2026-06-02_d7cd2dbea906473dadaac72a685ddc99_icedid_luca-stealer_njrat_stealc_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-06-02_d7cd2dbea906473dadaac72a685ddc99_icedid_luca-stealer_njrat_stealc_vidar
Size 3.5MB
Sample260602-lrgapsat4t
SHA256 75eac7591bb38fd3218d977579b30ebdba2f42717e413bf030c1b98dd3d29d4d
MD5 d7cd2dbea906473dadaac72a685ddc99
SHA1 5fc36db947a341c3b2d710ae8d4dc66a2ae5b088
SHA512 1db81a572af554b881ec3bc13dfa2e5c8109a478487e283835616df69ec4d71a29f99f4eb263584425f7a0d74e07edd06b7d81f7c78adf62bcd8d11c33b26044
SSDEEP 98304:6PfOZ4XtD1lSQPFmTpJHk/n5ARjVqxDmGTZ:6PfOZ4XtD1lSQPFmTpJHkf5AZVGDmG
TLSH
T12B06EF09E2AA01A8DF72A73C48854723D2B13CC84BF1D6D716AC8A75AF679F45D3DB01
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-06-02_d7cd2dbea906473dadaac72a685ddc99_icedid_luca-stealer_njrat_stealc_vidar

File Explorer

2026-06-02_d7cd2dbea906473dadaac72a685ddc99_icedid_luca-stealer_njrat_stealc_vidar

.exe 3.5MB

2026-06-02_d7cd2dbea906473dadaac72a685ddc99_icedid_luca-stealer_njrat_stealc_vidar

IMPHASH 0963e35e50785bc58d95ce2abe21d97f
SHA256 75eac7591bb38fd3218d977579b30ebdba2f42717e413bf030c1b98dd3d29d4d
MD5 d7cd2dbea906473dadaac72a685ddc99
SHA1 5fc36db947a341c3b2d710ae8d4dc66a2ae5b088
SHA512 1db81a572af554b881ec3bc13dfa2e5c8109a478487e283835616df69ec4d71a29f99f4eb263584425f7a0d74e07edd06b7d81f7c78adf62bcd8d11c33b26044
SSDEEP 98304:6PfOZ4XtD1lSQPFmTpJHk/n5ARjVqxDmGTZ:6PfOZ4XtD1lSQPFmTpJHkf5AZVGDmG
TLSH
T12B06EF09E2AA01A8DF72A73C48854723D2B13CC84BF1D6D716AC8A75AF679F45D3DB01
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

371872

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

rdpclip.pdb

advapi32

TraceMessage RegQueryValueExW RegOpenKeyExW RegSetValueExW RegCloseKey EventActivityIdControl EventWriteTransfer RegOpenKeyW EventUnregister UnregisterTraceGuids RegisterTraceGuidsW GetTraceEnableLevel GetTraceEnableFlags GetTraceLoggerHandle EventRegister OpenThreadToken RegDeleteValueW RegGetValueW CheckTokenMembership FreeSid RegCreateKeyExW AllocateAndInitializeSid

kernel32

EnterCriticalSection LeaveCriticalSection GetCurrentThread LoadLibraryW DeleteCriticalSection GetProcessHeap CreateMutexExW HeapAlloc HeapSetInformation OpenSemaphoreW WaitForSingleObjectEx OutputDebugStringW FormatMessageW ReleaseMutex GetCurrentThreadId WaitForSingleObject InitializeCriticalSection ReleaseSemaphore SetLastError HeapFree CreateSemaphoreExW GetModuleFileNameA ResetEvent SetEvent DefineDosDeviceW GetModuleHandleW DebugBreak ProcessIdToSessionId DeviceIoControl GetModuleHandleExW QueryDosDeviceW QueryFullProcessImageNameW GetCurrentProcessId GetModuleHandleExA GetLastError GetProcAddress FreeLibrary CreateEventW CloseHandle GetCurrentProcess CreateMutexW IsDebuggerPresent

user32

GetWindowTextLengthW MonitorFromWindow GetWindowRgn RegisterDeviceNotificationW RegisterClassW UnregisterDeviceNotification LoadStringW DefWindowProcW PostMessageW SetWindowLongPtrW ChangeDisplaySettingsExW GetWindowLongPtrW RegisterClassExW OpenDesktopW GetUserObjectInformationW GetLayeredWindowAttributes GetSystemMetrics LoadCursorW PostQuitMessage SystemParametersInfoW SetWinEventHook GetClassInfoExW UnhookWinEvent CloseDesktop EnumDisplayDevicesW CreateWindowExW EnumDisplaySettingsW

