2026-10-30_ee4da2b916033d2b4c4906d6b0a023b1_icedid_luca-stealer_njrat_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-30_ee4da2b916033d2b4c4906d6b0a023b1_icedid_luca-stealer_njrat_stealc
Size 2.0MB
Sample261030-qq2bpszt5j
SHA256 73233376eadaa69f813091c7df3fc986895fff71b068db9093032b97e363c70e
MD5 ee4da2b916033d2b4c4906d6b0a023b1
SHA1 d765e7d244dfb5ec74ad6583f08578bc2fa88c6e
SHA512 193515af92f1bde0d52628d4f957aad4dbafbf2f7ad21ac433bdd9980e4a5f43c283fe1bac7b722683f243dcbcee7622e53eb284c31281603514de672aa193e0
SSDEEP 24576:FTsIqCBizbIf8WTyq3tqMDPem5w6pkI4d6dqLujPSTSeU3P3mibmBkkozixnceMN:FA5nJbq3E6m6OQ5D/mc+kMxnzMZ+3
TLSH
T15595BF36A2A701ECE06AD178CA42AD17E2B1344803714AEB37E04D561FB77E45F7EB25
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-30_ee4da2b916033d2b4c4906d6b0a023b1_icedid_luca-stealer_njrat_stealc

File Explorer

2026-10-30_ee4da2b916033d2b4c4906d6b0a023b1_icedid_luca-stealer_njrat_stealc

.exe 2.0MB

2026-10-30_ee4da2b916033d2b4c4906d6b0a023b1_icedid_luca-stealer_njrat_stealc

IMPHASH cb127d6da097677c71517632feca3c5e
SHA256 73233376eadaa69f813091c7df3fc986895fff71b068db9093032b97e363c70e
MD5 ee4da2b916033d2b4c4906d6b0a023b1
SHA1 d765e7d244dfb5ec74ad6583f08578bc2fa88c6e
SHA512 193515af92f1bde0d52628d4f957aad4dbafbf2f7ad21ac433bdd9980e4a5f43c283fe1bac7b722683f243dcbcee7622e53eb284c31281603514de672aa193e0
SSDEEP 24576:FTsIqCBizbIf8WTyq3tqMDPem5w6pkI4d6dqLujPSTSeU3P3mibmBkkozixnceMN:FA5nJbq3E6m6OQ5D/mc+kMxnzMZ+3
TLSH
T15595BF36A2A701ECE06AD178CA42AD17E2B1344803714AEB37E04D561FB77E45F7EB25
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1160804

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

user32

LoadIconA PeekMessageA PostQuitMessage RegisterClassExA SetForegroundWindow SetLayeredWindowAttributes IsIconic DefWindowProcA EnumWindows GetForegroundWindow MessageBoxA MapVirtualKeyA SetWindowDisplayAffinity GetWindowLongA GetWindowTextA SetWindowLongA GetAsyncKeyState GetKeyNameTextA IsWindow ShowWindow GetCursorPos SendInput TranslateMessage CreateWindowExA ScreenToClient DefWindowProcW GetKeyState GetMessageExtraInfo GetCapture TrackMouseEvent GetKeyboardLayout SetCapture SetCursor IsWindowUnicode ReleaseCapture SetCursorPos OpenClipboard CloseClipboard EmptyClipboard GetClipboardData SetClipboardData LoadCursorA SetWindowPos ClientToScreen FindWindowW GetClientRect UnregisterClassA UpdateWindow GetWindowThreadProcessId MapVirtualKeyW DispatchMessageA DestroyWindow IsWindowVisible keybd_event PostMessageA GetWindowTextW

