2026-11-06_f660d897732fb7d01121af50c978093c_icedid_luca-stealer_njrat_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-11-06_f660d897732fb7d01121af50c978093c_icedid_luca-stealer_njrat_stealc
Size 1.9MB
Sample261107-xewemset71
SHA256 38deaea3068b2c8857353551e5cdb30c4e69a81ad4dd6cbbe42a712bac517955
MD5 f660d897732fb7d01121af50c978093c
SHA1 c974b5ae0fd4d925bf7f50a49b391911bf20ecea
SHA512 91743f42c55cc641cb1323faf86df60400be790eb81a56f14e8d1e6a3a742b4b149cbf24a9cf2a6860e2d04a70452138664cb61eb99e829f21c832a035397b63
SSDEEP 49152:1kq+sMBHpOLUv8ah5rc3fB+nDheTQ8dyQ42BwvAu:1kpgZfdBd54Gs
TLSH
T196959DAE93B442A8D056D6B8C9826C27E77238255378FBEF97C04D611F267E00B77721
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-11-06_f660d897732fb7d01121af50c978093c_icedid_luca-stealer_njrat_stealc

File Explorer

2026-11-06_f660d897732fb7d01121af50c978093c_icedid_luca-stealer_njrat_stealc

.exe 1.9MB

2026-11-06_f660d897732fb7d01121af50c978093c_icedid_luca-stealer_njrat_stealc

IMPHASH af0751ace720ceab2238177780be54c7
SHA256 38deaea3068b2c8857353551e5cdb30c4e69a81ad4dd6cbbe42a712bac517955
MD5 f660d897732fb7d01121af50c978093c
SHA1 c974b5ae0fd4d925bf7f50a49b391911bf20ecea
SHA512 91743f42c55cc641cb1323faf86df60400be790eb81a56f14e8d1e6a3a742b4b149cbf24a9cf2a6860e2d04a70452138664cb61eb99e829f21c832a035397b63
SSDEEP 49152:1kq+sMBHpOLUv8ah5rc3fB+nDheTQ8dyQ42BwvAu:1kpgZfdBd54Gs
TLSH
T196959DAE93B442A8D056D6B8C9826C27E77238255378FBEF97C04D611F267E00B77721
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

749404

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

d3d11

D3D11CreateDeviceAndSwapChain

wininet

InternetOpenUrlA InternetReadFile InternetSetOptionA HttpOpenRequestA HttpSendRequestA HttpQueryInfoA InternetOpenA InternetConnectA InternetCloseHandle

shell32

ShellExecuteA SHGetFolderPathA

advapi32

GetTokenInformation RegQueryValueExW RegOpenKeyExW RegDeleteValueW RegCreateKeyExW RegCloseKey CryptDestroyHash CryptHashData CryptCreateHash CryptGetHashParam CryptDestroyKey CryptReleaseContext SetSecurityDescriptorDacl SetKernelObjectSecurity InitializeSecurityDescriptor InitializeAcl OpenProcessToken AllocateAndInitializeSid CheckTokenMembership FreeSid RegSetValueExW GetUserNameA CloseServiceHandle OpenSCManagerW OpenServiceW QueryServiceStatus ConvertSidToStringSidA CryptAcquireContextA

user32

SetWindowPos SetCapture ReleaseCapture GetSystemMetrics UpdateWindow SetWindowRgn SetWindowTextA GetClientRect GetWindowRect MessageBoxA GetCursorPos OpenClipboard CloseClipboard SetClipboardData GetClipboardData EmptyClipboard GetKeyboardLayout TrackMouseEvent GetMessageExtraInfo ShowWindow GetCapture IsWindowUnicode GetForegroundWindow SetCursorPos SetCursor ClientToScreen ScreenToClient LoadCursorA UnregisterClassA PostQuitMessage DestroyWindow DefWindowProcA PostMessageA PeekMessageA DispatchMessageA TranslateMessage wsprintfW CreateWindowExA GetKeyState wsprintfA RegisterClassExA

gdi32

CreateRoundRectRgn

bcrypt

BCryptOpenAlgorithmProvider BCryptCloseAlgorithmProvider BCryptCreateHash BCryptHashData BCryptFinishHash BCryptDestroyHash BCryptGenRandom BCryptSetProperty BCryptGenerateSymmetricKey BCryptDecrypt BCryptDestroyKey

