2026-10-28_726a1b5da63346b5719781045d336366_icedid_luca-stealer_njrat_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-28_726a1b5da63346b5719781045d336366_icedid_luca-stealer_njrat_stealc
Size 1.3MB
Sample261030-chpfaavwbs
SHA256 b93699a73b1495f7230f69ac3222998c0d160f452f2e2e0c79c86dd43e1129aa
MD5 726a1b5da63346b5719781045d336366
SHA1 d26e8266f8c607259ad9879c0d0e80f93a1bda82
SHA512 e87d87d3aea6a8fe5f82d9d246bb92b8e6c6d4e91ae1a65511b01675c5b82812a7a934c889a1e14602e260898eae5d1fccf5d7aa74df7706f3b5b293bed3ee1a
SSDEEP 24576:M7W+K0yqkRiOO3NckmMT+dLR/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:eWUytR4yk/+dRLNiXicJFFRGNzj3
TLSH
T11F55CF16A7E811F9E1BBC276CD634516FBB2BC164B7196CF03A0525A1F37A904E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-28_726a1b5da63346b5719781045d336366_icedid_luca-stealer_njrat_stealc

File Explorer

2026-10-28_726a1b5da63346b5719781045d336366_icedid_luca-stealer_njrat_stealc

.exe 1.3MB

2026-10-28_726a1b5da63346b5719781045d336366_icedid_luca-stealer_njrat_stealc

IMPHASH b52bd34300fe569ecf3993d50ae07436
SHA256 b93699a73b1495f7230f69ac3222998c0d160f452f2e2e0c79c86dd43e1129aa
MD5 726a1b5da63346b5719781045d336366
SHA1 d26e8266f8c607259ad9879c0d0e80f93a1bda82
SHA512 e87d87d3aea6a8fe5f82d9d246bb92b8e6c6d4e91ae1a65511b01675c5b82812a7a934c889a1e14602e260898eae5d1fccf5d7aa74df7706f3b5b293bed3ee1a
SSDEEP 24576:M7W+K0yqkRiOO3NckmMT+dLR/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:eWUytR4yk/+dRLNiXicJFFRGNzj3
TLSH
T11F55CF16A7E811F9E1BBC276CD634516FBB2BC164B7196CF03A0525A1F37A904E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

282672

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

MsSense.pdb

kernel32

CloseThreadpoolTimer WaitForThreadpoolTimerCallbacks SetThreadpoolTimer GetModuleFileNameW DeleteCriticalSection InitializeCriticalSectionEx LeaveCriticalSection CreateFileW FindFirstVolumeW FindNextVolumeW FindVolumeClose GetDriveTypeW GetLogicalDrives GetVolumeInformationW QueryDosDeviceW GetVolumeNameForVolumeMountPointW GetVolumePathNamesForVolumeNameW DeviceIoControl MultiByteToWideChar QueryPerformanceCounter CompareFileTime CreateThreadpoolTimer GetSystemTimeAsFileTime GetProductInfo GetVersionExW Sleep AcquireSRWLockShared DeleteFileW FindClose FindFirstFileW FindNextFileW FlushFileBuffers GetFileAttributesW RemoveDirectoryW SetFileAttributesW SetFilePointerEx WriteFile AcquireSRWLockExclusive ReleaseSRWLockShared ReleaseSRWLockExclusive VerSetConditionMask LoadLibraryW FreeLibrary MoveFileExW WriteConsoleW GetWindowsDirectoryW GetComputerNameExW EnterCriticalSection GetTempPathW GlobalAlloc GetTempFileNameW SetStdHandle SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW FindFirstFileExW GetOEMCP GetLongPathNameW TerminateProcess GetCurrentProcess InitOnceComplete InitOnceBeginInitialize WideCharToMultiByte FormatMessageW GetProcAddress GetModuleHandleExW GetModuleHandleW GetACP IsValidCodePage GetModuleFileNameA CompareStringW GetConsoleMode GetConsoleOutputCP EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW DecodePointer HeapReAlloc HeapSize GetCurrentThreadId GetCurrentProcessId CreateSemaphoreExW CreateMutexExW LCMapStringW OpenSemaphoreW WaitForSingleObjectEx FlsFree WaitForSingleObject ReleaseMutex ReleaseSemaphore FlsSetValue FlsGetValue FlsAlloc GetFileType ExpandEnvironmentStringsW GetCommandLineW GetCommandLineA GetStdHandle ExitProcess LoadLibraryExW GlobalFree TlsFree TlsSetValue VerifyVersionInfoW TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount InterlockedPushEntrySList RtlUnwindEx GetStartupInfoW IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext InitializeSListHead GetProcessHeap HeapFree HeapAlloc SetLastError GetLastError CloseHandle OutputDebugStringW DebugBreak IsDebuggerPresent RaiseException GetSystemInfo VirtualProtect VirtualQuery LoadLibraryExA LCMapStringEx GetCPInfo CompareStringEx RtlPcToFileHeader GetStringTypeW WakeAllConditionVariable SleepConditionVariableSRW EncodePointer

advapi32

RegGetValueW RegDeleteKeyValueW RegOpenKeyExW RegCreateKeyExW OpenSCManagerW CloseServiceHandle RegSetValueExW StartServiceCtrlDispatcherW EventRegister EventUnregister EventSetInformation EventWriteTransfer GetSecurityDescriptorOwner GetSecurityDescriptorGroup GetSecurityDescriptorDacl LookupPrivilegeValueW AdjustTokenPrivileges OpenProcessToken SetNamedSecurityInfoW ConvertStringSecurityDescriptorToSecurityDescriptorW GetSecurityDescriptorSacl DestroyPrivateObjectSecurity ChangeServiceConfigW OpenServiceW StartServiceW RegCloseKey QueryServiceConfigW ControlService

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

api-ms-win-core-featurestaging-l1-1-0

SubscribeFeatureStateChangeNotification RecordFeatureError RecordFeatureUsage UnsubscribeFeatureStateChangeNotification GetFeatureEnabledState

api-ms-win-core-featurestaging-l1-1-1

GetFeatureVariant

api-ms-win-core-path-l1-1-0

PathCchCombine

userenv

GetAllUsersProfileDirectoryW

ws2_32

InetNtopW

iphlpapi

GetUnicastIpAddressEntry GetIfEntry2 FreeMibTable GetUnicastIpAddressTable

setupapi

SetupDiDestroyDeviceInfoList SetupDiEnumDeviceInfo SetupDiGetDeviceInterfaceDetailW SetupDiGetClassDevsW SetupDiGetDevicePropertyW SetupDiGetDeviceRegistryPropertyW SetupOpenInfFileW SetupDiEnumDeviceInterfaces SetupInstallFromInfSectionW SetupInstallServicesFromInfSectionW

bcrypt

BCryptCloseAlgorithmProvider BCryptDestroyHash

ntdll

RtlInitUnicodeString

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleExA

Name

.text

Size

476KB

Virtual Size

472KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

188KB

Virtual Size

186KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

16KB

Virtual Size

30KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

28KB

Virtual Size

24KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.didat

Size

4KB

Virtual Size

32B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

44KB

Virtual Size

40KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

576KB

Virtual Size

580KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-28_726a1b5da63346b5719781045d336366_icedid_luca-stealer_njrat_stealc

kernel32

advapi32

version

api-ms-win-core-featurestaging-l1-1-0

api-ms-win-core-featurestaging-l1-1-1

api-ms-win-core-path-l1-1-0

userenv

ws2_32

iphlpapi

setupapi

bcrypt

ntdll

api-ms-win-core-libraryloader-l1-2-0

generic