d3d11

D3D11CreateDeviceAndSwapChain

dwmapi

DwmExtendFrameIntoClientArea

kernel32

RaiseException InterlockedPushEntrySList SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW CreateThread ExitThread FreeLibraryAndExitThread GetModuleHandleExW WriteFile GetCommandLineA GetCommandLineW GetFileSizeEx SetFilePointerEx GetFileType HeapAlloc HeapFree FlsAlloc FlsGetValue FlsSetValue FlsFree VirtualProtect GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetTimeZoneInformation FlushFileBuffers GetConsoleOutputCP ReadConsoleW HeapReAlloc RtlUnwindEx GetStartupInfoW IsDebuggerPresent InitializeSListHead IsValidCodePage GetACP GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW WaitForSingleObject IsProcessorFeaturePresent SetThreadAffinityMask ReadFile GetModuleFileNameA SetConsoleCtrlHandler SetPriorityClass SetConsoleTextAttribute SetConsoleTitleA GetCurrentProcess GetStdHandle SetConsoleMode GetProcessAffinityMask SetThreadPriority GetEnvironmentVariableA GetVolumeInformationA K32EmptyWorkingSet GetModuleHandleA OpenProcess Sleep GetConsoleMode GetTickCount64 GetLastError GetFileAttributesA K32GetProcessMemoryInfo CreateFileA GetCurrentThread QueryPerformanceFrequency CloseHandle GetPriorityClass ExitProcess ReadProcessMemory GetCurrentProcessId GlobalMemoryStatusEx WideCharToMultiByte GetConsoleWindow QueryFullProcessImageNameW CreateDirectoryA SetProcessWorkingSetSize QueryPerformanceCounter GetTickCount AllocConsole VirtualQueryEx GetModuleFileNameW MultiByteToWideChar GlobalAlloc GlobalFree GlobalLock GlobalUnlock OutputDebugStringA GetLocaleInfoA LoadLibraryA IsDBCSLeadByte GetProcAddress FreeLibrary SetEnvironmentVariableW TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext RtlPcToFileHeader SetStdHandle GetProcessHeap HeapSize SetEvent GetSystemTimePreciseAsFileTime RtlUnwind SetEndOfFile WriteConsoleW CreateEventW

comdlg32

GetSaveFileNameA GetOpenFileNameA

advapi32

RegCloseKey RegOpenKeyExA RegQueryValueExA

shell32

SHGetFolderPathA ShellExecuteW

ole32

CoUninitialize CoCreateInstance CreateStreamOnHGlobal CoInitializeEx CoCreateFreeThreadedMarshaler

shlwapi

PathRemoveFileSpecA PathAppendA

winhttp

WinHttpQueryDataAvailable WinHttpSendRequest WinHttpCloseHandle WinHttpSetOption WinHttpOpenRequest WinHttpReadData WinHttpOpen WinHttpReceiveResponse WinHttpConnect

d3dcompiler_47

D3DCompile

api-ms-win-core-heap-l2-1-0

LocalFree

api-ms-win-core-localization-l1-2-0

GetCPInfo LCMapStringEx GetLocaleInfoEx FormatMessageA

api-ms-win-core-file-l1-1-0

FindClose CreateFileW CreateDirectoryW FindFirstFileExW FindNextFileW GetFileAttributesExW GetFileInformationByHandle GetFullPathNameW FindFirstFileW

api-ms-win-core-file-l1-2-2

AreFileApisANSI

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleW

api-ms-win-core-file-l2-1-0

GetFileInformationByHandleEx

api-ms-win-core-file-l2-1-2

CopyFileW

api-ms-win-core-synch-l1-1-0

ReleaseSRWLockExclusive TryAcquireSRWLockExclusive InitializeCriticalSectionEx EnterCriticalSection LeaveCriticalSection DeleteCriticalSection AcquireSRWLockExclusive WaitForSingleObjectEx

api-ms-win-core-processthreads-l1-1-0

GetCurrentThreadId GetExitCodeThread

api-ms-win-core-synch-l1-2-0

WakeAllConditionVariable SleepConditionVariableSRW

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime

api-ms-win-core-util-l1-1-0

DecodePointer EncodePointer

api-ms-win-core-string-l1-1-0

GetStringTypeW

imm32

ImmSetCompositionWindow ImmReleaseContext ImmGetContext ImmSetCandidateWindow

oleaut32

SysStringLen GetErrorInfo SysFreeString SetErrorInfo

api-ms-win-core-winrt-error-l1-1-1

RoOriginateLanguageException

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory

Name

.text

Size

1.3MB

Virtual Size

1.3MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

477KB

Virtual Size

476KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

16KB

Virtual Size

39KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

47KB

Virtual Size

46KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

74KB

Virtual Size

73KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-30_ee4da2b916033d2b4c4906d6b0a023b1_icedid_luca-stealer_njrat_stealc

user32

d3d11

dwmapi

kernel32

comdlg32

advapi32

shell32

ole32

shlwapi

winhttp

d3dcompiler_47

api-ms-win-core-heap-l2-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-file-l1-1-0

api-ms-win-core-file-l1-2-2

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-file-l2-1-0

api-ms-win-core-file-l2-1-2

api-ms-win-core-synch-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-util-l1-1-0

api-ms-win-core-string-l1-1-0

imm32

oleaut32

api-ms-win-core-winrt-error-l1-1-1

api-ms-win-core-winrt-l1-1-0

generic