2026-06-28_990f56b854fc36e9338dd5e4f520e57f_icedid_luca-stealer_njrat_stealc_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-06-28_990f56b854fc36e9338dd5e4f520e57f_icedid_luca-stealer_njrat_stealc_vidar
Size 5.2MB
Sample260628-y7fekaes7m
SHA256 b42baaa67fda622205992cc278b3c0afcb63320880fb0dc326ea4f316e1f7b92
MD5 990f56b854fc36e9338dd5e4f520e57f
SHA1 2a9dbd5b9cdd936204aac8899704a8f93b658f8e
SHA512 acdd5aafd12de8929ce4ecc0e90fc8959971bf831c5d86ca321cfc36ea31e699ef4e4bef160295e443f688757ebc98a805f19d69a362971a0330745712395791
SSDEEP 49152:1zB6w4sPZsJv6M3TBGSfGNBJWHYQ1a+BRz3TQptW0:Hyg4OJMCz
TLSH
T11946B55AEA6541E1C4F9C03DD553622FF87138A68330A7C7A681AB175B337E4EA3E740
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-06-28_990f56b854fc36e9338dd5e4f520e57f_icedid_luca-stealer_njrat_stealc_vidar

File Explorer

2026-06-28_990f56b854fc36e9338dd5e4f520e57f_icedid_luca-stealer_njrat_stealc_vidar

.exe 5.2MB

2026-06-28_990f56b854fc36e9338dd5e4f520e57f_icedid_luca-stealer_njrat_stealc_vidar

IMPHASH 80b47e87db0df52795ff4b375d587fd0
SHA256 b42baaa67fda622205992cc278b3c0afcb63320880fb0dc326ea4f316e1f7b92
MD5 990f56b854fc36e9338dd5e4f520e57f
SHA1 2a9dbd5b9cdd936204aac8899704a8f93b658f8e
SHA512 acdd5aafd12de8929ce4ecc0e90fc8959971bf831c5d86ca321cfc36ea31e699ef4e4bef160295e443f688757ebc98a805f19d69a362971a0330745712395791
SSDEEP 49152:1zB6w4sPZsJv6M3TBGSfGNBJWHYQ1a+BRz3TQptW0:Hyg4OJMCz
TLSH
T11946B55AEA6541E1C4F9C03DD553622FF87138A68330A7C7A681AB175B337E4EA3E740
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

3253144

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Build\Build_2027a_D20260204T153521\fa_rss\Release\PCAppStore.pdb

