2026-10-28_76c3110bbfed4752a41723bb3ac48d66_icedid_luca-stealer_njrat_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-28_76c3110bbfed4752a41723bb3ac48d66_icedid_luca-stealer_njrat_stealc
Size 1.8MB
Sample261030-b672vsvvdw
SHA256 1af78a5005b3dc57bc48bade7a74146cbfe8993c24dce61914154040ff5a0fcf
MD5 76c3110bbfed4752a41723bb3ac48d66
SHA1 39aa1027cd92983102a312ce77791be7dffa370a
SHA512 55adb7f17a5900e2c3089fe19b48eceba64ab37a41da487b2bccf929a483e9ae947fe948a4db2bedfb27ff507412e170eec4057e15c9c647f4724e6e4884fe74
SSDEEP 49152:f28p0TKrMV4WsC3fBanZ8yTQ8dyQ42BwvA3:yfmBd54GR
TLSH
T1EB859DBD93B08298D156E6B484836827F3B2382953B8FBEB57D44D611F167E00BB7631
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-28_76c3110bbfed4752a41723bb3ac48d66_icedid_luca-stealer_njrat_stealc

File Explorer

2026-10-28_76c3110bbfed4752a41723bb3ac48d66_icedid_luca-stealer_njrat_stealc

.exe 1.8MB

2026-10-28_76c3110bbfed4752a41723bb3ac48d66_icedid_luca-stealer_njrat_stealc

IMPHASH a4786c4f567f6bae1a72803282dd5488
SHA256 1af78a5005b3dc57bc48bade7a74146cbfe8993c24dce61914154040ff5a0fcf
MD5 76c3110bbfed4752a41723bb3ac48d66
SHA1 39aa1027cd92983102a312ce77791be7dffa370a
SHA512 55adb7f17a5900e2c3089fe19b48eceba64ab37a41da487b2bccf929a483e9ae947fe948a4db2bedfb27ff507412e170eec4057e15c9c647f4724e6e4884fe74
SSDEEP 49152:f28p0TKrMV4WsC3fBanZ8yTQ8dyQ42BwvA3:yfmBd54GR
TLSH
T1EB859DBD93B08298D156E6B484836827F3B2382953B8FBEB57D44D611F167E00BB7631
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

667572

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

d3d11

D3D11CreateDeviceAndSwapChain

wininet

InternetCloseHandle InternetConnectA InternetOpenUrlA InternetReadFile InternetSetOptionA HttpOpenRequestA HttpSendRequestA HttpQueryInfoA InternetOpenA

shell32

SHGetFolderPathA ShellExecuteA

advapi32

GetTokenInformation RegQueryValueExW RegOpenKeyExW RegDeleteValueW RegCreateKeyExW RegCloseKey CryptDestroyHash CryptHashData CryptCreateHash CryptGetHashParam CryptDestroyKey CryptReleaseContext SetSecurityDescriptorDacl SetKernelObjectSecurity InitializeSecurityDescriptor InitializeAcl OpenProcessToken AllocateAndInitializeSid CheckTokenMembership FreeSid RegSetValueExW GetUserNameA CloseServiceHandle OpenSCManagerW OpenServiceW QueryServiceStatus ConvertSidToStringSidA CryptAcquireContextA

user32

wsprintfA wsprintfW TranslateMessage DispatchMessageA PeekMessageA PostMessageA DefWindowProcA PostQuitMessage UnregisterClassA RegisterClassExA CreateWindowExA DestroyWindow ShowWindow SetWindowPos SetCapture ReleaseCapture GetSystemMetrics SetClipboardData UpdateWindow SetWindowRgn SetWindowTextA LoadCursorA ScreenToClient ClientToScreen SetCursor SetCursorPos GetForegroundWindow IsWindowUnicode GetCapture GetKeyState GetMessageExtraInfo TrackMouseEvent GetKeyboardLayout EmptyClipboard GetClipboardData GetClientRect CloseClipboard OpenClipboard GetCursorPos MessageBoxA GetWindowRect

