2026-09-30_e465eadcfb0359eee7b593b188ebe60b_icedid_luca-stealer_njrat
Signed malware with C2 and persistence
Authenticode chain CN: Microsoft Windows PublisherCert chain has only 2 entries
SHA-256cca89fb5e1ee57015525b0a78b18392eae5f84ca10cf1c0eca0f81ca4f8848a5
Evidence
⋯3 more rows
0x3f000000000000000000000000000000000................
0x4004055565741544156488dac2410f7ffff@UVWATAVH..$....
0x4104881ecf0090000488b05e20f02004833H......H......H3
0x420c4488985d0080000448bf2488bf1488d.H......D..H..H.
⋯5 more rows
0x480000041b8040100004488a58c00000048..A.....D......H
0x4908d8d80000000ffd0ffc80f57c00f1185...........W....
0x4a0800000003dc70000007612488b474048....=....v.H.G@H
0x4b08d9590000000b904010000ffd0488d8d.............H..
⋯26 more rows
⋯3 more rows
0xed54000660f1f840000000000418b0241b8@.f........A..A.
0xee5051500004903c30fb60884c9741c0fb6....I.......t...
⋯7 more rows
⋯3 more rows
0x2a3300eb6b4d8bbcf7f885010033d2498bcf..kM.......3.I..
0x2a4341b800080000ff15993a0100488bd848A........:..H..H
0x2a5385c0757eff152b3a010083f857752d44..u~..+:....Wu-D
0x2a638d4307498bcf488d1538500100e87b55.C.I..H..8P...{U
⋯7 more rows
⋯6 more rows
0x161303d256c75290000005b44365d204c6175=%lu)...[D6] Lau
0x161406e6368696e6720776974682043524541nching with CREA
0x1615054455f4e4f5f57494e444f5700000000TE_NO_WINDOW....
0x161605b44375d2043726561746550726f6365[D7] CreateProce
0x161707373413a20726573756c743d25642047ssA: result=%d G
0x161804c453d256c75205049443d256c750000LE=%lu PID=%lu..
⋯3 more rows
0x161c06f6e6520557064617465205461736b00one Update Task.
0x161d07363687461736b732e657865202f6372schtasks.exe /cr
0x161e065617465202f746e2022257322202f74eate /tn "%s" /t
0x161f0722022257322202f7363206f6e6c6f67r "%s" /sc onlog
0x162006f6e202f726c206c696d69746564202fon /rl limited /
0x1621066000000000000005b50325d20736368f.......[P2] sch
0x162207461736b733a20726573756c743d2564tasks: result=%d
⋯7 more rows
0x16fd060656820766563746f7220636f707920`eh vector copy
0x16fe0636f6e7374727563746f722069746572constructor iter
0x16ff061746f72270000006065682076656374ator'...`eh vect
0x170006f7220766261736520636f707920636for vbase copy co
0x170106e7374727563746f7220697465726174nstructor iterat
0x170206f722700000000006064796e616d6963or'.....`dynamic
0x1703020696e697469616c697a657220666f72 initializer for
0x1704020270000000000006064796e616d6963 '......`dynamic
0x1705020617465786974206465737472756374 atexit destruct
0x170606f7220666f7220270000000000000000or for '........
0x1707060766563746f7220636f707920636f6e`vector copy con
0x170807374727563746f72206974657261746fstructor iterato
0x17090722700000000000060766563746f7220r'......`vector
⋯7 more rows
0x1711072642700000000006f70657261746f72rd'.....operator
0x1712020222220000000006f70657261746f72 "" ....operator
0x1713020636f5f617761697400000000000000 co_await.......
0x171406f70657261746f723c3d3e0000000000operator<=>.....
0x1715020547970652044657363726970746f72 Type Descriptor
0x171602700000000000000204261736520436c'....... Base Cl
0x171706173732044657363726970746f722061ass Descriptor a
⋯3 more rows
0x171b02044657363726970746f722700000000 Descriptor'....
0x171c020436f6d706c657465204f626a656374 Complete Object
0x171d0204c6f6361746f722700000000000000 Locator'.......
0x171e060616e6f6e796d6f7573206e616d6573`anonymous names
0x171f070616365270000001086014001000000pace'......@....
0x1720050860140010000009086014001000000P..@.......@....
0x172106100700069002d006d0073002d007700a.p.i.-.m.s.-.w.
0x1722069006e002d0063006f00720065002d00i.n.-.c.o.r.e.-.
0x172306600690062006500720073002d006c00f.i.b.e.r.s.-.l.
0x1724031002d0031002d0031000000000000001.-.1.-.1.......
0x172506100700069002d006d0073002d007700a.p.i.-.m.s.-.w.
0x1726069006e002d0063006f00720065002d00i.n.-.c.o.r.e.-.
0x17270730079006e00630068002d006c003100s.y.n.c.h.-.l.1.
0x172802d0032002d0030000000000000000000-.2.-.0.........
0x172906b00650072006e0065006c0033003200k.e.r.n.e.l.3.2.
0x172a000000000000000006100700069002d00........a.p.i.-.
0x172b06d0073002d0000000000000002000000m.s.-...........
0x172c0466c73416c6c6f630000000000000000FlsAlloc........