version

GetFileVersionInfoW GetFileVersionInfoSizeW VerQueryValueW

urlmon

CreateUri URLDownloadToFileW

kernel32

CreateFileW OpenEventW GetOverlappedResult ReadDirectoryChangesW LocalFree CreateDirectoryW FreeLibrary LoadLibraryW ExpandEnvironmentStringsW HeapDestroy HeapReAlloc HeapSize GetTickCount64 FindResourceExW VerSetConditionMask FindClose FindFirstFileExW FindNextFileW GetFileAttributesW ReadFile RemoveDirectoryW CreateProcessW OpenProcess VerifyVersionInfoW LCIDToLocaleName GetUserDefaultUILanguage GetLocaleInfoEx GetConsoleOutputCP K32EnumProcessModules K32GetModuleBaseNameW GetStartupInfoW GetTickCount CopyFileA IsProcessCritical QueryFullProcessImageNameW CreateToolhelp32Snapshot Process32FirstW Process32NextW K32EnumProcesses K32GetModuleFileNameExW GetTempPathW GetExitCodeProcess GetProcessId InitializeProcThreadAttributeList DeleteProcThreadAttributeList UpdateProcThreadAttribute OpenMutexW OpenFileMappingW MapViewOfFile GetStdHandle GetEnvironmentVariableA SetCurrentDirectoryW FindFirstFileW GetCurrentProcess GetSystemTime SystemTimeToFileTime FileTimeToLocalFileTime lstrcmpA FileTimeToSystemTime FlushFileBuffers QueryPerformanceCounter CreateFileMappingW FormatMessageA GetSystemTimeAsFileTime GetFileSize LockFileEx UnlockFile HeapCompact GetSystemInfo DeleteFileA LoadLibraryA CreateFileA FlushViewOfFile GetFileAttributesExW GetFileAttributesA GetDiskFreeSpaceA GetTempPathA MultiByteToWideChar HeapValidate UnmapViewOfFile CreateMutexW UnlockFileEx SetEndOfFile GetFullPathNameA SetFilePointer LockFile OutputDebugStringA GetDiskFreeSpaceW WriteFile GetFullPathNameW HeapCreate AreFileApisANSI SetEnvironmentVariableW WaitForMultipleObjects LeaveCriticalSection TryEnterCriticalSection DeleteCriticalSection DecodePointer InitializeCriticalSectionEx GlobalAlloc GlobalUnlock GlobalLock LoadLibraryExW GetEnvironmentVariableW GetCommandLineA GetExitCodeThread ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive GetCurrentDirectoryW GetFileInformationByHandle SetFileInformationByHandle GetFileInformationByHandleEx GetStringTypeW InitOnceBeginInitialize InitOnceComplete QueryPerformanceFrequency SleepConditionVariableSRW WakeConditionVariable WakeAllConditionVariable EncodePointer LCMapStringEx CompareStringEx GetCPInfo InitializeSListHead RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter Sleep SetUnhandledExceptionFilter IsProcessorFeaturePresent TerminateProcess RtlPcToFileHeader GetCommandLineW RtlUnwindEx GetModuleFileNameW CreateEventW ResetEvent InterlockedPushEntrySList InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree CreateThread ExitThread GetEnvironmentStringsW FreeLibraryAndExitThread ExitProcess GetDriveTypeW GetFileType PeekNamedPipe SystemTimeToTzSpecificLocalTime FindResourceW SizeofResource LockResource LoadResource WideCharToMultiByte FormatMessageW GetProcAddress GetModuleHandleExW GetModuleHandleW GetModuleFileNameA GetCurrentThreadId GetCurrentProcessId FlsAlloc FlsGetValue FlsSetValue GetProcessHeap FlsFree VirtualProtect GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW SetEvent ReadConsoleW SetFilePointerEx GetFileSizeEx CreateSemaphoreExW CreateMutexExW OpenSemaphoreW WaitForSingleObjectEx WaitForSingleObject ReleaseMutex InitializeCriticalSection ReleaseSemaphore WriteConsoleW FreeEnvironmentStringsW HeapAlloc HeapFree SetLastError GetLastError CloseHandle OutputDebugStringW DebugBreak IsDebuggerPresent DeleteFileW GetOEMCP GetACP IsValidCodePage RtlUnwind RaiseException GetConsoleMode SetStdHandle EnterCriticalSection EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW GetTimeZoneInformation

user32

RegisterClassExW AttachThreadInput SendMessageTimeoutW RegisterWindowMessageW UpdateWindow GetWindowLongPtrW SetWindowLongW SetRectEmpty FillRect AdjustWindowRectEx GetClientRect SetWindowTextW GetWindowPlacement UnregisterClassW CreatePopupMenu TrackMouseEvent DestroyMenu GetMenuItemCount InsertMenuW AppendMenuW RemoveMenu TrackPopupMenu LoadIconW MonitorFromWindow LoadCursorW EqualRect InvalidateRect EndPaint BeginPaint ShowWindow DestroyWindow CreateWindowExW RegisterClassW PostQuitMessage EmptyClipboard FindWindowExW UnhookWinEvent GetClassInfoExW GetForegroundWindow keybd_event GetCapture SetCapture PtInRect SetClipboardData SetClassLongPtrW OpenClipboard CloseClipboard ChangeWindowMessageFilterEx GetShellWindow SetCursorPos GetWindowTextW SetWindowPos GetPhysicalCursorPos GetSystemMetrics GetAsyncKeyState CallNextHookEx UnhookWindowsHookEx SetWindowsHookExW EnumChildWindows WindowFromPoint ScreenToClient GetCursorPos IsChild PostThreadMessageW SendMessageW GetMessageW GetThreadDpiAwarenessContext SetThreadDpiAwarenessContext EnumDisplayMonitors FindWindowW IntersectRect GetMonitorInfoW MonitorFromRect DialogBoxParamW MonitorFromPoint SystemParametersInfoW GetWindow GetWindowThreadProcessId GetClassNameW EnumWindows ReleaseDC GetDC SendInput EndDialog IsWindowVisible SetWinEventHook PeekMessageW DispatchMessageW TranslateMessage KillTimer SetTimer IsIconic SetForegroundWindow SetFocus IsWindow GetWindowRect ReleaseCapture PostMessageW OpenIcon SetWindowPlacement SetWindowLongPtrW DefWindowProcW IsZoomed

gdi32

CreateCompatibleBitmap CreateCompatibleDC DeleteDC SelectObject DeleteObject CreateSolidBrush BitBlt

winspool.drv

EnumPrintersW

comdlg32

GetOpenFileNameW

advapi32

EventUnregister RegGetValueW EventWriteTransfer EventSetInformation EventRegister RegNotifyChangeKeyValue RegCreateKeyExW GetUserNameW RegSetValueExW RegQueryValueExW RegOpenKeyExW RegDeleteValueW RegCloseKey

