stealer_njrat_stealc

.exe 2.0MB

2026-10-26_e0d29695451e18d993c17f3f02b27071_icedid_luca-stealer_njrat_stealc

IMPHASH d9856661084353cbefc03c9ef56467ed
SHA256 aaa54932f0bfe0d1cc106d3d44924f5f915954a8de334d30bc31d59783a344d9
MD5 e0d29695451e18d993c17f3f02b27071
SHA1 64056a979ff1f89f6bac4080be2cdb318783e57c
SHA512 5a0ac1537f1cf2aa4ccbda88d6e1f183dc0472a8e7cdc48b922008d643c17785ca82163c4472dd559e1ad3a9ee631be7926b6474edbf619c772d3957e1388b0a
SSDEEP 24576:Rg1gg6C2hiHkC7bLlulsnOjYCE4YNlC5yX6okpU13j6xKMKDZp+p:rCxkC7/CBE4YNlC5yyU1+xKT9
TLSH
T134A5E929D9A25F27D43D477D81F74161F624E08CEB97AF5B2228F53835933B016EA328
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

417852

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

GetStdHandle SetStdHandle SetEnvironmentVariableW ReadFile WriteFile CloseHandle DuplicateHandle QueryPerformanceCounter QueryPerformanceFrequency SetEvent WaitForSingleObject CreateEventW GetCurrentProcess TerminateProcess GetCurrentThread GetThreadPriority GetPriorityClass VirtualQuery MapViewOfFile UnmapViewOfFile GetModuleHandleW GetProcAddress IsDebuggerPresent OutputDebugStringA LoadLibraryA FreeLibrary GetEnvironmentVariableA WriteConsoleW SetEndOfFile ReadConsoleW GetCurrentThreadId ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive WakeConditionVariable WakeAllConditionVariable SleepConditionVariableSRW WideCharToMultiByte EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer MultiByteToWideChar LCMapStringEx GetSystemTimeAsFileTime GetStringTypeW GetCPInfo RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent GetCurrentProcessId InitializeSListHead RtlPcToFileHeader RaiseException RtlUnwindEx GetLastError SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW CreateThread ExitThread FreeLibraryAndExitThread GetModuleHandleExW GetFileType ExitProcess GetModuleFileNameW GetCommandLineA GetCommandLineW HeapAlloc HeapFree FlsAlloc FlsGetValue FlsSetValue FlsFree VirtualProtect GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW FlushFileBuffers GetConsoleOutputCP GetConsoleMode HeapReAlloc HeapSize HeapQueryInformation GetFileSizeEx SetFilePointerEx GetTimeZoneInformation FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW GetProcessHeap CreateFileW

user32

MessageBoxA

Name

.text

Size

601KB

Virtual Size

600KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.4MB

Virtual Size

1.4MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

6KB

Virtual Size

18KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

24KB

Virtual Size

24KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-26_e0d29695451e18d993c17f3f02b27071_icedid_luca-stealer_njrat_stealc

kernel32

user32

generic