2026-08-13_e4026494e1277286a704fa49d0b23d75_icedid_luca-stealer_njrat_stealc_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-13_e4026494e1277286a704fa49d0b23d75_icedid_luca-stealer_njrat_stealc_vidar
Size 5.3MB
Sample260813-wctmlavfqa
SHA256 1a30cacd9b8e04f45bf6aa3f79c7627e7115ae7c4eb51401cc9fbf1d2f3d3b4a
MD5 e4026494e1277286a704fa49d0b23d75
SHA1 5a37836d623eb75a4b678ca3418513af5449e382
SHA512 60f41510eefbdc727f513465d71e7926478006dc5b23dc8b1600bcf9f4ab251742b6b34da018869fba0c304e8c60091bdf672d1061c510e23ab1f765b4005b7d
SSDEEP 49152:6DqpQ6y2pCIU5S0VaMuxtVOsbvF8LqpEvAc3TQptI:6SCFu4HCW
TLSH
T1FC46E75ADAB641E1D4FAD1398627762BFC713C5EC230A707A780AB175B36760E63E700
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-13_e4026494e1277286a704fa49d0b23d75_icedid_luca-stealer_njrat_stealc_vidar

File Explorer

2026-08-13_e4026494e1277286a704fa49d0b23d75_icedid_luca-stealer_njrat_stealc_vidar

.exe 5.3MB

2026-08-13_e4026494e1277286a704fa49d0b23d75_icedid_luca-stealer_njrat_stealc_vidar

IMPHASH dd39d42f21dd61e1d677629e70403bf9
SHA256 1a30cacd9b8e04f45bf6aa3f79c7627e7115ae7c4eb51401cc9fbf1d2f3d3b4a
MD5 e4026494e1277286a704fa49d0b23d75
SHA1 5a37836d623eb75a4b678ca3418513af5449e382
SHA512 60f41510eefbdc727f513465d71e7926478006dc5b23dc8b1600bcf9f4ab251742b6b34da018869fba0c304e8c60091bdf672d1061c510e23ab1f765b4005b7d
SSDEEP 49152:6DqpQ6y2pCIU5S0VaMuxtVOsbvF8LqpEvAc3TQptI:6SCFu4HCW
TLSH
T1FC46E75ADAB641E1D4FAD1398627762BFC713C5EC230A707A780AB175B36760E63E700
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

3419624

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Build\Build_2043c_D20260407T163850\fa_rss\Release\PCAppStore.pdb

urlmon

URLDownloadToFileW CreateUri

ws2_32

send WSAConnectByNameW recv WSAGetLastError shutdown WSAStartup socket closesocket WSACleanup

winhttp

WinHttpConnect WinHttpSetTimeouts WinHttpSendRequest WinHttpCloseHandle WinHttpOpenRequest WinHttpOpen WinHttpReceiveResponse WinHttpQueryDataAvailable WinHttpSetOption WinHttpReadData WinHttpQueryHeaders

wininet

InternetConnectW InternetCloseHandle HttpSendRequestW HttpQueryInfoW InternetOpenW InternetQueryDataAvailable HttpOpenRequestW InternetSetOptionW InternetReadFile HttpAddRequestHeadersW

secur32

ApplyControlToken InitializeSecurityContextW DecryptMessage FreeCredentialsHandle AcquireCredentialsHandleW QueryContextAttributesW DeleteSecurityContext EncryptMessage FreeContextBuffer

wtsapi32

WTSRegisterSessionNotification WTSUnRegisterSessionNotification

shlwapi

PathFindFileNameW PathCreateFromUrlW PathAddBackslashW UrlCreateFromPathW AssocCreate SHCreateStreamOnFileEx PathRenameExtensionW

