2026-11-12_480aa15620804340780af64ab4d30d25_icedid_luca-stealer_njrat_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-11-12_480aa15620804340780af64ab4d30d25_icedid_luca-stealer_njrat_stealc
Size 5.1MB
Sample261113-ekth5aft91
SHA256 c2d03641a84ca96bc3ec4cbb78a704f74c9cd1516aa877b68d485eb76429b33d
MD5 480aa15620804340780af64ab4d30d25
SHA1 ab971cdb3bc1d438b4f3db34a0aa930f4a338371
SHA512 1636dd98bcaa8dfb618629b8ecf2f27902880017b1955f611a88eeb4ce704e8a9f81434fd9c2869c5ef12a878f3f985ea9adb2e461034870a9a1121003fd1ea4
SSDEEP 49152:XKANKwTwuJWbe48ozlTZOBQNJ/9K23eMK2YXzKu71tWqpgsP0cDOnb2gT:6OKkmHreqJFK231PYjKktWbsP0cD62W
TLSH
T1F346330577F871E6E12242B88AD14216EBB1B4222364DB5F43F046F6BE27691DD7FB20
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-11-12_480aa15620804340780af64ab4d30d25_icedid_luca-stealer_njrat_stealc

File Explorer

2026-11-12_480aa15620804340780af64ab4d30d25_icedid_luca-stealer_njrat_stealc

.exe 5.1MB

2026-11-12_480aa15620804340780af64ab4d30d25_icedid_luca-stealer_njrat_stealc

IMPHASH 546da44d4237b5ddc4360a5e3487a71d
SHA256 c2d03641a84ca96bc3ec4cbb78a704f74c9cd1516aa877b68d485eb76429b33d
MD5 480aa15620804340780af64ab4d30d25
SHA1 ab971cdb3bc1d438b4f3db34a0aa930f4a338371
SHA512 1636dd98bcaa8dfb618629b8ecf2f27902880017b1955f611a88eeb4ce704e8a9f81434fd9c2869c5ef12a878f3f985ea9adb2e461034870a9a1121003fd1ea4
SSDEEP 49152:XKANKwTwuJWbe48ozlTZOBQNJ/9K23eMK2YXzKu71tWqpgsP0cDOnb2gT:6OKkmHreqJFK231PYjKktWbsP0cD62W
TLSH
T1F346330577F871E6E12242B88AD14216EBB1B4222364DB5F43F046F6BE27691DD7FB20
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

25048

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

CloseHandle GetConsoleMode CreateFileW FlushFileBuffers HeapReAlloc HeapSize SetFilePointerEx WriteConsoleW MulDiv GetVersion GetTickCount GetLocalTime GetSystemTimeAsFileTime GetSystemInfo GetCurrentThreadId QueryPerformanceCounter GetEnvironmentVariableW GetConsoleOutputCP Sleep GetProcessHeap LCMapStringW CompareStringW FlsFree FlsSetValue FlsGetValue FlsAlloc GetStringTypeW GetCurrentProcessId InitializeSListHead RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent GetModuleHandleW RtlUnwindEx RtlPcToFileHeader RaiseException GetLastError SetLastError EncodePointer EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary GetProcAddress LoadLibraryExW GetCurrentProcess TerminateProcess GetStdHandle WriteFile GetModuleFileNameW ExitProcess GetModuleHandleExW GetCommandLineA GetCommandLineW HeapFree HeapAlloc GetFileType FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle

user32

FindWindowW MessageBoxW GetWindowTextLengthW GetDoubleClickTime GetSystemMetrics IsWindowVisible GetForegroundWindow

gdi32

DeleteObject CreateFontW GetDeviceCaps

advapi32

RegOpenKeyExW RegEnumKeyExW RegDeleteValueW RegCreateKeyExW RegCloseKey GetUserNameW RegQueryValueExW

ole32

CoInitializeEx CLSIDFromString CoTaskMemAlloc CoTaskMemFree CoCreateInstance CoUninitialize

shlwapi

PathIsDirectoryW StrStrW PathCombineW PathFileExistsW PathRemoveFileSpecW

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

Name

.00cfg

Size

106KB

Virtual Size

105KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.gehcont

Size

49KB

Virtual Size

49KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.didat

Size

3KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.debug

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.sxdata

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.idata

Size

5.0MB

Virtual Size

5.0MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1024B

Virtual Size

872B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-11-12_480aa15620804340780af64ab4d30d25_icedid_luca-stealer_njrat_stealc

kernel32

user32

gdi32

advapi32

ole32

shlwapi

version

generic