2026-11-11_5d125de3d2c5d6bf7ac1ad0e57973f10_icedid_luca-stealer_njrat_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-11-11_5d125de3d2c5d6bf7ac1ad0e57973f10_icedid_luca-stealer_njrat_stealc
Size 1.9MB
Sample261113-nslypaa13q
SHA256 432cbf44c61ff2ee70627675a218de14fb039f0169ad43cf901b7a9b24562cce
MD5 5d125de3d2c5d6bf7ac1ad0e57973f10
SHA1 7a24228765f0c01975a703000efeb085fbc905ba
SHA512 35b2da27452b5be34fda9cd5b98184697968700d1d188687f692b3f3c526483af0388d0aec4295ae42753238d1e763023efa11c96bb8c564d86bb91354800145
SSDEEP 49152:/5PhGoAPATw+6Lry3fBDnTrtTQ8dyQ42BwvAG:/5hfHBd54G0
TLSH
T13895BEAFA3B54298D056E6B88983A827F77238651378FBDB53C04D611F267E00B77721
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-11-11_5d125de3d2c5d6bf7ac1ad0e57973f10_icedid_luca-stealer_njrat_stealc

File Explorer

2026-11-11_5d125de3d2c5d6bf7ac1ad0e57973f10_icedid_luca-stealer_njrat_stealc

.exe 1.9MB

2026-11-11_5d125de3d2c5d6bf7ac1ad0e57973f10_icedid_luca-stealer_njrat_stealc

IMPHASH af0751ace720ceab2238177780be54c7
SHA256 432cbf44c61ff2ee70627675a218de14fb039f0169ad43cf901b7a9b24562cce
MD5 5d125de3d2c5d6bf7ac1ad0e57973f10
SHA1 7a24228765f0c01975a703000efeb085fbc905ba
SHA512 35b2da27452b5be34fda9cd5b98184697968700d1d188687f692b3f3c526483af0388d0aec4295ae42753238d1e763023efa11c96bb8c564d86bb91354800145
SSDEEP 49152:/5PhGoAPATw+6Lry3fBDnTrtTQ8dyQ42BwvAG:/5hfHBd54G0
TLSH
T13895BEAFA3B54298D056E6B88983A827F77238651378FBDB53C04D611F267E00B77721
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

749596

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

d3d11

D3D11CreateDeviceAndSwapChain

wininet

InternetOpenUrlA InternetReadFile InternetSetOptionA HttpOpenRequestA HttpSendRequestA HttpQueryInfoA InternetOpenA InternetConnectA InternetCloseHandle

shell32

ShellExecuteA SHGetFolderPathA

advapi32

GetTokenInformation RegQueryValueExW RegOpenKeyExW RegDeleteValueW RegCreateKeyExW RegCloseKey CryptDestroyHash CryptHashData CryptCreateHash CryptGetHashParam CryptDestroyKey CryptReleaseContext SetSecurityDescriptorDacl SetKernelObjectSecurity InitializeSecurityDescriptor InitializeAcl OpenProcessToken AllocateAndInitializeSid CheckTokenMembership FreeSid RegSetValueExW GetUserNameA CloseServiceHandle OpenSCManagerW OpenServiceW QueryServiceStatus ConvertSidToStringSidA CryptAcquireContextA

user32

SetWindowPos SetCapture ReleaseCapture GetSystemMetrics UpdateWindow SetWindowRgn SetWindowTextA GetClientRect GetWindowRect MessageBoxA GetCursorPos OpenClipboard CloseClipboard SetClipboardData GetClipboardData EmptyClipboard GetKeyboardLayout TrackMouseEvent GetMessageExtraInfo ShowWindow GetCapture IsWindowUnicode GetForegroundWindow SetCursorPos SetCursor ClientToScreen ScreenToClient LoadCursorA UnregisterClassA PostQuitMessage DestroyWindow DefWindowProcA PostMessageA PeekMessageA DispatchMessageA TranslateMessage wsprintfW CreateWindowExA GetKeyState wsprintfA RegisterClassExA

gdi32

CreateRoundRectRgn

bcrypt

BCryptOpenAlgorithmProvider BCryptCloseAlgorithmProvider BCryptCreateHash BCryptHashData BCryptFinishHash BCryptDestroyHash BCryptGenRandom BCryptSetProperty BCryptGenerateSymmetricKey BCryptDecrypt BCryptDestroyKey

