2026-11-12_5a46b0e32e96ba021189363ee83f4aed_icedid_luca-stealer_njrat

General

Target
2026-11-12_5a46b0e32e96ba021189363ee83f4aed_icedid_luca-stealer_njrat
Size 1.4MB
Sample261113-cv98hsft3n
SHA256 07a4ca98c8525739a1ea54d4a8d612c2971d91ebc57284896a9bcd1338bbdba1
MD5 5a46b0e32e96ba021189363ee83f4aed
SHA1 b0b27f944c09e709f58d9f49fe94970eea981240
SHA512 605e8f19b4770361259e0c6cbcd15512775c58192867c9a3607619960d361ff51b4d9b260e54b73cf5e24cfcac749d7add651fb8ba410a9bde15f4bde4da7b63
SSDEEP 24576:97JVbIr44BR1IVOe4waHbTkEFhA+b3XYXKXjAOY5MBmYBREkM2eU25gooYHJLUY:Joj15e4w8xhACEKzs57Xci5NLd
TLSH
T1B365020BA6A401F9D5F3C174CC52590ADB76F84A47A4EB4F03E449961F276B09E3FB22
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
2026-11-12_5a46b0e32e96ba021189363ee83f4aed_icedid_luca-stealer_njrat

File Explorer

2026-11-12_5a46b0e32e96ba021189363ee83f4aed_icedid_luca-stealer_njrat

.exe 1.4MB

2026-11-12_5a46b0e32e96ba021189363ee83f4aed_icedid_luca-stealer_njrat

IMPHASH 7e266528ec985c53014ad02d5c6a12f4
SHA256 07a4ca98c8525739a1ea54d4a8d612c2971d91ebc57284896a9bcd1338bbdba1
MD5 5a46b0e32e96ba021189363ee83f4aed
SHA1 b0b27f944c09e709f58d9f49fe94970eea981240
SHA512 605e8f19b4770361259e0c6cbcd15512775c58192867c9a3607619960d361ff51b4d9b260e54b73cf5e24cfcac749d7add651fb8ba410a9bde15f4bde4da7b63
SSDEEP 24576:97JVbIr44BR1IVOe4waHbTkEFhA+b3XYXKXjAOY5MBmYBREkM2eU25gooYHJLUY:Joj15e4w8xhACEKzs57Xci5NLd
TLSH
T1B365020BA6A401F9D5F3C174CC52590ADB76F84A47A4EB4F03E449961F276B09E3FB22
MD5 SHA1 SHA512 SSDEEP TLSH

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

15:4e:75:4e:51:fb:15:6c:78:d3:2b:c7:92:be:53:4f:ce:c6:b9:d9:54:7a:0d:5b:1b:ff:97:4f:51:76:e7:de

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Adobe Systems Incorporated,O=Adobe Systems Incorporated,L=San Jose,ST=California,C=US

Chains

Nov 6, 2026

CN=Adobe Systems Incorporated,O=Adobe Systems Incorporated,L=San Jose,ST=California,C=US

CN=Adobe Root CA,O=Adobe Systems Incorporated,C=US

Minor OS version

0

Major OS version

6

Entry point

1264444

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

kernel32

RtlCaptureContext WriteConsoleW HeapSize SetStdHandle GetProcessHeap SetEnvironmentVariableW FreeEnvironmentStringsW GetConsoleScreenBufferInfo SetConsoleTextAttribute GetStdHandle Sleep CloseHandle WideCharToMultiByte SetConsoleOutputCP ExpandEnvironmentStringsW WaitForSingleObject ReadFile SetFilePointer CreateFileW GetLastError CreateProcessW WriteFile CreateNamedPipeW PeekNamedPipe GetCurrentThreadId GetCurrentProcessId GetTickCount ConnectNamedPipe GetModuleHandleW GetCurrentDirectoryW CreateDirectoryW FindClose FindFirstFileW FindFirstFileExW FindNextFileW GetFileAttributesExW AreFileApisANSI GetProcAddress GetFileInformationByHandleEx MultiByteToWideChar LocalFree FormatMessageA GetLocaleInfoEx EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer GetStringTypeW LCMapStringEx GetCPInfo RtlUnwind RtlLookupFunctionEntry RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent QueryPerformanceCounter GetSystemTimeAsFileTime InitializeSListHead GetCurrentProcess TerminateProcess GetEnvironmentStringsW RtlUnwindEx RtlPcToFileHeader RaiseException SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW ExitProcess GetModuleHandleExW GetModuleFileNameW GetCommandLineA GetCommandLineW HeapAlloc HeapFree GetFileType FlsAlloc FlsGetValue FlsSetValue FlsFree VirtualProtect CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW FlushFileBuffers GetConsoleOutputCP GetConsoleMode GetFileSizeEx SetFilePointerEx ReadConsoleW HeapReAlloc IsValidCodePage GetACP GetOEMCP

Name

.text

Size

1.4MB

Virtual Size

1.4MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

12KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-11-12_5a46b0e32e96ba021189363ee83f4aed_icedid_luca-stealer_njrat

PE Signature issue

version

kernel32

generic