2026-11-10_f065654707e54a87bdcd51dac8731810_icedid_luca-stealer_njrat_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-11-10_f065654707e54a87bdcd51dac8731810_icedid_luca-stealer_njrat_stealc
Size 1.3MB
Sample261110-a2skyaxtbt
SHA256 189783b3b3a79e4174d71f09838ec3f201fac343be076b7011670647f8fdbf07
MD5 f065654707e54a87bdcd51dac8731810
SHA1 e2d32d4ada130409b27f2b233a8948381d9fb2c7
SHA512 8ebb207b4c3ac2b7e43cba64967f0ff4dcf6a8d36c6afaf87dc7c8d299d73ad6d49f33869cb46d2f69c7ea54c83be79e00dbdbfe3d56940dfb93189f0d5d36f7
SSDEEP 24576:RPVnmTrQMNrG4i/MSWhsgt9bSAW0VzTTQAek:RPVnCrdrzPfHP/a
TLSH
T16F558E29974102B9D4B6C1BDCE538591E2767C5D4BB24ACF0BA4BAA12E335D48E3F313
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-11-10_f065654707e54a87bdcd51dac8731810_icedid_luca-stealer_njrat_stealc

File Explorer

2026-11-10_f065654707e54a87bdcd51dac8731810_icedid_luca-stealer_njrat_stealc

.exe 1.3MB

2026-11-10_f065654707e54a87bdcd51dac8731810_icedid_luca-stealer_njrat_stealc

IMPHASH a36d267736db2f4e00ccbf083d31070c
SHA256 189783b3b3a79e4174d71f09838ec3f201fac343be076b7011670647f8fdbf07
MD5 f065654707e54a87bdcd51dac8731810
SHA1 e2d32d4ada130409b27f2b233a8948381d9fb2c7
SHA512 8ebb207b4c3ac2b7e43cba64967f0ff4dcf6a8d36c6afaf87dc7c8d299d73ad6d49f33869cb46d2f69c7ea54c83be79e00dbdbfe3d56940dfb93189f0d5d36f7
SSDEEP 24576:RPVnmTrQMNrG4i/MSWhsgt9bSAW0VzTTQAek:RPVnCrdrzPfHP/a
TLSH
T16F558E29974102B9D4B6C1BDCE538591E2767C5D4BB24ACF0BA4BAA12E335D48E3F313
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1376256

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

ws2_32

socket setsockopt send WSAStartup inet_ntop inet_pton FreeAddrInfoW recv ntohl listen accept htons getpeername closesocket bind GetAddrInfoW

winhttp

WinHttpReceiveResponse WinHttpSetOption WinHttpSetTimeouts WinHttpOpenRequest WinHttpSendRequest WinHttpQueryHeaders WinHttpQueryDataAvailable WinHttpAddRequestHeaders WinHttpReadData WinHttpConnect WinHttpCloseHandle WinHttpOpen WinHttpQueryOption

user32

TranslateMessage DispatchMessageW ExitWindowsEx SendMessageW SendMessageTimeoutW SendNotifyMessageW PostMessageW PostThreadMessageW DefWindowProcW PostQuitMessage RegisterClassExW CreateWindowExW ShowWindow SetWindowPos GetWindowPlacement IsWindowVisible OpenClipboard CloseClipboard SetClipboardData EmptyClipboard GetMessageW RegisterWindowMessageW GetSystemMetrics ReleaseCapture UpdateWindow SetForegroundWindow LoadImageW LoadIconW LoadCursorW UnhookWindowsHookEx SetWindowsHookExW GetWindowThreadProcessId GetClassNameW EnumWindows FindWindowW SetWindowLongW GetWindowLongW FillRect ScreenToClient MessageBoxW GetWindowRect GetClientRect GetWindowTextW SetWindowRgn

shell32

ShellExecuteW ShellExecuteExW SHGetFolderPathW SHChangeNotify

advapi32

QueryServiceStatus AdjustTokenPrivileges GetTokenInformation LookupPrivilegeValueA LookupPrivilegeValueW RegCloseKey GetSidSubAuthority GetSidSubAuthorityCount RegGetValueW EventUnregister EventWriteTransfer EventSetInformation EventRegister SetNamedSecurityInfoW SetEntriesInAclW ConvertStringSecurityDescriptorToSecurityDescriptorW ConvertStringSidToSidW StartServiceW QueryServiceStatusEx OpenProcessToken OpenServiceW OpenServiceA OpenSCManagerW OpenSCManagerA ControlService CloseServiceHandle RevertToSelf ImpersonateNamedPipeClient RegSetValueExW RegQueryValueExW RegOpenKeyExW RegCreateKeyExW

