2026-08-16_6d91f7df634be1853a1196bb1f359fb0_icedid_luca-stealer_njrat_stealc_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-16_6d91f7df634be1853a1196bb1f359fb0_icedid_luca-stealer_njrat_stealc_vidar
Size 5.1MB
Sample260816-rf5rtacn6t
SHA256 a9378b0116ed6af9bcfc3a78e55c1cc745a95f76f06deb351d9b1f4da5d5491f
MD5 6d91f7df634be1853a1196bb1f359fb0
SHA1 6196288398267c61a0942cb338fa44faa863510f
SHA512 85d4d195bc8ea0584a9df06e6b14f1137fe6c62cdc84cbbb05b864656cb637dac28b9fc8128baa8c8925a595c00e83c7413928e8e6322f4bdc89dc80470822a7
SSDEEP 49152:wzw66pZqHqET+AZJSeiJuB7ZFfmVbEpWz3TQpt5y:0zJqM/cC6
TLSH
T15746C75AEA7641D1C4F9C03CD593622EF87138A6933097C7A681AA175B33BF4E63E740
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-16_6d91f7df634be1853a1196bb1f359fb0_icedid_luca-stealer_njrat_stealc_vidar

File Explorer

2026-08-16_6d91f7df634be1853a1196bb1f359fb0_icedid_luca-stealer_njrat_stealc_vidar

.exe 5.1MB

2026-08-16_6d91f7df634be1853a1196bb1f359fb0_icedid_luca-stealer_njrat_stealc_vidar

IMPHASH 22af88b332758b63dcd4e3de5fb45da9
SHA256 a9378b0116ed6af9bcfc3a78e55c1cc745a95f76f06deb351d9b1f4da5d5491f
MD5 6d91f7df634be1853a1196bb1f359fb0
SHA1 6196288398267c61a0942cb338fa44faa863510f
SHA512 85d4d195bc8ea0584a9df06e6b14f1137fe6c62cdc84cbbb05b864656cb637dac28b9fc8128baa8c8925a595c00e83c7413928e8e6322f4bdc89dc80470822a7
SSDEEP 49152:wzw66pZqHqET+AZJSeiJuB7ZFfmVbEpWz3TQpt5y:0zJqM/cC6
TLSH
T15746C75AEA7641D1C4F9C03CD593622EF87138A6933097C7A681AA175B33BF4E63E740
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

3247912

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Build\Build_2026_D20260115T171611\fa_rss\Release\PCAppStore.pdb