msvcrt

_cexit wcscmp _exit __CxxFrameHandler3 _unlock __dllonexit _onexit _wcsnicmp isalpha ?terminate@@YAXXZ memset _lock swprintf_s wcsrchr _strnicmp strnlen _commode memcmp memcpy ?what@exception@@UEBAPEBDXZ ??1exception@@UEAA@XZ ??0exception@@QEAA@AEBQEBDH@Z ??0exception@@QEAA@AEBV0@@Z _ismbblead _callnewh malloc __C_specific_handler _wcsicmp _purecall memcpy_s wcsnlen wcschr memmove_s _wsplitpath_s _wmakepath_s _vsnwprintf __setusermatherr free _fmode _acmdln _CxxThrowException _XcptFilter _amsg_exit __getmainargs __set_app_type exit ??1type_info@@UEAA@XZ _initterm

ole32

StringFromGUID2 CoTaskMemFree CoCreateInstance OleInitialize CoTaskMemAlloc ReleaseStgMedium OleUninitialize

crypt32

CryptBinaryToStringW

api-ms-win-security-isolatedcontainer-l1-1-1

IsProcessInWDAGContainer

rpcrt4

RpcImpersonateClient RpcServerUnregisterIfEx RpcServerListen RpcStringFreeW RpcStringBindingParseW RpcBindingToStringBindingW RpcRevertToSelf RpcServerRegisterIfEx RpcServerUseProtseqEpW RpcBindingInqAuthClientW NdrServerCall2 NdrServerCallAll

mpr

WNetCancelConnection2W WNetAddConnection2W

api-ms-win-core-synch-l1-2-0

Sleep InitOnceInitialize InitOnceExecuteOnce

api-ms-win-core-processthreads-l1-1-0

TlsGetValue OpenThread TlsAlloc SwitchToThread CreateThread TerminateProcess TlsSetValue GetStartupInfoW TlsFree QueueUserAPC

api-ms-win-core-rtlsupport-l1-1-0

RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind

api-ms-win-core-errorhandling-l1-1-0

SetUnhandledExceptionFilter RaiseException UnhandledExceptionFilter

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime GetSystemInfo GetTickCount GetSystemTime GetVersionExW

api-ms-win-core-featurestaging-l1-1-0

UnsubscribeFeatureStateChangeNotification SubscribeFeatureStateChangeNotification RecordFeatureUsage

api-ms-win-core-libraryloader-l1-2-0

LoadLibraryExW FreeLibraryAndExitThread

api-ms-win-core-synch-l1-2-1

CreateSemaphoreW WaitForMultipleObjects

api-ms-win-core-processthreads-l1-1-1

OpenProcess

api-ms-win-core-threadpool-l1-2-0

WaitForThreadpoolTimerCallbacks CreateThreadpoolTimer CloseThreadpoolTimer SetThreadpoolTimer

api-ms-win-core-heap-l2-1-0

LocalAlloc GlobalAlloc LocalFree GlobalFree

api-ms-win-core-synch-l1-1-0

ReleaseSRWLockShared InitializeCriticalSectionEx AcquireSRWLockExclusive AcquireSRWLockShared ReleaseSRWLockExclusive

shell32

ShellExecuteW SHFileOperationW DragQueryFileW SHChangeNotify

winsta

WinStationVirtualOpenEx WinStationIsCurrentSessionRemoteable WinStationFreePropertyValue WinStationGetConnectionProperty WinStationQueryInformationW WinStationNameFromLogonIdW WinStationIsSessionRemoteable

wtsapi32

WTSVirtualChannelOpen WTSVirtualChannelQuery WTSVirtualChannelWrite WTSVirtualChannelOpenEx WTSQuerySessionInformationW WTSFreeMemory WTSUnRegisterSessionNotification WTSVirtualChannelClose WTSRegisterSessionNotification

ntdll

RtlMultiByteToUnicodeN NtClose RtlNtStatusToDosError NtCreateFile EtwEventActivityIdControl RtlInitUnicodeString

winspool.drv

GetPrinterDataW OpenPrinterW ord203 SetDefaultPrinterW ClosePrinter

setupapi

SetupDiDestroyDeviceInfoList SetupDiGetDevicePropertyW SetupDiCreateDeviceInfoList SetupDiGetDeviceRegistryPropertyW SetupDiGetClassDevsW SetupDiEnumDeviceInterfaces SetupDiOpenDeviceInterfaceW SetupDiGetDeviceInterfaceDetailW

dwmapi

DwmGetWindowAttribute

api-ms-win-core-file-l1-1-0

GetFileInformationByHandle GetFileAttributesW SetFilePointerEx FindClose FindNextFileW CreateFileW GetTempFileNameW DeleteFileW CreateDirectoryW WriteFile ReadFileEx FindFirstFileW ReadFile

