2026-07-17_2d6838049edaae859650f81e70d4496e_icedid_luca-stealer_njrat_stealc_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-17_2d6838049edaae859650f81e70d4496e_icedid_luca-stealer_njrat_stealc_vidar
Size 5.1MB
Sample260718-e2h4qagt2r
SHA256 b2dc0e50d22e1f7e748af9fb4d9e266bb224c564fbf2f8df00c9709530ae725f
MD5 2d6838049edaae859650f81e70d4496e
SHA1 7190f1e70ba2652fed18563eb74e78a6ccfb45fd
SHA512 0333a8cda52872a269cc5ea6094da2c5beb112a6771119ad03e2b131f85d6de7d6911b0e99c1cfbdaa3cb0ecbab8a0a2f84a0fbcb732888da7cdc5feca4fcb53
SSDEEP 49152:wzw66pZqHqET+AZJSeiJuB7ZFfmVbEpWz3TQpt5R:0zJqM/cCp
TLSH
T1A746C75AEA7641D1C4F9C03CD593622EF87138A6933097C7A681AA175B33BF4E63E740
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-17_2d6838049edaae859650f81e70d4496e_icedid_luca-stealer_njrat_stealc_vidar

File Explorer

2026-07-17_2d6838049edaae859650f81e70d4496e_icedid_luca-stealer_njrat_stealc_vidar

.exe 5.1MB

2026-07-17_2d6838049edaae859650f81e70d4496e_icedid_luca-stealer_njrat_stealc_vidar

IMPHASH 22af88b332758b63dcd4e3de5fb45da9
SHA256 b2dc0e50d22e1f7e748af9fb4d9e266bb224c564fbf2f8df00c9709530ae725f
MD5 2d6838049edaae859650f81e70d4496e
SHA1 7190f1e70ba2652fed18563eb74e78a6ccfb45fd
SHA512 0333a8cda52872a269cc5ea6094da2c5beb112a6771119ad03e2b131f85d6de7d6911b0e99c1cfbdaa3cb0ecbab8a0a2f84a0fbcb732888da7cdc5feca4fcb53
SSDEEP 49152:wzw66pZqHqET+AZJSeiJuB7ZFfmVbEpWz3TQpt5R:0zJqM/cCp
TLSH
T1A746C75AEA7641D1C4F9C03CD593622EF87138A6933097C7A681AA175B33BF4E63E740
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

3247912

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Build\Build_2026_D20260115T171611\fa_rss\Release\PCAppStore.pdb