dwmapi

DwmSetWindowAttribute DwmExtendFrameIntoClientArea

urlmon

URLDownloadToFileA

winhttp

WinHttpSendRequest WinHttpOpenRequest WinHttpQueryHeaders WinHttpReadData WinHttpConnect WinHttpOpen WinHttpSetTimeouts WinHttpReceiveResponse WinHttpCloseHandle

ole32

CoInitializeEx CoUninitialize

ws2_32

recv accept bind closesocket connect ioctlsocket getsockname getsockopt htonl listen ntohs __WSAFDIsSet select send setsockopt shutdown socket WSAStartup WSAGetLastError getaddrinfo freeaddrinfo inet_ntop

kernel32

IsValidCodePage GetACP GetOEMCP SetFilePointerEx GetFileSizeEx GetConsoleMode GetCommandLineA FlushFileBuffers GetFileType EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW VirtualProtect FlsFree FlsSetValue FlsGetValue FlsAlloc HeapReAlloc GetStdHandle ExitProcess GetModuleHandleExW FreeLibraryAndExitThread ExitThread CreateThread LoadLibraryExW TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount SetLastError RtlUnwindEx RaiseException RtlPcToFileHeader GetCommandLineW GetEnvironmentStringsW ReadConsoleW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle HeapSize SetEndOfFile WriteConsoleW GetConsoleOutputCP GetSystemDirectoryW InitializeSListHead IsProcessorFeaturePresent GetStartupInfoW UnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext GetCPInfo GetStringTypeW LCMapStringEx DecodePointer EncodePointer GetSystemTimeAsFileTime DeleteCriticalSection InitializeCriticalSectionEx LeaveCriticalSection EnterCriticalSection GetFileInformationByHandleEx CopyFileW AreFileApisANSI SetFileInformationByHandle GetFinalPathNameByHandleW GetFileInformationByHandle GetFileAttributesExW FindFirstFileExW CreateFileW WakeAllConditionVariable SetEnvironmentVariableA CreateDirectoryA CreateFileA DeleteFileA FindClose FindFirstFileA FindNextFileA GetFileAttributesA GetFileAttributesW GetFileAttributesExA GetFileSize ReadFile WriteFile GetTempPathA GetVolumeInformationA OutputDebugStringA CloseHandle SetUnhandledExceptionFilter GetLastError SetErrorMode QueryPerformanceCounter SetEvent WaitForSingleObject CreateEventA CreateEventW Sleep WaitForMultipleObjects GetCurrentProcess GetCurrentProcessId TerminateProcess GetExitCodeProcess ResumeThread CreateProcessA OpenProcess GetTickCount GetTickCount64 GetSystemDirectoryA RtlUnwind GetWindowsDirectoryA FreeLibrary GetModuleFileNameA GetModuleFileNameW GetModuleHandleA LoadLibraryExA LocalFree MoveFileExA WideCharToMultiByte CreateToolhelp32Snapshot Process32FirstW Process32NextW GetEnvironmentVariableW CompareFileTime CreateDirectoryW DeleteFileW FindFirstFileW FindNextFileW GetProcessTimes CreateProcessW ReadProcessMemory GetModuleHandleW GetProcAddress QueryFullProcessImageNameW MoveFileExW GlobalAlloc GlobalUnlock GlobalLock GlobalFree MultiByteToWideChar QueryPerformanceFrequency LoadLibraryA GetLocaleInfoA HeapAlloc HeapFree GetProcessHeap InitializeProcThreadAttributeList DeleteProcThreadAttributeList UpdateProcThreadAttribute GetThreadContext SetThreadContext VirtualAllocEx VirtualProtectEx WriteProcessMemory GetExitCodeThread DebugSetProcessKillOnExit FormatMessageA GetLocaleInfoEx InitOnceBeginInitialize InitOnceComplete WaitForSingleObjectEx GetCurrentThreadId ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive SleepConditionVariableSRW

imm32

ImmReleaseContext ImmSetCandidateWindow ImmGetContext ImmSetCompositionWindow

d3dcompiler_47

D3DCompile

Name

.text

Size

944KB

Virtual Size

943KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

483KB

Virtual Size

483KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

6KB

Virtual Size

14KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

523KB

Virtual Size

523KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-11-11_5d125de3d2c5d6bf7ac1ad0e57973f10_icedid_luca-stealer_njrat_stealc

d3d11

wininet

shell32

advapi32

user32

gdi32

bcrypt

dwmapi

urlmon

winhttp

ole32

ws2_32

kernel32

imm32

d3dcompiler_47

generic