api-ms-win-core-io-l1-1-1

CancelIo

api-ms-win-core-io-l1-1-0

GetOverlappedResult

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory

api-ms-win-core-winrt-string-l1-1-0

WindowsCreateString WindowsCreateStringReference WindowsDeleteString

api-ms-win-core-com-l1-1-0

CoInitializeEx CoUninitialize CoCreateFreeThreadedMarshaler

api-ms-win-rtcore-ntuser-clipboard-l1-1-0

IsClipboardFormatAvailable GetClipboardFormatNameW RegisterClipboardFormatW

api-ms-win-rtcore-ntuser-window-l1-1-0

GetWindowRect TranslateMessage GetDesktopWindow IsWindowVisible GetMessageW GetParent EnumWindows IsChild KillTimer EnumChildWindows GetAncestor GetWindowTextW IsWindow DispatchMessageW SetTimer GetWindowThreadProcessId DestroyWindow GetClientRect PostThreadMessageW UnregisterClassW ClientToScreen SendMessageW PeekMessageW GetClassNameW

api-ms-win-core-string-l1-1-0

WideCharToMultiByte CompareStringW MultiByteToWideChar

api-ms-win-core-registry-l1-1-0

RegEnumValueW

api-ms-win-ntuser-rectangle-l1-1-0

CopyRect EqualRect IntersectRect UnionRect OffsetRect SetRect SetRectEmpty

api-ms-win-security-systemfunctions-l1-1-0

SystemFunction036

api-ms-win-security-base-l1-1-0

GetTokenInformation

devobj

DevObjEnumDeviceInterfaces DevObjDestroyDeviceInfoList DevObjGetClassDevs DevObjCreateDeviceInfoList DevObjGetDeviceInterfaceDetail

api-ms-win-core-shlwapi-obsolete-l1-1-0

StrStrIW

api-ms-win-core-string-obsolete-l1-1-0

lstrcmpW

api-ms-win-ntuser-sysparams-l1-1-0

EnumDisplayMonitors GetMonitorInfoW

gdi32

OffsetRgn CreateRectRgn GetRegionData DeleteObject EqualRgn GetRgnBox CreateDCW DeleteDC GetStockObject CreateRectRgnIndirect SetRectRgn GetObjectW CombineRgn CreatePalette CreateMetaFileW PlayMetaFile CloseMetaFile GetMetaFileBitsEx DeleteMetaFile SetMetaFileBitsEx GetPaletteEntries ExtEscape

api-ms-win-rtcore-ntuser-synch-l1-1-0

MsgWaitForMultipleObjectsEx

api-ms-win-core-heap-obsolete-l1-1-0

GlobalSize GlobalUnlock GlobalLock

api-ms-win-rtcore-ole32-clipboard-l1-1-0

OleIsCurrentClipboard OleGetClipboard OleSetClipboard

api-ms-win-core-psapi-l1-1-0

K32GetModuleFileNameExW

api-ms-win-core-localization-l1-2-0

IsDBCSLeadByte GetCPInfo

api-ms-win-core-stringansi-l1-1-0

CharNextA CharPrevA

api-ms-win-core-path-l1-1-0

PathCchCanonicalize

Sharing

General

Malware Config

Signatures

File Explorer

2026-06-02_d7cd2dbea906473dadaac72a685ddc99_icedid_luca-stealer_njrat_stealc_vidar

advapi32

kernel32

user32

msvcrt

ole32

crypt32

api-ms-win-security-isolatedcontainer-l1-1-1

rpcrt4

mpr

api-ms-win-core-synch-l1-2-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-rtlsupport-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-featurestaging-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-synch-l1-2-1

api-ms-win-core-processthreads-l1-1-1

api-ms-win-core-threadpool-l1-2-0

api-ms-win-core-heap-l2-1-0

api-ms-win-core-synch-l1-1-0

shell32

winsta

wtsapi32

ntdll

winspool.drv

setupapi

dwmapi

api-ms-win-core-file-l1-1-0

api-ms-win-core-io-l1-1-1

api-ms-win-core-io-l1-1-0

api-ms-win-core-winrt-l1-1-0

api-ms-win-core-winrt-string-l1-1-0

api-ms-win-core-com-l1-1-0

api-ms-win-rtcore-ntuser-clipboard-l1-1-0

api-ms-win-rtcore-ntuser-window-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-registry-l1-1-0

api-ms-win-ntuser-rectangle-l1-1-0

api-ms-win-security-systemfunctions-l1-1-0

api-ms-win-security-base-l1-1-0

devobj

api-ms-win-core-shlwapi-obsolete-l1-1-0

api-ms-win-core-string-obsolete-l1-1-0

api-ms-win-ntuser-sysparams-l1-1-0

gdi32

api-ms-win-rtcore-ntuser-synch-l1-1-0

api-ms-win-core-heap-obsolete-l1-1-0

api-ms-win-rtcore-ole32-clipboard-l1-1-0

api-ms-win-core-psapi-l1-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-stringansi-l1-1-0

api-ms-win-core-path-l1-1-0

generic