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

urlmon

CreateUri URLDownloadToFileW

kernel32

CreateFileW OpenEventW GetOverlappedResult ReadDirectoryChangesW LocalFree CreateDirectoryW FreeLibrary LoadLibraryW ExpandEnvironmentStringsW HeapDestroy HeapReAlloc HeapSize GetTickCount64 FindResourceExW VerSetConditionMask FindClose FindFirstFileExW FindNextFileW GetFileAttributesW ReadFile RemoveDirectoryW CreateProcessW OpenProcess VerifyVersionInfoW LCIDToLocaleName GetUserDefaultUILanguage GetLocaleInfoEx GetConsoleOutputCP K32EnumProcessModules K32GetModuleBaseNameW GetStartupInfoW GetTickCount CopyFileA IsProcessCritical QueryFullProcessImageNameW CreateToolhelp32Snapshot Process32FirstW Process32NextW K32EnumProcesses K32GetModuleFileNameExW GetTempPathW GetExitCodeProcess GetProcessId InitializeProcThreadAttributeList DeleteProcThreadAttributeList UpdateProcThreadAttribute OpenMutexW OpenFileMappingW MapViewOfFile GetStdHandle GetEnvironmentVariableA SetCurrentDirectoryW FindFirstFileW GetCurrentProcess GetSystemTime SystemTimeToFileTime FileTimeToLocalFileTime lstrcmpA FileTimeToSystemTime FlushFileBuffers QueryPerformanceCounter CreateFileMappingW FormatMessageA GetSystemTimeAsFileTime GetFileSize LockFileEx UnlockFile HeapCompact GetSystemInfo DeleteFileA LoadLibraryA CreateFileA FlushViewOfFile GetFileAttributesExW GetFileAttributesA GetDiskFreeSpaceA GetTempPathA MultiByteToWideChar HeapValidate UnmapViewOfFile CreateMutexW UnlockFileEx SetEndOfFile GetFullPathNameA SetFilePointer LockFile OutputDebugStringA GetDiskFreeSpaceW WriteFile GetFullPathNameW HeapCreate AreFileApisANSI SetEnvironmentVariableW GetProcessHeap WaitForMultipleObjects TryEnterCriticalSection DeleteCriticalSection DecodePointer InitializeCriticalSectionEx GlobalAlloc GlobalUnlock GlobalLock LoadLibraryExW GetEnvironmentVariableW GetCommandLineA RaiseException GetExitCodeThread ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive GetCurrentDirectoryW GetFileInformationByHandle SetFileInformationByHandle GetFileInformationByHandleEx GetStringTypeW InitOnceBeginInitialize InitOnceComplete QueryPerformanceFrequency SleepConditionVariableSRW WakeConditionVariable WakeAllConditionVariable EncodePointer LCMapStringEx CompareStringEx GetCPInfo InitializeSListHead RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter Sleep IsProcessorFeaturePresent TerminateProcess RtlPcToFileHeader RtlUnwindEx GetCommandLineW InterlockedPushEntrySList GetModuleFileNameW CreateEventW ResetEvent InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree CreateThread ExitThread GetEnvironmentStringsW FreeLibraryAndExitThread ExitProcess GetDriveTypeW GetFileType PeekNamedPipe SystemTimeToTzSpecificLocalTime FindResourceW SizeofResource LockResource LoadResource WideCharToMultiByte FormatMessageW GetProcAddress GetModuleHandleExW GetModuleHandleW GetModuleFileNameA GetCurrentThreadId GetCurrentProcessId FlsAlloc FlsGetValue FlsSetValue LeaveCriticalSection FlsFree VirtualProtect GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW SetEvent SetFilePointerEx GetFileSizeEx CreateSemaphoreExW CreateMutexExW OpenSemaphoreW WaitForSingleObjectEx WaitForSingleObject ReleaseMutex InitializeCriticalSection ReleaseSemaphore WriteConsoleW FreeEnvironmentStringsW HeapAlloc HeapFree SetLastError GetLastError CloseHandle OutputDebugStringW DebugBreak IsDebuggerPresent DeleteFileW GetOEMCP GetACP IsValidCodePage GetConsoleMode RtlUnwind SetStdHandle GetTimeZoneInformation EnterCriticalSection EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW ReadConsoleW

user32

GetClassInfoExW RegisterClassExW AttachThreadInput SendMessageTimeoutW RegisterWindowMessageW UpdateWindow GetWindowLongPtrW SetWindowLongW SetRectEmpty FillRect AdjustWindowRectEx GetClientRect SetWindowTextW DestroyMenu GetCapture GetMenuItemCount InsertMenuW AppendMenuW RemoveMenu TrackPopupMenu LoadIconW ChangeWindowMessageFilterEx GetWindowPlacement UnregisterClassW MonitorFromWindow LoadCursorW EqualRect InvalidateRect EndPaint BeginPaint ShowWindow DestroyWindow CreateWindowExW RegisterClassW OpenIcon DefWindowProcW CreatePopupMenu FindWindowExW UnhookWinEvent SetCapture PtInRect SetClassLongPtrW OpenClipboard EmptyClipboard CloseClipboard SetClipboardData TrackMouseEvent GetForegroundWindow keybd_event GetShellWindow SetCursorPos GetWindowTextW SetWindowPos GetPhysicalCursorPos GetSystemMetrics GetAsyncKeyState CallNextHookEx UnhookWindowsHookEx SetWindowsHookExW EnumChildWindows WindowFromPoint ScreenToClient GetCursorPos IsChild PostThreadMessageW SendMessageW GetMessageW GetThreadDpiAwarenessContext SetThreadDpiAwarenessContext EnumDisplayMonitors FindWindowW IntersectRect GetMonitorInfoW MonitorFromRect DialogBoxParamW MonitorFromPoint SystemParametersInfoW GetWindow GetWindowThreadProcessId GetClassNameW EnumWindows ReleaseDC GetDC SendInput EndDialog IsWindowVisible SetWinEventHook PeekMessageW DispatchMessageW TranslateMessage KillTimer SetTimer IsIconic SetForegroundWindow SetFocus IsWindow GetWindowRect ReleaseCapture PostMessageW SetWindowPlacement SetWindowLongPtrW PostQuitMessage IsZoomed

gdi32

CreateCompatibleBitmap CreateCompatibleDC DeleteDC SelectObject DeleteObject CreateSolidBrush BitBlt

winspool.drv

EnumPrintersW

comdlg32

GetOpenFileNameW

advapi32

EventSetInformation RegGetValueW EventUnregister EventWriteTransfer EventRegister RegNotifyChangeKeyValue RegCreateKeyExW GetUserNameW RegSetValueExW RegQueryValueExW RegOpenKeyExW RegDeleteValueW RegCloseKey

