2026-11-01_e285e8ee0380c5116fb8bfe9006c2be0_icedid_luca-stealer_njrat_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-11-01_e285e8ee0380c5116fb8bfe9006c2be0_icedid_luca-stealer_njrat_stealc
Size 2.1MB
Sample261102-gclvesht9q
SHA256 7b72c500f425475e294e70f967bd1e1a730e58d472a67bc077027db6d3cd0d30
MD5 e285e8ee0380c5116fb8bfe9006c2be0
SHA1 5c00956b309ec2c426b0aa20c623674bb5a917cc
SHA512 2b377e19e57c52ab443a56ccb8e06d9adc9576d754865e7905c2ab5ca34ddd2e1b31df4b68ecb3c5497f2238775d37b00bf5134ac204606cc2a9024983eccdbc
SSDEEP 24576:Dx+39CS63P0f1WkQMyuzhzbyOl0xz0KyXioKKMycj6Mhz8ekM523nxeB:F+39CS63P0owh5QUfeVk3n
TLSH
T12FA5AE9DE1BC80ECE0EB8538D65E3BD3E5763844272096FB22C011917FB6E855E26763
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-11-01_e285e8ee0380c5116fb8bfe9006c2be0_icedid_luca-stealer_njrat_stealc

File Explorer

2026-11-01_e285e8ee0380c5116fb8bfe9006c2be0_icedid_luca-stealer_njrat_stealc

.exe 2.1MB

2026-11-01_e285e8ee0380c5116fb8bfe9006c2be0_icedid_luca-stealer_njrat_stealc

IMPHASH 105ac71a5c0f0e36cdc1c78dd0bbdcc9
SHA256 7b72c500f425475e294e70f967bd1e1a730e58d472a67bc077027db6d3cd0d30
MD5 e285e8ee0380c5116fb8bfe9006c2be0
SHA1 5c00956b309ec2c426b0aa20c623674bb5a917cc
SHA512 2b377e19e57c52ab443a56ccb8e06d9adc9576d754865e7905c2ab5ca34ddd2e1b31df4b68ecb3c5497f2238775d37b00bf5134ac204606cc2a9024983eccdbc
SSDEEP 24576:Dx+39CS63P0f1WkQMyuzhzbyOl0xz0KyXioKKMycj6Mhz8ekM523nxeB:F+39CS63P0owh5QUfeVk3n
TLSH
T12FA5AE9DE1BC80ECE0EB8538D65E3BD3E5763844272096FB22C011917FB6E855E26763
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2202624

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

user32

ReleaseCapture SetForegroundWindow GetCursorPos UpdateWindow RegisterClassExA PostQuitMessage UnregisterClassA PeekMessageA mouse_event SendMessageA GetClipboardData TranslateMessage SetFocus DefWindowProcA MessageBoxA MapVirtualKeyA SetWindowTextA CloseClipboard OpenClipboard GetAsyncKeyState DefWindowProcW GetMessageExtraInfo GetCapture ClientToScreen EmptyClipboard TrackMouseEvent GetKeyboardLayout GetForegroundWindow SetCapture SetClipboardData SetCursor GetClientRect IsWindowUnicode SetCursorPos GetKeyState DispatchMessageA LoadCursorA DestroyWindow ScreenToClient GetSystemMetrics ShowWindow GetKeyNameTextA SendInput

d3d11

D3D11CreateDevice

dwmapi

DwmExtendFrameIntoClientArea

wininet

InternetOpenA InternetReadFile InternetConnectA HttpSendRequestA InternetCloseHandle InternetSetOptionA HttpOpenRequestA InternetOpenUrlA

advapi32

RegQueryValueExA StartServiceA ChangeServiceConfigA OpenServiceA OpenSCManagerA CloseServiceHandle RegCloseKey CreateServiceA RegOpenKeyExA

shell32

SHGetFolderPathA ShellExecuteW ShellExecuteA

winmm

timeBeginPeriod timeEndPeriod

kernel32

WaitForSingleObject EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW FlsFree FlsSetValue FlsGetValue FlsAlloc HeapAlloc HeapFree GetConsoleMode GetConsoleOutputCP FlushFileBuffers GetTimeZoneInformation SetFilePointerEx GetFileSizeEx GetCommandLineW GetCommandLineA WriteFile WriteConsoleW GetModuleFileNameW CreateProcessW GetFileAttributesExW ReadConsoleW OutputDebugStringW GetFileType GetStdHandle ReadFile GetModuleHandleExW FreeLibraryAndExitThread ExitThread LoadLibraryExW TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount SetLastError HeapReAlloc FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW RaiseException RtlPcToFileHeader RtlUnwindEx SetStdHandle GetProcessHeap GetExitCodeProcess CreateFileW GetModuleFileNameA GetFileAttributesExA FindFirstFileA VirtualProtect GetCurrentProcess TerminateProcess FindNextFileA SetThreadPriority GetFullPathNameA FindClose CreateMutexA GetModuleHandleA HeapSize GetTempPathA GetTickCount64 CopyFileA GetLastError GetFileAttributesA MoveFileExA CreateFileA DefineDosDeviceA GetCurrentThread DeleteFileA CloseHandle CreateThread SetFileAttributesA GetThreadContext Beep GetProcAddress GlobalLock ExitProcess SetEnvironmentVariableA GetCurrentProcessId GetConsoleWindow CreateProcessA SetProcessWorkingSetSize GetTempFileNameA GetTickCount GlobalUnlock IsDebuggerPresent CheckRemoteDebuggerPresent SetUnhandledExceptionFilter OutputDebugStringA GetLocaleInfoA MultiByteToWideChar LoadLibraryA QueryPerformanceFrequency GlobalAlloc RtlUnwind IsDBCSLeadByte FreeLibrary WideCharToMultiByte QueryPerformanceCounter ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive GetCurrentThreadId SleepConditionVariableSRW InitializeCriticalSectionEx GetSystemTimeAsFileTime GetModuleHandleW EnterCriticalSection LeaveCriticalSection DeleteCriticalSection EncodePointer DecodePointer LCMapStringEx WakeAllConditionVariable GetStringTypeW GetCPInfo RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter IsProcessorFeaturePresent InitializeSListHead GetStartupInfoW SetEndOfFile Sleep GlobalFree

imm32

ImmSetCandidateWindow ImmReleaseContext ImmSetCompositionWindow ImmGetContext

d3dcompiler_47

D3DCompile

Name

.text

Size

921KB

Virtual Size

921KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.1MB

Virtual Size

1.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

6KB

Virtual Size

23KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

35KB

Virtual Size

35KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

40KB

Virtual Size

91KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-11-01_e285e8ee0380c5116fb8bfe9006c2be0_icedid_luca-stealer_njrat_stealc

user32

d3d11

dwmapi

wininet

advapi32

shell32

winmm

kernel32

imm32

d3dcompiler_47

generic