ole32

CoTaskMemFree CoTaskMemAlloc CoInitializeEx

gdi32

CreateSolidBrush

bcrypt

BCryptCloseAlgorithmProvider BCryptImportKeyPair BCryptGetProperty BCryptCreateHash BCryptDestroyKey BCryptGenRandom BCryptDestroyHash BCryptFinishHash BCryptHashData BCryptVerifySignature BCryptOpenAlgorithmProvider

dwmapi

DwmExtendFrameIntoClientArea DwmSetWindowAttribute DwmEnableBlurBehindWindow

crypt32

CertCloseStore CryptQueryObject CryptProtectData CryptUnprotectData CryptMsgClose

wintrust

WinVerifyTrust

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

kernel32

ExitThread TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount RtlUnwindEx RaiseException RtlPcToFileHeader InitializeSListHead GetCurrentProcessId GetStartupInfoW IsProcessorFeaturePresent UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext GetStringTypeW LCMapStringEx GetCPInfo CompareStringEx DecodePointer EncodePointer ExitProcess FreeLibraryAndExitThread GetStdHandle HeapAlloc GetFileType FlsAlloc FlsGetValue FlsSetValue FlsFree VirtualProtect GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetTimeZoneInformation GetConsoleOutputCP GetConsoleMode SetFilePointerEx ReadConsoleW HeapReAlloc FindFirstFileExW IsValidCodePage GetACP GetOEMCP GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW DeleteCriticalSection GetModuleHandleExW InitializeCriticalSectionEx LeaveCriticalSection EnterCriticalSection WakeAllConditionVariable SleepConditionVariableSRW QueryPerformanceFrequency TryAcquireSRWLockExclusive AcquireSRWLockExclusive ReleaseSRWLockExclusive SetStdHandle HeapSize WriteConsoleW SetEndOfFile SetUnhandledExceptionFilter GetCurrentThreadId LocalAlloc HeapFree GetProcessHeap GetEnvironmentVariableW SearchPathW CreateDirectoryW CreateFileW DeleteFileW FindClose FindFirstFileW FindNextFileW FlushFileBuffers GetFileAttributesW GetFileSizeEx GetFullPathNameW GetVolumeInformationW ReadFile RemoveDirectoryW SetFileAttributesW SetFilePointer WriteFile GetTempPathW IsDebuggerPresent CheckRemoteDebuggerPresent CloseHandle RtlUnwind GetLastError SetLastError QueryPerformanceCounter SetEvent ReleaseMutex WaitForSingleObject CreateMutexW CreateEventW Sleep GetCurrentProcess GetExitCodeProcess CreateThread CreateProcessW GetSystemTimeAsFileTime GetLocalTime GetTickCount GetTickCount64 GetSystemDirectoryW GetSystemWow64DirectoryW FreeLibrary GetModuleFileNameW GetModuleHandleW GetProcAddress LoadLibraryExW LoadLibraryW GlobalAlloc GlobalUnlock GlobalLock LocalFree lstrcpynW CopyFileW MoveFileExW GetComputerNameW MultiByteToWideChar WideCharToMultiByte CreateToolhelp32Snapshot Process32FirstW Process32NextW Thread32First Thread32Next Module32FirstW Module32NextW SetEnvironmentVariableW DeleteFileA GetFileAttributesExW ConnectNamedPipe CreateNamedPipeW CancelIoEx CreateMutexA TerminateProcess OpenProcess GetSystemInfo VirtualQueryEx ReadProcessMemory GetModuleFileNameA OpenMutexA CreateFileMappingA OpenFileMappingA SetComputerNameExW OutputDebugStringA OutputDebugStringW

Name

.text

Size

656KB

Virtual Size

656KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

296KB

Virtual Size

296KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

17KB

Virtual Size

30KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

26KB

Virtual Size

26KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

308KB

Virtual Size

308KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

41KB

Virtual Size

92KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-11-10_f065654707e54a87bdcd51dac8731810_icedid_luca-stealer_njrat_stealc

ws2_32

winhttp

user32

shell32

advapi32

ole32

gdi32

bcrypt

dwmapi

crypt32

wintrust

version

kernel32

generic