shell32

SHEmptyRecycleBinW SHQueryRecycleBinW SHGetFolderPathW SHGetKnownFolderPath SHAppBarMessage ShellExecuteW ShellExecuteExW Shell_NotifyIconW CommandLineToArgvW

ole32

RevokeDragDrop CoTaskMemAlloc OleInitialize CoSetProxyBlanket CoInitializeSecurity OleRun CoInitialize CoCreateInstance RegisterDragDrop CoInitializeEx CoTaskMemFree CoUninitialize CoCreateFreeThreadedMarshaler CoAllowSetForegroundWindow

oleaut32

VariantInit VariantChangeType SysFreeString SysAllocString SysStringLen VariantClear GetErrorInfo SetErrorInfo

iphlpapi

IcmpCloseHandle IcmpCreateFile

winhttp

WinHttpSendRequest WinHttpSetTimeouts WinHttpConnect WinHttpCloseHandle WinHttpOpen WinHttpReadData WinHttpQueryDataAvailable WinHttpOpenRequest WinHttpSetOption WinHttpQueryHeaders WinHttpReceiveResponse

crypt32

CryptMsgClose CryptQueryObject CertGetNameStringW CertFreeCertificateContext CertFindCertificateInStore CertCloseStore CertOpenStore CryptDecodeObjectEx CryptDecodeObject CryptMsgOpenToDecode CryptMsgUpdate CryptMsgGetParam

ws2_32

WSAConnectByNameW closesocket recv send shutdown socket WSAStartup WSACleanup WSAGetLastError

sspicli

QueryContextAttributesW DecryptMessage EncryptMessage FreeContextBuffer FreeCredentialsHandle ApplyControlToken DeleteSecurityContext InitializeSecurityContextW AcquireCredentialsHandleW

ext-ms-win-networking-wlanapi-l1-1-0

WlanCloseHandle WlanFreeMemory WlanGetAvailableNetworkList WlanEnumInterfaces WlanOpenHandle

wlanapi

WlanScan WlanRegisterNotification WlanAllocateMemory

shlwapi

PathCreateFromUrlW PathFindFileNameW AssocCreate PathAddBackslashW SHCreateStreamOnFileEx UrlCreateFromPathW PathRenameExtensionW

api-ms-win-shcore-scaling-l1-1-1

GetDpiForMonitor

dwmapi

DwmGetWindowAttribute DwmSetWindowAttribute

wtsapi32

WTSRegisterSessionNotification WTSUnRegisterSessionNotification

gdiplus

GdipCreateMatrix GdipCloneBrush GdipSetStringFormatAlign GdipDeleteStringFormat GdipDeleteBrush GdipCreateSolidFill GdipDisposeImage GdipCreateBitmapFromHBITMAP GdiplusStartup GdipCreateStringFormat GdiplusShutdown GdipDrawString GdipAlloc GdipCloneImage GdipFree GdipFlush GdipCreateFromHDC GdipDeleteGraphics GdipSetSmoothingMode GdipSetWorldTransform GdipTranslateWorldTransform GdipScaleWorldTransform GdipFillEllipse GdipDrawImageI GdipCreateFontFamilyFromName GdipDeleteFontFamily GdipCreateFont GdipDeleteFont GdipDeleteMatrix

msi

ord70 ord45 ord92 ord8 ord32 ord159 ord160 ord118

wininet

InternetCloseHandle InternetConnectW InternetReadFile InternetQueryDataAvailable InternetSetOptionW HttpOpenRequestW HttpAddRequestHeadersW HttpSendRequestW HttpQueryInfoW InternetCheckConnectionW InternetOpenW

setupapi

SetupDiEnumDeviceInfo SetupDiGetDeviceRegistryPropertyW SetupDiGetClassDevsW SetupDiDestroyDeviceInfoList

api-ms-win-core-winrt-error-l1-1-1

RoOriginateLanguageException

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory

Name

.text

Size

3.6MB

Virtual Size

3.6MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

839KB

Virtual Size

839KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

185KB

Virtual Size

317KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

257KB

Virtual Size

257KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

328KB

Virtual Size

328KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

13KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-06-28_990f56b854fc36e9338dd5e4f520e57f_icedid_luca-stealer_njrat_stealc_vidar

version

urlmon

kernel32

user32

gdi32

winspool.drv

comdlg32

advapi32

shell32

ole32

oleaut32

iphlpapi

winhttp

crypt32

ws2_32

sspicli

ext-ms-win-networking-wlanapi-l1-1-0

wlanapi

shlwapi

api-ms-win-shcore-scaling-l1-1-1

dwmapi

wtsapi32

gdiplus

msi

wininet

setupapi

api-ms-win-core-winrt-error-l1-1-1

api-ms-win-core-winrt-l1-1-0

generic