dwmapi

DwmSetWindowAttribute DwmGetWindowAttribute

api-ms-win-shcore-scaling-l1-1-1

GetDpiForMonitor

msi

ord92 ord45 ord32 ord118 ord8 ord160 ord159 ord70

kernel32

EncodePointer LCMapStringEx CompareStringEx GetStartupInfoW InterlockedPushEntrySList RtlUnwindEx InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree GetCPInfo RtlUnwind CreateThread WriteConsoleW GetCommandLineA GetOEMCP GetACP IsValidCodePage GetTimeZoneInformation SetStdHandle ReadConsoleW SetFilePointerEx GetFileSizeEx DeleteFileW IsDebuggerPresent DebugBreak OutputDebugStringW CloseHandle GetLastError SetLastError HeapAlloc HeapFree GetProcessHeap ReleaseSemaphore ReleaseMutex WaitForSingleObject WaitForSingleObjectEx OpenSemaphoreW CreateMutexExW CreateSemaphoreExW GetCurrentProcessId GetCurrentThreadId GetModuleFileNameA GetModuleHandleW GetModuleHandleExW GetProcAddress FormatMessageW WideCharToMultiByte LoadResource LockResource SizeofResource FindResourceW SetEnvironmentVariableW SetEvent ResetEvent CreateEventW Sleep WaitForMultipleObjects GetModuleFileNameW CreateFileW OpenEventW GetOverlappedResult ReadDirectoryChangesW CreateMutexW FreeLibrary LoadLibraryW ExpandEnvironmentStringsW GetEnvironmentVariableW GetTickCount64 SetCurrentDirectoryW ReadFile CreateProcessW GetLocaleInfoEx GetConsoleOutputCP CopyFileA OpenProcess IsProcessCritical QueryFullProcessImageNameW CreateToolhelp32Snapshot Process32FirstW Process32NextW K32EnumProcesses K32GetModuleFileNameExW GetTempPathW GetExitCodeProcess GetProcessId InitializeProcThreadAttributeList DeleteProcThreadAttributeList UpdateProcThreadAttribute GetStdHandle GetEnvironmentVariableA FindFirstFileW SetUnhandledExceptionFilter GetSystemTime SystemTimeToFileTime FileTimeToLocalFileTime LocalFree lstrcmpA FileTimeToSystemTime FlushFileBuffers GetTickCount QueryPerformanceCounter MapViewOfFile CreateFileMappingW FormatMessageA GetSystemTimeAsFileTime GetFileSize LockFileEx UnlockFile HeapDestroy HeapCompact GetSystemInfo HeapReAlloc DeleteFileA LoadLibraryA CreateFileA FlushViewOfFile GetFileAttributesExW GetFileAttributesA GetDiskFreeSpaceA GetTempPathA MultiByteToWideChar HeapSize HeapValidate UnmapViewOfFile GetFileAttributesW UnlockFileEx SetEndOfFile GetFullPathNameA SetFilePointer LockFile OutputDebugStringA GetDiskFreeSpaceW WriteFile GetFullPathNameW HeapCreate AreFileApisANSI InitializeCriticalSection EnterCriticalSection LeaveCriticalSection TryEnterCriticalSection DeleteCriticalSection DecodePointer InitializeCriticalSectionEx GlobalAlloc GlobalUnlock GlobalLock GlobalFree LoadLibraryExW CreateDirectoryW FindFirstFileExW FindNextFileW RemoveDirectoryW GetUserDefaultUILanguage LCIDToLocaleName VerSetConditionMask VerifyVersionInfoW GetSystemFirmwareTable GetCommandLineW OpenFileMappingW OpenMutexW FreeEnvironmentStringsW K32GetModuleBaseNameW K32EnumProcessModules GetEnvironmentStringsW RtlPcToFileHeader ExitThread FreeLibraryAndExitThread ExitProcess GetDriveTypeW GetFileType SleepConditionVariableSRW WakeAllConditionVariable UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext InitializeSListHead TerminateProcess PeekNamedPipe FindClose SystemTimeToTzSpecificLocalTime FlsAlloc FlsGetValue FlsSetValue FlsFree VirtualProtect GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetConsoleMode RaiseException GetExitCodeThread ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive GetCurrentDirectoryW GetFileInformationByHandle SetFileInformationByHandle GetFileInformationByHandleEx IsProcessorFeaturePresent GetStringTypeW InitOnceBeginInitialize InitOnceComplete QueryPerformanceFrequency GetCurrentProcess WakeConditionVariable

user32

GetShellWindow SetCursorPos GetWindowTextW SetWindowPos GetPhysicalCursorPos GetSystemMetrics GetAsyncKeyState CallNextHookEx UnhookWindowsHookEx GetForegroundWindow UnhookWinEvent FindWindowExW DefWindowProcW PostQuitMessage RegisterClassW CreateWindowExW DestroyWindow BeginPaint EndPaint InvalidateRect EqualRect SetWindowsHookExW EnumChildWindows WindowFromPoint SetCapture GetCursorPos IsChild PostThreadMessageW SendMessageW GetMessageW GetThreadDpiAwarenessContext SetThreadDpiAwarenessContext GetWindow EnumWindows FindWindowW IntersectRect GetMonitorInfoW MonitorFromRect GetCapture TrackMouseEvent ChangeWindowMessageFilterEx LoadIconW TrackPopupMenu RemoveMenu AppendMenuW InsertMenuW MonitorFromPoint GetWindowThreadProcessId GetClassNameW ReleaseDC GetDC SendInput EndDialog IsWindowVisible DialogBoxParamW SetWinEventHook PeekMessageW DispatchMessageW TranslateMessage KillTimer SetTimer SetForegroundWindow SetFocus IsIconic ShowWindow IsWindow ReleaseCapture PostMessageW GetMenuItemCount DestroyMenu CreatePopupMenu GetClassInfoExW RegisterClassExW AttachThreadInput SendMessageTimeoutW LoadCursorW MonitorFromWindow UnregisterClassW GetWindowPlacement IsZoomed SetWindowTextW AdjustWindowRectEx SetWindowLongPtrW keybd_event SetWindowPlacement RegisterWindowMessageW OpenIcon EmptyClipboard SetClipboardData CloseClipboard OpenClipboard SetClassLongPtrW EnumDisplayMonitors PtInRect UpdateWindow GetDpiForWindow GetWindowLongPtrW SetWindowLongW SetRectEmpty FillRect ScreenToClient MapWindowPoints GetWindowRect GetClientRect