gdi32

CreateRoundRectRgn

bcrypt

BCryptDecrypt BCryptGenerateSymmetricKey BCryptSetProperty BCryptDestroyHash BCryptFinishHash BCryptHashData BCryptCreateHash BCryptCloseAlgorithmProvider BCryptOpenAlgorithmProvider BCryptDestroyKey

dwmapi

DwmSetWindowAttribute DwmExtendFrameIntoClientArea

urlmon

URLDownloadToFileA

ole32

CoUninitialize CoInitializeEx

kernel32

IsValidCodePage GetACP GetOEMCP ReadConsoleW SetFilePointerEx GetFileSizeEx GetCommandLineA GetConsoleOutputCP FlushFileBuffers GetFileType EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW VirtualProtect FlsFree FlsSetValue FlsGetValue FlsAlloc HeapReAlloc GetStdHandle ExitProcess GetModuleHandleExW FreeLibraryAndExitThread ExitThread CreateThread LoadLibraryExW TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount SetLastError RtlUnwindEx RaiseException RtlPcToFileHeader GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle HeapSize SetEndOfFile WriteConsoleW GetConsoleMode DeleteFileW InitializeSListHead IsProcessorFeaturePresent GetStartupInfoW UnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext GetCPInfo GetStringTypeW LCMapStringEx DecodePointer EncodePointer WakeAllConditionVariable SetEnvironmentVariableA CreateDirectoryA CreateFileA DeleteFileA FindClose FindFirstFileA FindNextFileA GetFileAttributesA GetFileAttributesW GetFileAttributesExA GetFileSize ReadFile WriteFile GetTempPathA GetVolumeInformationA OutputDebugStringA CloseHandle SetUnhandledExceptionFilter GetLastError SetErrorMode QueryPerformanceCounter SetEvent WaitForSingleObject CreateEventA CreateEventW Sleep WaitForMultipleObjects GetCurrentProcess GetCurrentProcessId TerminateProcess GetExitCodeProcess ResumeThread CreateProcessA OpenProcess GetTickCount GetTickCount64 GetSystemDirectoryA GetSystemDirectoryW GetWindowsDirectoryA FreeLibrary GetModuleFileNameA GetModuleFileNameW GetModuleHandleA LoadLibraryExA LocalFree MoveFileExA WideCharToMultiByte CreateToolhelp32Snapshot Process32FirstW Process32NextW GetEnvironmentVariableW CompareFileTime CreateDirectoryW RtlUnwind FindFirstFileW FindNextFileW GetProcessTimes CreateProcessW ReadProcessMemory GetModuleHandleW GetProcAddress QueryFullProcessImageNameW MoveFileExW GlobalAlloc GlobalUnlock GlobalLock GlobalFree MultiByteToWideChar QueryPerformanceFrequency LoadLibraryA GetLocaleInfoA HeapAlloc HeapFree GetProcessHeap InitializeProcThreadAttributeList DeleteProcThreadAttributeList UpdateProcThreadAttribute GetThreadContext SetThreadContext VirtualAllocEx VirtualProtectEx WriteProcessMemory GetExitCodeThread DebugSetProcessKillOnExit FormatMessageA GetLocaleInfoEx WaitForSingleObjectEx GetCurrentThreadId ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive SleepConditionVariableSRW CreateFileW FindFirstFileExW GetFileAttributesExW GetFileInformationByHandle GetFinalPathNameByHandleW SetFileInformationByHandle AreFileApisANSI CopyFileW GetFileInformationByHandleEx EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection GetSystemTimeAsFileTime

imm32

ImmReleaseContext ImmSetCandidateWindow ImmGetContext ImmSetCompositionWindow

d3dcompiler_47

D3DCompile

Name

.text

Size

860KB

Virtual Size

859KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

413KB

Virtual Size

412KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

6KB

Virtual Size

14KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

523KB

Virtual Size

523KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-28_76c3110bbfed4752a41723bb3ac48d66_icedid_luca-stealer_njrat_stealc

d3d11

wininet

shell32

advapi32

user32

gdi32

bcrypt

dwmapi

urlmon

ole32

kernel32

imm32

d3dcompiler_47

generic