2026-04-16_6b86184ce15d8c61785fb6a1df1f22a5_amadey_icedid_luca-stealer_njrat_vidar

General

Target
2026-04-16_6b86184ce15d8c61785fb6a1df1f22a5_amadey_icedid_luca-stealer_njrat_vidar
Size 2.5MB
Sample260416-vbld6aav8x
SHA256 4e7b06c2487e70da631210307ccad1381cc503dd9e782223c27eca130c1285b9
MD5 6b86184ce15d8c61785fb6a1df1f22a5
SHA1 bd0eb2df932ca85a66231186addb095c28ede2ff
SHA512 4c7228d8ae8ac1262dfd8b2a461d8e1a2069e5febf995957f7490c374dbf49373baa9c1f08677845141ae60af19f35a21cef85efc1e03b431eea2933a1029866
SSDEEP 49152:+/ev6snJyO7U+hfyZAW2ROQcverO04TLcK:QGyOhH4TLcK
TLSH
T1A5C53D1226DC38B8F0B20631973592996B39FCA9AA03DE4F11907D9D77F2641FD29732
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects executables manipulated with Fody 1 IoCs

resource	yara_rule
sample	INDICATOR_EXE_Packed_Fody

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-04-16_6b86184ce15d8c61785fb6a1df1f22a5_amadey_icedid_luca-stealer_njrat_vidar

File Explorer

2026-04-16_6b86184ce15d8c61785fb6a1df1f22a5_amadey_icedid_luca-stealer_njrat_vidar

.exe 2.5MB

2026-04-16_6b86184ce15d8c61785fb6a1df1f22a5_amadey_icedid_luca-stealer_njrat_vidar

IMPHASH 132e825e554e7b8d464d7812f8fb426a
SHA256 4e7b06c2487e70da631210307ccad1381cc503dd9e782223c27eca130c1285b9
MD5 6b86184ce15d8c61785fb6a1df1f22a5
SHA1 bd0eb2df932ca85a66231186addb095c28ede2ff
SHA512 4c7228d8ae8ac1262dfd8b2a461d8e1a2069e5febf995957f7490c374dbf49373baa9c1f08677845141ae60af19f35a21cef85efc1e03b431eea2933a1029866
SSDEEP 49152:+/ev6snJyO7U+hfyZAW2ROQcverO04TLcK:QGyOhH4TLcK
TLSH
T1A5C53D1226DC38B8F0B20631973592996B39FCA9AA03DE4F11907D9D77F2641FD29732
MD5 SHA1 SHA512 SSDEEP TLSH

Detects executables manipulated with Fody
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

2

Major OS version

5

Entry point

14024

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\Vinay\Projects\simple_launcher\dist\t64.pdb

kernel32

ExitProcess GetCommandLineW SearchPathW SetInformationJobObject CreateProcessW GetCurrentProcess WaitForSingleObject GenerateConsoleCtrlEvent AssignProcessToJobObject FormatMessageW GetExitCodeProcess GetModuleFileNameW QueryInformationJobObject MultiByteToWideChar CreateJobObjectA GetStdHandle GetLastError SetConsoleCtrlHandler DuplicateHandle CloseHandle HeapSize GetProcessHeap SetEndOfFile SetEnvironmentVariableW HeapFree HeapAlloc EnterCriticalSection LeaveCriticalSection GetStringTypeW GetCommandLineA TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext RtlUnwindEx InitializeCriticalSectionAndSpinCount EncodePointer DecodePointer HeapSetInformation GetVersion HeapCreate GetCPInfo GetACP GetOEMCP IsValidCodePage FlsGetValue FlsSetValue FlsFree SetLastError GetCurrentThreadId FlsAlloc GetProcAddress GetModuleHandleW WriteFile SetHandleCount GetFileType GetStartupInfoW DeleteCriticalSection Sleep LCMapStringW ReadFile SetFilePointer FreeEnvironmentStringsW GetEnvironmentStringsW GetModuleFileNameA WideCharToMultiByte QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime CreateFileW LoadLibraryW HeapReAlloc GetConsoleCP GetConsoleMode FlushFileBuffers SetStdHandle CompareStringW WriteConsoleW

shlwapi

StrStrIW PathRemoveFileSpecW PathCombineW

Sharing

General

Malware Config

Signatures

File Explorer

2026-04-16_6b86184ce15d8c61785fb6a1df1f22a5_amadey_icedid_luca-stealer_njrat_vidar

kernel32

shlwapi

generic