gdi32

DeleteObject SelectObject DeleteDC CreateCompatibleDC CreateCompatibleBitmap BitBlt CreateSolidBrush

winspool.drv

EnumPrintersW

comdlg32

GetOpenFileNameW

advapi32

RegCreateKeyExW RegNotifyChangeKeyValue GetUserNameW RegGetValueW EventUnregister RegCloseKey RegDeleteValueW RegOpenKeyExW RegQueryValueExW RegSetValueExW EventRegister EventSetInformation EventWriteTransfer

shell32

ShellExecuteW SHAppBarMessage SHGetKnownFolderPath SHQueryRecycleBinW SHEmptyRecycleBinW SHGetFolderPathW ShellExecuteExW CommandLineToArgvW Shell_NotifyIconW

ole32

CoCreateInstance RegisterDragDrop CoInitializeSecurity CoTaskMemFree CoUninitialize CoInitialize OleRun CoSetProxyBlanket OleInitialize CreateStreamOnHGlobal CoTaskMemAlloc RevokeDragDrop CoAllowSetForegroundWindow CoInitializeEx OleUninitialize CoCreateFreeThreadedMarshaler

oleaut32

VariantClear VariantInit SysFreeString SysAllocString GetErrorInfo VariantChangeType SetErrorInfo SysStringLen

iphlpapi

IcmpCreateFile IcmpCloseHandle

bcrypt

BCryptGenRandom BCryptCreateHash BCryptHashData BCryptDestroyHash BCryptCloseAlgorithmProvider BCryptFinishHash BCryptOpenAlgorithmProvider

crypt32

CryptDecodeObjectEx CertFindCertificateInStore CertFreeCertificateContext CertGetNameStringW CryptQueryObject CertCloseStore CertOpenStore CryptDecodeObject CryptMsgOpenToDecode CryptMsgClose CryptMsgUpdate CryptMsgGetParam

ext-ms-win-networking-wlanapi-l1-1-0

WlanOpenHandle WlanCloseHandle WlanEnumInterfaces WlanFreeMemory WlanGetAvailableNetworkList

wlanapi

WlanAllocateMemory WlanRegisterNotification WlanScan

api-ms-win-core-version-l1-1-0

VerQueryValueW

api-ms-win-core-version-l1-1-1

GetFileVersionInfoW

gdiplus

GdipCloneImage GdipCreateSolidFill GdipDeleteBrush GdipCloneBrush GdipDeleteMatrix GdipCreateBitmapFromHBITMAP GdipFree GdipAlloc GdiplusShutdown GdiplusStartup GdipFlush GdipCreateFromHDC GdipDisposeImage GdipDeleteGraphics GdipSetSmoothingMode GdipSetWorldTransform GdipTranslateWorldTransform GdipScaleWorldTransform GdipFillEllipse GdipDrawImageI GdipCreateFontFamilyFromName GdipDeleteFontFamily GdipSetStringFormatAlign GdipCreateFont GdipDeleteFont GdipDrawString GdipCreateStringFormat GdipDeleteStringFormat GdipCreateMatrix

setupapi

SetupDiDestroyDeviceInfoList SetupDiGetClassDevsW SetupDiGetDeviceRegistryPropertyW SetupDiEnumDeviceInfo

version

GetFileVersionInfoSizeW

api-ms-win-core-winrt-error-l1-1-1

RoOriginateLanguageException

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory

Name

.text

Size

3.7MB

Virtual Size

3.7MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

874KB

Virtual Size

873KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

190KB

Virtual Size

319KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

211KB

Virtual Size

211KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

313KB

Virtual Size

313KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

14KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-13_e4026494e1277286a704fa49d0b23d75_icedid_luca-stealer_njrat_stealc_vidar

urlmon

ws2_32

winhttp

wininet

secur32

wtsapi32

shlwapi

dwmapi

api-ms-win-shcore-scaling-l1-1-1

msi

kernel32

user32

gdi32

winspool.drv

comdlg32

advapi32

shell32

ole32

oleaut32

iphlpapi

bcrypt

crypt32

ext-ms-win-networking-wlanapi-l1-1-0

wlanapi

api-ms-win-core-version-l1-1-0

api-ms-win-core-version-l1-1-1

gdiplus

setupapi

version

api-ms-win-core-winrt-error-l1-1-1

api-ms-win-core-winrt-l1-1-0

generic