dwmapi

DwmSetWindowAttribute DwmExtendFrameIntoClientArea

urlmon

URLDownloadToFileA

winhttp

WinHttpSendRequest WinHttpOpenRequest WinHttpQueryHeaders WinHttpReadData WinHttpConnect WinHttpOpen WinHttpSetTimeouts WinHttpReceiveResponse WinHttpCloseHandle

ole32

CoInitializeEx CoUninitialize

ws2_32

recv accept bind closesocket connect ioctlsocket getsockname getsockopt htonl listen ntohs __WSAFDIsSet select send setsockopt shutdown socket WSAStartup WSAGetLastError getaddrinfo freeaddrinfo inet_ntop

kernel32

IsValidCodePage GetACP GetOEMCP SetFilePointerEx GetFileSizeEx GetConsoleMode GetCommandLineA FlushFileBuffers GetFileType EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW VirtualProtect FlsFree FlsSetValue FlsGetValue FlsAlloc HeapReAlloc GetStdHandle ExitProcess GetModuleHandleExW FreeLibraryAndExitThread ExitThread CreateThread LoadLibraryExW TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount SetLastError RtlUnwindEx RaiseException RtlPcToFileHeader GetCommandLineW GetEnvironmentStringsW ReadConsoleW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle HeapSize SetEndOfFile WriteConsoleW GetConsoleOutputCP GetSystemDirectoryW InitializeSListHead IsProcessorFeaturePresent GetStartupInfoW UnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext GetCPInfo GetStringTypeW LCMapStringEx DecodePointer EncodePointer GetSystemTimeAsFileTime DeleteCriticalSection InitializeCriticalSectionEx LeaveCriticalSection EnterCriticalSection GetFileInformationByHandleEx CopyFileW AreFileApisANSI SetFileInformationByHandle GetFinalPathNameByHandleW GetFileInformationByHandle GetFileAttributesExW FindFirstFileExW CreateFileW WakeAllConditionVariable SetEnvironmentVariableA CreateDirectoryA CreateFileA DeleteFileA FindClose FindFirstFileA FindNextFileA GetFileAttributesA GetFileAttributesW GetFileAttributesExA GetFileSize ReadFile WriteFile GetTempPathA GetVolumeInformationA OutputDebugStringA CloseHandle SetUnhandledExceptionFilter GetLastError SetErrorMode QueryPerformanceCounter SetEvent WaitForSingleObject CreateEventA CreateEventW Sleep WaitForMultipleObjects GetCurrentProcess GetCurrentProcessId TerminateProcess GetExitCodeProcess ResumeThread CreateProcessA OpenProcess GetTickCount GetTickCount64 GetSystemDirectoryA RtlUnwind GetWindowsDirectoryA FreeLibrary GetModuleFileNameA GetModuleFileNameW GetModuleHandleA LoadLibraryExA LocalFree MoveFileExA WideCharToMultiByte CreateToolhelp32Snapshot Process32FirstW Process32NextW GetEnvironmentVariableW CompareFileTime CreateDirectoryW DeleteFileW FindFirstFileW FindNextFileW GetProcessTimes CreateProcessW ReadProcessMemory GetModuleHandleW GetProcAddress QueryFullProcessImageNameW MoveFileExW GlobalAlloc GlobalUnlock GlobalLock GlobalFree MultiByteToWideChar QueryPerformanceFrequency LoadLibraryA GetLocaleInfoA HeapAlloc HeapFree GetProcessHeap InitializeProcThreadAttributeList DeleteProcThreadAttributeList UpdateProcThreadAttribute GetThreadContext SetThreadContext VirtualAllocEx VirtualProtectEx WriteProcessMemory GetExitCodeThread DebugSetProcessKillOnExit FormatMessageA GetLocaleInfoEx InitOnceBeginInitialize InitOnceComplete WaitForSingleObjectEx GetCurrentThreadId ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive SleepConditionVariableSRW

imm32

ImmReleaseContext ImmSetCandidateWindow ImmGetContext ImmSetCompositionWindow

d3dcompiler_47

D3DCompile

Name

.text

Size

943KB

Virtual Size

943KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

428KB

Virtual Size

427KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

6KB

Virtual Size

14KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

523KB

Virtual Size

523KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-11-06_f660d897732fb7d01121af50c978093c_icedid_luca-stealer_njrat_stealc

d3d11

wininet

shell32

advapi32

user32

gdi32

bcrypt

dwmapi

urlmon

winhttp

ole32

ws2_32

kernel32

imm32

d3dcompiler_47

generic