2026-07-20_21d277f34b320c8782f1bed102b5c20a_icedid_luca-stealer_njrat_stealc_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-20_21d277f34b320c8782f1bed102b5c20a_icedid_luca-stealer_njrat_stealc_vidar
Size 4.5MB
Sample260720-md72yahs2w
SHA256 6e68ea8d678f3993d2355034a66b451455a8ecc2f71447085bce88c6572a8f95
MD5 21d277f34b320c8782f1bed102b5c20a
SHA1 0cc1ccf832aa7db7b75688c53b38951a86f66e34
SHA512 fefb6fa23476e8710728d7a5ca2c8dea52d4458e469adbe948b7c111d0ba43cebb097b02af93809b84bdaee6fe8bc327a00d22260bb574960e55583a0b3ada66
SSDEEP 49152:fZ3+BCRQWMYAyfw3dMdo0iKaeTz3TQptI:MyYNjiCO
TLSH
T13E26C64BEA7A51D1C4FAC03A9553622FFC71389A833097C7A6416A575B33BE4E93E700
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-20_21d277f34b320c8782f1bed102b5c20a_icedid_luca-stealer_njrat_stealc_vidar

File Explorer

2026-07-20_21d277f34b320c8782f1bed102b5c20a_icedid_luca-stealer_njrat_stealc_vidar

.exe 4.5MB

2026-07-20_21d277f34b320c8782f1bed102b5c20a_icedid_luca-stealer_njrat_stealc_vidar

IMPHASH f989f90f177bf3d50a80d0fbdbd562ea
SHA256 6e68ea8d678f3993d2355034a66b451455a8ecc2f71447085bce88c6572a8f95
MD5 21d277f34b320c8782f1bed102b5c20a
SHA1 0cc1ccf832aa7db7b75688c53b38951a86f66e34
SHA512 fefb6fa23476e8710728d7a5ca2c8dea52d4458e469adbe948b7c111d0ba43cebb097b02af93809b84bdaee6fe8bc327a00d22260bb574960e55583a0b3ada66
SSDEEP 49152:fZ3+BCRQWMYAyfw3dMdo0iKaeTz3TQptI:MyYNjiCO
TLSH
T13E26C64BEA7A51D1C4FAC03A9553622FFC71389A833097C7A6416A575B33BE4E93E700
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2996760

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Build\Build_2024_D20251208T083754\fa_rss\engine\Release\PCAppStore.pdb

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

urlmon

CreateUri URLDownloadToFileW

kernel32

ResetEvent CreateEventW WaitForMultipleObjects GetModuleFileNameW LocalFree CreateFileW OpenEventW GetOverlappedResult ReadDirectoryChangesW CreateDirectoryW FreeLibrary LoadLibraryW ExpandEnvironmentStringsW GetTickCount64 VerSetConditionMask FindClose FindFirstFileExW FindNextFileW GetFileAttributesW ReadFile RemoveDirectoryW CreateProcessW OpenProcess VerifyVersionInfoW LCIDToLocaleName GetUserDefaultUILanguage GetLocaleInfoEx GetConsoleOutputCP K32EnumProcessModules K32GetModuleBaseNameW Sleep GetStartupInfoW GetTickCount CopyFileA TerminateProcess IsProcessCritical GlobalAlloc GlobalFree QueryFullProcessImageNameW CreateToolhelp32Snapshot Process32FirstW Process32NextW K32EnumProcesses K32GetModuleFileNameExW GetTempPathW GetExitCodeProcess GetProcessId InitializeProcThreadAttributeList DeleteProcThreadAttributeList UpdateProcThreadAttribute OpenMutexW OpenFileMappingW MapViewOfFile GetStdHandle GetEnvironmentVariableA SetCurrentDirectoryW FindFirstFileW GetCurrentProcess GetSystemTime SystemTimeToFileTime FileTimeToLocalFileTime lstrcmpA FileTimeToSystemTime FlushFileBuffers QueryPerformanceCounter CreateFileMappingW FormatMessageA GetSystemTimeAsFileTime GetFileSize LockFileEx UnlockFile HeapCompact GetSystemInfo DeleteFileA LoadLibraryA CreateFileA FlushViewOfFile GetFileAttributesExW GetFileAttributesA GetDiskFreeSpaceA GetTempPathA HeapValidate UnmapViewOfFile CreateMutexW UnlockFileEx SetEndOfFile GetFullPathNameA SetFilePointer LockFile OutputDebugStringA GetDiskFreeSpaceW WriteFile GetFullPathNameW SetEnvironmentVariableW AreFileApisANSI HeapReAlloc EnterCriticalSection LeaveCriticalSection TryEnterCriticalSection DeleteCriticalSection DecodePointer InitializeCriticalSectionEx GlobalUnlock GlobalLock LoadLibraryExW GetEnvironmentVariableW GetTimeZoneInformation RaiseException GetExitCodeThread ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive QueryPerformanceFrequency SleepConditionVariableSRW GetCurrentDirectoryW GetFileInformationByHandle SetFileInformationByHandle GetFileInformationByHandleEx GetStringTypeW InitOnceBeginInitialize InitOnceComplete WakeConditionVariable WakeAllConditionVariable RtlPcToFileHeader EncodePointer LCMapStringEx CompareStringEx GetCPInfo InitializeSListHead RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind GetCommandLineW UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent RtlUnwindEx SizeofResource InterlockedPushEntrySList SetEvent WideCharToMultiByte MultiByteToWideChar InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree CreateThread ExitThread ReadConsoleW FreeLibraryAndExitThread ExitProcess GetDriveTypeW GetFileType PeekNamedPipe SystemTimeToTzSpecificLocalTime LockResource LoadResource GetProcAddress GetModuleHandleExW GetModuleHandleW GetModuleFileNameA FindResourceExW GetCurrentThreadId GetCurrentProcessId CreateSemaphoreExW CreateMutexExW OpenSemaphoreW FindResourceW FlsAlloc FlsGetValue FlsSetValue FlsFree VirtualProtect GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW FormatMessageW SetFilePointerEx GetFileSizeEx GetConsoleMode EnumSystemLocalesW WaitForSingleObjectEx WaitForSingleObject ReleaseMutex ReleaseSemaphore GetProcessHeap HeapSize HeapCreate HeapFree WriteConsoleW FreeEnvironmentStringsW HeapAlloc HeapDestroy SetLastError GetLastError CloseHandle OutputDebugStringW DebugBreak IsDebuggerPresent DeleteFileW GetUserDefaultLCID GetEnvironmentStringsW GetCommandLineA GetOEMCP RtlUnwind GetACP IsValidCodePage InitializeCriticalSection IsValidLocale GetLocaleInfoW SetStdHandle