shell32

SHEmptyRecycleBinW SHQueryRecycleBinW SHGetFolderPathW SHGetKnownFolderPath SHAppBarMessage ShellExecuteW ShellExecuteExW Shell_NotifyIconW CommandLineToArgvW

ole32

RevokeDragDrop CoTaskMemAlloc OleInitialize CoSetProxyBlanket CoInitializeSecurity OleRun CoCreateFreeThreadedMarshaler CoCreateInstance RegisterDragDrop CoInitializeEx CoTaskMemFree CoUninitialize CoAllowSetForegroundWindow CoInitialize

oleaut32

VariantInit VariantChangeType SysFreeString SysAllocString SysStringLen VariantClear GetErrorInfo SetErrorInfo

iphlpapi

IcmpCloseHandle IcmpCreateFile

winhttp

WinHttpConnect WinHttpCloseHandle WinHttpOpen WinHttpReceiveResponse WinHttpReadData WinHttpSetTimeouts WinHttpSendRequest WinHttpQueryDataAvailable WinHttpQueryHeaders WinHttpOpenRequest

crypt32

CryptMsgClose CryptQueryObject CertGetNameStringW CertFreeCertificateContext CertFindCertificateInStore CertCloseStore CertOpenStore CryptDecodeObjectEx CryptDecodeObject CryptMsgOpenToDecode CryptMsgUpdate CryptMsgGetParam

ws2_32

WSAConnectByNameW closesocket recv send shutdown socket WSAStartup WSACleanup WSAGetLastError

sspicli

QueryContextAttributesW DecryptMessage EncryptMessage FreeContextBuffer FreeCredentialsHandle ApplyControlToken DeleteSecurityContext InitializeSecurityContextW AcquireCredentialsHandleW

ext-ms-win-networking-wlanapi-l1-1-0

WlanOpenHandle WlanCloseHandle WlanFreeMemory WlanGetAvailableNetworkList WlanEnumInterfaces

wlanapi

WlanRegisterNotification WlanScan WlanAllocateMemory

shlwapi

PathCreateFromUrlW PathFindFileNameW PathRenameExtensionW PathAddBackslashW SHCreateStreamOnFileEx UrlCreateFromPathW AssocCreate

api-ms-win-shcore-scaling-l1-1-1

GetDpiForMonitor

dwmapi

DwmSetWindowAttribute DwmGetWindowAttribute

wtsapi32

WTSRegisterSessionNotification WTSUnRegisterSessionNotification

gdiplus

GdipDeleteBrush GdiplusStartup GdiplusShutdown GdipDisposeImage GdipSetStringFormatAlign GdipCreateSolidFill GdipCloneImage GdipCreateBitmapFromHBITMAP GdipFlush GdipAlloc GdipDeleteStringFormat GdipFree GdipCreateStringFormat GdipCreateMatrix GdipDeleteMatrix GdipCloneBrush GdipCreateFromHDC GdipDeleteGraphics GdipSetSmoothingMode GdipSetWorldTransform GdipTranslateWorldTransform GdipScaleWorldTransform GdipFillEllipse GdipDrawImageI GdipCreateFontFamilyFromName GdipDeleteFontFamily GdipCreateFont GdipDeleteFont GdipDrawString

msi

ord160 ord70 ord45 ord8 ord32 ord159 ord118 ord92

wininet

InternetOpenUrlW InternetReadFile InternetOpenW InternetSetOptionW HttpQueryInfoW InternetCheckConnectionW InternetQueryDataAvailable InternetCloseHandle

setupapi

SetupDiGetDeviceRegistryPropertyW SetupDiDestroyDeviceInfoList SetupDiEnumDeviceInfo SetupDiGetClassDevsW

api-ms-win-core-winrt-error-l1-1-1

RoOriginateLanguageException

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory

Name

.text

Size

3.6MB

Virtual Size

3.6MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

837KB

Virtual Size

836KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

184KB

Virtual Size

315KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

257KB

Virtual Size

256KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

328KB

Virtual Size

328KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

13KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-17_2d6838049edaae859650f81e70d4496e_icedid_luca-stealer_njrat_stealc_vidar

version

urlmon

kernel32

user32

gdi32

winspool.drv

comdlg32

advapi32

shell32

ole32

oleaut32

iphlpapi

winhttp

crypt32

ws2_32

sspicli

ext-ms-win-networking-wlanapi-l1-1-0

wlanapi

shlwapi

api-ms-win-shcore-scaling-l1-1-1

dwmapi

wtsapi32

gdiplus

msi

wininet

setupapi

api-ms-win-core-winrt-error-l1-1-1

api-ms-win-core-winrt-l1-1-0

generic