2026-05-28_53affb6967d2fa43949d33ef60112c57_icedid_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-05-28_53affb6967d2fa43949d33ef60112c57_icedid_stealc
Size 18.1MB
Sample260528-1m1k4sdx21
SHA256 337bd621b499d1b3a1f14d6c63b40f1687b7f276669e32ebf975a50983ce96fe
MD5 53affb6967d2fa43949d33ef60112c57
SHA1 78ec9163124845eeeee4f7242165808c06146afc
SHA512 60805cafb5d2dd052296f2d63d493ef913b92288f0b548b3b8d5827819122aa8a2b22a20346eca1bc870f734d81e36002b70f0ca14f6a0baa8e837010683b51d
SSDEEP 49152:dch6iVfQrqdJAqB8YAWWzf6hNOeHq13yLJPPrmoCHnBy/PIcJHMv4xRVL8Qws0Wn:dCR
TLSH
T18A171B336107B077CE8140B6D26251934EBCB3691732A1F6B4AD824CB5EE4F857B7AB1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
2026-05-28_53affb6967d2fa43949d33ef60112c57_icedid_stealc

File Explorer

2026-05-28_53affb6967d2fa43949d33ef60112c57_icedid_stealc

.exe 18.1MB

2026-05-28_53affb6967d2fa43949d33ef60112c57_icedid_stealc

IMPHASH 34a58e868e8be0cc777f0d7231cbaa90
SHA256 337bd621b499d1b3a1f14d6c63b40f1687b7f276669e32ebf975a50983ce96fe
MD5 53affb6967d2fa43949d33ef60112c57
SHA1 78ec9163124845eeeee4f7242165808c06146afc
SHA512 60805cafb5d2dd052296f2d63d493ef913b92288f0b548b3b8d5827819122aa8a2b22a20346eca1bc870f734d81e36002b70f0ca14f6a0baa8e837010683b51d
SSDEEP 49152:dch6iVfQrqdJAqB8YAWWzf6hNOeHq13yLJPPrmoCHnBy/PIcJHMv4xRVL8Qws0Wn:dCR
TLSH
T18A171B336107B077CE8140B6D26251934EBCB3691732A1F6B4AD824CB5EE4F857B7AB1
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

94:4f:c5:31:85:3e:3d:09:57:79:bf:c8:0f:eb:fd:ef:9f:2c:f4:94:17:88:35:60:6a:67:a4:21:6d:47:5d:60

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Axion Works Group,OU=Field A6AFA05F,O=Axion Works Group,L=Atlanta,ST=Virginia,C=KR

Chains

May 27, 2026

CN=Axion Works Group,OU=Field A6AFA05F,O=Axion Works Group,L=Atlanta,ST=Virginia,C=KR

Subject

CN=Axion Works Group,OU=Field A6AFA05F,O=Axion Works Group,L=Atlanta,ST=Virginia,C=KR

Serial Number

36:a2:77:6f:15:34:b5:ae:45:2f:cd:ea:df:55:f6:9b

Issuer

CN=Axion Works Group,OU=Field A6AFA05F,O=Axion Works Group,L=Atlanta,ST=Virginia,C=KR

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

May 27, 2026 - May 27, 2031

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Minor OS version

Major OS version

Entry point

71540

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

GetWindowsDirectoryW GetFileAttributesW GetLocalTime GetTickCount64 GetModuleHandleW GetCurrentProcessId GetThreadLocale LocalFree GetCalendarInfoW ExpandEnvironmentStringsW GetDateFormatW VirtualQuery GetUserDefaultUILanguage Sleep QueryPerformanceCounter GetEnvironmentVariableW GetSystemTime GetCurrentThreadId ExitThread GetCurrentProcess GetLastError GetModuleFileNameW GetSystemTimeAsFileTime WriteConsoleW CloseHandle CreateFileW SetFilePointerEx GetConsoleMode GetConsoleOutputCP FlushFileBuffers HeapReAlloc HeapSize GetProcessHeap LCMapStringW ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW InitializeSListHead RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind GetLastError UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent RtlUnwindEx RtlPcToFileHeader RaiseException SetLastError EncodePointer EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary GetProcAddress LoadLibraryExW TerminateProcess GetStdHandle WriteFile ExitProcess GetModuleHandleExW HeapAlloc HeapFree FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle GetFileType GetStringTypeW FlsAlloc FlsGetValue FlsSetValue FlsFree InitializeCriticalSectionEx VirtualProtect

user32

UnregisterClassW DestroyWindow TranslateMessage PeekMessageW CreateWindowExW RegisterClassExW LoadCursorW DefWindowProcW DispatchMessageW

Name

.text

Size

121KB

Virtual Size

120KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

87KB

Virtual Size

87KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

309KB

Virtual Size

317KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.uistr

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.cache

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

17.6MB

Virtual Size

17.6MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-05-28_53affb6967d2fa43949d33ef60112c57_icedid_stealc

PE Signature issue

kernel32

user32

generic