user32

CreatePopupMenu GetClassInfoExW RegisterClassExW AttachThreadInput SendMessageTimeoutW RegisterWindowMessageW UpdateWindow GetWindowLongPtrW SetWindowLongW SetRectEmpty FillRect AdjustWindowRectEx GetClientRect SetWindowTextW IsZoomed SetCapture GetMenuItemCount InsertMenuW AppendMenuW RemoveMenu TrackPopupMenu LoadIconW ChangeWindowMessageFilterEx TrackMouseEvent UnregisterClassW MonitorFromWindow LoadCursorW EqualRect InvalidateRect EndPaint BeginPaint ShowWindow DestroyWindow CreateWindowExW RegisterClassW SetWindowPlacement DefWindowProcW FindWindowExW DestroyMenu UnhookWinEvent GetForegroundWindow PtInRect SetClassLongPtrW OpenIcon OpenClipboard CloseClipboard SetClipboardData EmptyClipboard GetCapture keybd_event GetShellWindow SetCursorPos GetWindowTextW SetWindowPos wsprintfW GetPhysicalCursorPos GetSystemMetrics GetAsyncKeyState CallNextHookEx UnhookWindowsHookEx SetWindowsHookExW EnumChildWindows WindowFromPoint ScreenToClient GetCursorPos IsChild PostThreadMessageW SendMessageW GetMessageW GetThreadDpiAwarenessContext SetThreadDpiAwarenessContext EnumDisplayMonitors FindWindowW IntersectRect GetMonitorInfoW MonitorFromRect DialogBoxParamW MonitorFromPoint SystemParametersInfoW GetWindow GetWindowThreadProcessId GetClassNameW EnumWindows GetDesktopWindow ReleaseDC GetDC SendInput EndDialog IsWindowVisible SetWinEventHook PeekMessageW DispatchMessageW TranslateMessage KillTimer SetTimer SetForegroundWindow SetFocus IsWindow GetWindowRect ReleaseCapture PostMessageW IsIconic SetWindowLongPtrW PostQuitMessage GetWindowPlacement

gdi32

CreateCompatibleBitmap CreateCompatibleDC DeleteDC SelectObject DeleteObject CreateSolidBrush BitBlt

winspool.drv

EnumPrintersW

advapi32

RegNotifyChangeKeyValue RegGetValueW EventUnregister EventWriteTransfer EventSetInformation EventRegister RegCreateKeyExW RegSetKeyValueW RegDeleteValueW RegCreateKeyW GetUserNameW RegSetValueExW RegQueryValueExW RegOpenKeyExW RegCloseKey

