2026-11-13_2e820f0b6ca1dd282017f415fcec3f6e_icedid_luca-stealer_njrat_stealc

General

Target
2026-11-13_2e820f0b6ca1dd282017f415fcec3f6e_icedid_luca-stealer_njrat_stealc
Size 4.1MB
Sample261114-vba87afv2m
SHA256 6d5daea97acf82f1f388271e08403d1400faee4273033f280232e480c4b31a2c
MD5 2e820f0b6ca1dd282017f415fcec3f6e
SHA1 375075a0de8f0dd80f72ad19ac18caebc7aa8777
SHA512 ab83790f9932e2b5b77e734708966bc2f57555c0cddb0b729d80e8552a95f27252a74dc0bf7daa18063b50645ff5e3622be93d83e07d6d5d4f10ab3697c4f23c
SSDEEP 49152:z9cNEp1M3oN47m5YSSFYkOqOhlVt9256vPNU9z6Km1wfMIMAMNMoMkM:q7jeXLKu
TLSH
T1CF16BF5FA7A401E8D16BD078CF455943E7B2B41A03A1A7EF259086A70F776F40E3E722
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-11-13_2e820f0b6ca1dd282017f415fcec3f6e_icedid_luca-stealer_njrat_stealc

File Explorer

2026-11-13_2e820f0b6ca1dd282017f415fcec3f6e_icedid_luca-stealer_njrat_stealc

.exe 4.1MB

2026-11-13_2e820f0b6ca1dd282017f415fcec3f6e_icedid_luca-stealer_njrat_stealc

IMPHASH 977f5372a9ae20494e1be7c86dfef217
SHA256 6d5daea97acf82f1f388271e08403d1400faee4273033f280232e480c4b31a2c
MD5 2e820f0b6ca1dd282017f415fcec3f6e
SHA1 375075a0de8f0dd80f72ad19ac18caebc7aa8777
SHA512 ab83790f9932e2b5b77e734708966bc2f57555c0cddb0b729d80e8552a95f27252a74dc0bf7daa18063b50645ff5e3622be93d83e07d6d5d4f10ab3697c4f23c
SSDEEP 49152:z9cNEp1M3oN47m5YSSFYkOqOhlVt9256vPNU9z6Km1wfMIMAMNMoMkM:q7jeXLKu
TLSH
T1CF16BF5FA7A401E8D16BD078CF455943E7B2B41A03A1A7EF259086A70F776F40E3E722
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

4296192

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

WideCharToMultiByte EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer MultiByteToWideChar LCMapStringEx GetStringTypeW GetCPInfo ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW GetModuleHandleW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead RtlUnwindEx RtlPcToFileHeader RaiseException GetLastError SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary GetProcAddress LoadLibraryExW ExitProcess GetModuleHandleExW SetConsoleCtrlHandler GetModuleFileNameW GetStdHandle WriteFile GetCommandLineA GetCommandLineW HeapAlloc HeapFree GetFileType FlsAlloc FlsGetValue FlsSetValue FlsFree CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW SetStdHandle GetFileSizeEx SetFilePointerEx FlushFileBuffers GetConsoleOutputCP GetConsoleMode CloseHandle ReadFile ReadConsoleW HeapReAlloc FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetProcessHeap CreateFileW HeapSize WriteConsoleW RtlUnwind

Sharing

General

Malware Config

Signatures

File Explorer

2026-11-13_2e820f0b6ca1dd282017f415fcec3f6e_icedid_luca-stealer_njrat_stealc

kernel32

generic