2026-11-09_56e4ea50d61b42bf74d871a99d3d47fb_icedid_luca-stealer_njrat_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-11-09_56e4ea50d61b42bf74d871a99d3d47fb_icedid_luca-stealer_njrat_stealc
Size 6.1MB
Sample261110-xxgzzaab78
SHA256 61d185a8564dba0eca10c37879b55be7534056fc777e7e158177b3efd4317dcd
MD5 56e4ea50d61b42bf74d871a99d3d47fb
SHA1 6c6fe8858acd28e60874bb793d1d321d024dddbb
SHA512 85f615df9aa6e4b7e74d5ea5779671ed5f7a411b2bcbae51fcb9838f330640ac1ae7a8729b287270b18d7b0133d70509c70fbc3faf63fcc3b124228a54706020
SSDEEP 196608:+V6J/Cua8b1q7XaRxTmMaKaNDV6J/Cua8b1q7XaRxTmMaKaN:+QRW8bULmxuxZQRW8bULmxux
TLSH
T190563355E3AA21FDE9A7DC3989471912D7337C974BA1EAEF03E497118E2F1500E3AB10
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Custom signature

Detects executables Discord URL observed in first stage droppers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_DiscordURL

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-11-09_56e4ea50d61b42bf74d871a99d3d47fb_icedid_luca-stealer_njrat_stealc

File Explorer

2026-11-09_56e4ea50d61b42bf74d871a99d3d47fb_icedid_luca-stealer_njrat_stealc

.exe 6.1MB

2026-11-09_56e4ea50d61b42bf74d871a99d3d47fb_icedid_luca-stealer_njrat_stealc

IMPHASH 89574991c95037b9654445e5b158006e
SHA256 61d185a8564dba0eca10c37879b55be7534056fc777e7e158177b3efd4317dcd
MD5 56e4ea50d61b42bf74d871a99d3d47fb
SHA1 6c6fe8858acd28e60874bb793d1d321d024dddbb
SHA512 85f615df9aa6e4b7e74d5ea5779671ed5f7a411b2bcbae51fcb9838f330640ac1ae7a8729b287270b18d7b0133d70509c70fbc3faf63fcc3b124228a54706020
SSDEEP 196608:+V6J/Cua8b1q7XaRxTmMaKaNDV6J/Cua8b1q7XaRxTmMaKaN:+QRW8bULmxuxZQRW8bULmxux
TLSH
T190563355E3AA21FDE9A7DC3989471912D7337C974BA1EAEF03E497118E2F1500E3AB10
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects executables Discord URL observed in first stage droppers
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

69052

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

E:\KernelEVS_RAT\KernelEVS\KernelBoost\x64\Release\KernelBoost.pdb

kernel32

HeapSize GetProcessHeap SetStdHandle SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP GetACP IsValidCodePage WriteConsoleW HeapReAlloc ReadConsoleW ReadFile CreateProcessW GetExitCodeProcess WaitForSingleObject EnumSystemLocalesW GetUserDefaultLCID IsValidLocale SetEndOfFile GlobalUnlock WinExec GetModuleHandleW ExitProcess GlobalLock SetFileAttributesA CloseHandle GlobalAlloc DeleteFileA CopyFileA CreateFileA Sleep GetDriveTypeA WriteFile GetCurrentProcess GetLogicalDrives GetModuleFileNameA GetLocaleInfoW LCMapStringW CompareStringW VirtualProtect FlsFree FlsSetValue FlsGetValue FlsAlloc GetConsoleMode GetConsoleOutputCP FlushFileBuffers HeapAlloc HeapFree GetFileType SetFilePointerEx GetFileSizeEx GetModuleFileNameW GetStdHandle GetModuleHandleExW FreeLibraryAndExitThread ExitThread CreateThread LocalFree FormatMessageA GetLocaleInfoEx CreateFileW FindClose FindFirstFileW FindFirstFileExW FindNextFileW GetFileAttributesExW SetFileInformationByHandle AreFileApisANSI GetLastError GetProcAddress GetFileInformationByHandleEx MultiByteToWideChar WideCharToMultiByte GetCurrentThreadId EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer LCMapStringEx ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive WakeAllConditionVariable QueryPerformanceCounter GetSystemTimeAsFileTime GetStringTypeW GetCPInfo GetCurrentProcessId InitializeSListHead RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent TerminateProcess RtlUnwindEx RtlPcToFileHeader RaiseException SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW RtlUnwind

user32

CallNextHookEx CreateWindowExW FillRect MessageBoxW DefWindowProcW ShowWindow EndPaint BeginPaint InvalidateRect PostQuitMessage DrawTextW FindWindowW TranslateMessage SetFocus UnhookWindowsHookEx BlockInput FrameRect RegisterClassW SetWindowsHookExA DispatchMessageW GetAsyncKeyState GetMessageW GetSystemMetrics

gdi32

BitBlt CreateCompatibleBitmap SelectObject CreateCompatibleDC CreateFontW GetStockObject DeleteDC SetTextColor SetBkMode DeleteObject CreateSolidBrush

advapi32

RegSetValueExA OpenProcessToken RegOpenKeyExA RegDeleteValueA GetTokenInformation RegCloseKey

shell32

ShellExecuteA

ole32

CreateStreamOnHGlobal

gdiplus

GdipLoadImageFromStream GdipDeleteGraphics GdipCreateFromHDC GdipFree GdipSetSmoothingMode GdiplusStartup GdipDrawImageRectI GdipAlloc GdipCloneImage GdiplusShutdown GdipDisposeImage

winhttp

WinHttpReceiveResponse WinHttpConnect WinHttpSendRequest WinHttpCloseHandle WinHttpOpenRequest WinHttpOpen WinHttpCrackUrl

ws2_32

gethostname

Name

.text

Size

212KB

Virtual Size

211KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

3.0MB

Virtual Size

3.0MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

12KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

2.9MB

Virtual Size

2.9MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-11-09_56e4ea50d61b42bf74d871a99d3d47fb_icedid_luca-stealer_njrat_stealc

kernel32

user32

gdi32

advapi32

shell32

ole32

gdiplus

winhttp

ws2_32

generic