shell32

SHEmptyRecycleBinW SHQueryRecycleBinW SHGetFolderPathW SHGetKnownFolderPath SHAppBarMessage ShellExecuteW ShellExecuteExW Shell_NotifyIconW CommandLineToArgvW

ole32

RevokeDragDrop CoTaskMemAlloc CoAllowSetForegroundWindow OleRun CoInitialize CoCreateInstance CoSetProxyBlanket CoInitializeSecurity RegisterDragDrop CoInitializeEx CoTaskMemFree CoUninitialize OleInitialize CoCreateFreeThreadedMarshaler

oleaut32

VariantClear VariantChangeType SysFreeString SysAllocString SysStringLen VariantInit GetErrorInfo SetErrorInfo

iphlpapi

IcmpCloseHandle IcmpCreateFile

winhttp

WinHttpSetTimeouts WinHttpConnect WinHttpCloseHandle WinHttpOpen WinHttpQueryHeaders WinHttpOpenRequest WinHttpReceiveResponse WinHttpReadData WinHttpQueryDataAvailable WinHttpSendRequest

crypt32

CryptMsgClose CryptQueryObject CertGetNameStringW CertFreeCertificateContext CertFindCertificateInStore CertCloseStore CertOpenStore CryptDecodeObjectEx CryptDecodeObject CryptMsgOpenToDecode CryptMsgUpdate CryptMsgGetParam

ws2_32

WSAConnectByNameW closesocket recv send shutdown socket WSAStartup WSACleanup WSAGetLastError

sspicli

ApplyControlToken DecryptMessage EncryptMessage FreeContextBuffer QueryContextAttributesW AcquireCredentialsHandleW DeleteSecurityContext InitializeSecurityContextW FreeCredentialsHandle

ext-ms-win-networking-wlanapi-l1-1-0

WlanOpenHandle WlanCloseHandle WlanFreeMemory WlanGetAvailableNetworkList WlanEnumInterfaces

wlanapi

WlanRegisterNotification WlanScan WlanAllocateMemory

shlwapi

PathCreateFromUrlW PathFindFileNameW AssocCreate PathRenameExtensionW SHCreateStreamOnFileEx UrlCreateFromPathW PathAddBackslashW

api-ms-win-shcore-scaling-l1-1-1

GetDpiForMonitor

dwmapi

DwmSetWindowAttribute DwmGetWindowAttribute

wtsapi32

WTSRegisterSessionNotification WTSUnRegisterSessionNotification

gdiplus

GdipDeleteBrush GdiplusStartup GdiplusShutdown GdipSetStringFormatAlign GdipDisposeImage GdipCreateSolidFill GdipCloneImage GdipCreateBitmapFromHBITMAP GdipFlush GdipAlloc GdipDeleteStringFormat GdipFree GdipCreateStringFormat GdipCreateMatrix GdipDeleteMatrix GdipCloneBrush GdipCreateFromHDC GdipDeleteGraphics GdipSetSmoothingMode GdipSetWorldTransform GdipTranslateWorldTransform GdipScaleWorldTransform GdipFillEllipse GdipDrawImageI GdipCreateFontFamilyFromName GdipDeleteFontFamily GdipCreateFont GdipDeleteFont GdipDrawString

msi

ord70 ord45 ord118 ord8 ord32 ord159 ord92 ord160

wininet

InternetReadFile InternetOpenUrlW InternetOpenW InternetQueryDataAvailable HttpQueryInfoW InternetCheckConnectionW InternetCloseHandle

setupapi

SetupDiGetDeviceRegistryPropertyW SetupDiDestroyDeviceInfoList SetupDiEnumDeviceInfo SetupDiGetClassDevsW

api-ms-win-core-winrt-error-l1-1-1

RoOriginateLanguageException

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory

Name

.text

Size

3.2MB

Virtual Size

3.2MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

577KB

Virtual Size

576KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

159KB

Virtual Size

233KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

213KB

Virtual Size

212KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

328KB

Virtual Size

328KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

13KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-20_21d277f34b320c8782f1bed102b5c20a_icedid_luca-stealer_njrat_stealc_vidar

version

urlmon

kernel32

user32

gdi32

winspool.drv

advapi32

shell32

ole32

oleaut32

iphlpapi

winhttp

crypt32

ws2_32

sspicli

ext-ms-win-networking-wlanapi-l1-1-0

wlanapi

shlwapi

api-ms-win-shcore-scaling-l1-1-1

dwmapi

wtsapi32

gdiplus

msi

wininet

setupapi

api-ms-win-core-winrt-error-l1-1-1

api-ms-win-core-winrt-l1-1-0

generic