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

urlmon

CreateUri URLDownloadToFileW

kernel32

CreateFileW OpenEventW GetOverlappedResult ReadDirectoryChangesW LocalFree CreateDirectoryW FreeLibrary LoadLibraryW ExpandEnvironmentStringsW HeapDestroy HeapReAlloc HeapSize GetTickCount64 FindResourceExW VerSetConditionMask FindClose FindFirstFileExW FindNextFileW GetFileAttributesW ReadFile RemoveDirectoryW CreateProcessW OpenProcess VerifyVersionInfoW LCIDToLocaleName GetUserDefaultUILanguage GetLocaleInfoEx GetConsoleOutputCP K32EnumProcessModules K32GetModuleBaseNameW GetStartupInfoW GetTickCount CopyFileA IsProcessCritical QueryFullProcessImageNameW CreateToolhelp32Snapshot Process32FirstW Process32NextW K32EnumProcesses K32GetModuleFileNameExW GetTempPathW GetExitCodeProcess GetProcessId InitializeProcThreadAttributeList DeleteProcThreadAttributeList UpdateProcThreadAttribute OpenMutexW OpenFileMappingW MapViewOfFile GetStdHandle GetEnvironmentVariableA SetCurrentDirectoryW FindFirstFileW GetCurrentProcess GetSystemTime SystemTimeToFileTime FileTimeToLocalFileTime lstrcmpA FileTimeToSystemTime FlushFileBuffers QueryPerformanceCounter CreateFileMappingW FormatMessageA GetSystemTimeAsFileTime GetFileSize LockFileEx UnlockFile HeapCompact GetSystemInfo DeleteFileA LoadLibraryA CreateFileA FlushViewOfFile GetFileAttributesExW GetFileAttributesA GetDiskFreeSpaceA GetTempPathA MultiByteToWideChar HeapValidate UnmapViewOfFile CreateMutexW UnlockFileEx SetEndOfFile GetFullPathNameA SetFilePointer LockFile OutputDebugStringA GetDiskFreeSpaceW WriteFile GetFullPathNameW HeapCreate AreFileApisANSI SetEnvironmentVariableW GetProcessHeap WaitForMultipleObjects TryEnterCriticalSection DeleteCriticalSection DecodePointer InitializeCriticalSectionEx GlobalAlloc GlobalUnlock GlobalLock LoadLibraryExW GetEnvironmentVariableW GetCommandLineA RaiseException GetExitCodeThread ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive GetCurrentDirectoryW GetFileInformationByHandle SetFileInformationByHandle GetFileInformationByHandleEx GetStringTypeW InitOnceBeginInitialize InitOnceComplete QueryPerformanceFrequency SleepConditionVariableSRW WakeConditionVariable WakeAllConditionVariable EncodePointer LCMapStringEx CompareStringEx GetCPInfo InitializeSListHead RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter Sleep IsProcessorFeaturePresent TerminateProcess RtlPcToFileHeader RtlUnwindEx GetCommandLineW InterlockedPushEntrySList GetModuleFileNameW CreateEventW ResetEvent InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree CreateThread ExitThread GetEnvironmentStringsW FreeLibraryAndExitThread ExitProcess GetDriveTypeW GetFileType PeekNamedPipe SystemTimeToTzSpecificLocalTime FindResourceW SizeofResource LockResource LoadResource WideCharToMultiByte FormatMessageW GetProcAddress GetModuleHandleExW GetModuleHandleW GetModuleFileNameA GetCurrentThreadId GetCurrentProcessId FlsAlloc FlsGetValue FlsSetValue LeaveCriticalSection FlsFree VirtualProtect GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW SetEvent SetFilePointerEx GetFileSizeEx CreateSemaphoreExW CreateMutexExW OpenSemaphoreW WaitForSingleObjectEx WaitForSingleObject ReleaseMutex InitializeCriticalSection ReleaseSemaphore WriteConsoleW FreeEnvironmentStringsW HeapAlloc HeapFree SetLastError GetLastError CloseHandle OutputDebugStringW DebugBreak IsDebuggerPresent DeleteFileW GetOEMCP GetACP IsValidCodePage GetConsoleMode RtlUnwind SetStdHandle GetTimeZoneInformation EnterCriticalSection EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW ReadConsoleW

user32

GetClassInfoExW RegisterClassExW AttachThreadInput SendMessageTimeoutW RegisterWindowMessageW UpdateWindow GetWindowLongPtrW SetWindowLongW SetRectEmpty FillRect AdjustWindowRectEx GetClientRect SetWindowTextW DestroyMenu GetCapture GetMenuItemCount InsertMenuW AppendMenuW RemoveMenu TrackPopupMenu LoadIconW ChangeWindowMessageFilterEx GetWindowPlacement UnregisterClassW MonitorFromWindow LoadCursorW EqualRect InvalidateRect EndPaint BeginPaint ShowWindow DestroyWindow CreateWindowExW RegisterClassW OpenIcon DefWindowProcW CreatePopupMenu FindWindowExW UnhookWinEvent SetCapture PtInRect SetClassLongPtrW OpenClipboard EmptyClipboard CloseClipboard SetClipboardData TrackMouseEvent GetForegroundWindow keybd_event GetShellWindow SetCursorPos GetWindowTextW SetWindowPos GetPhysicalCursorPos GetSystemMetrics GetAsyncKeyState CallNextHookEx UnhookWindowsHookEx SetWindowsHookExW EnumChildWindows WindowFromPoint ScreenToClient GetCursorPos IsChild PostThreadMessageW SendMessageW GetMessageW GetThreadDpiAwarenessContext SetThreadDpiAwarenessContext EnumDisplayMonitors FindWindowW IntersectRect GetMonitorInfoW MonitorFromRect DialogBoxParamW MonitorFromPoint SystemParametersInfoW GetWindow GetWindowThreadProcessId GetClassNameW EnumWindows ReleaseDC GetDC SendInput EndDialog IsWindowVisible SetWinEventHook PeekMessageW DispatchMessageW TranslateMessage KillTimer SetTimer IsIconic SetForegroundWindow SetFocus IsWindow GetWindowRect ReleaseCapture PostMessageW SetWindowPlacement SetWindowLongPtrW PostQuitMessage IsZoomed

gdi32

CreateCompatibleBitmap CreateCompatibleDC DeleteDC SelectObject DeleteObject CreateSolidBrush BitBlt

winspool.drv

EnumPrintersW

comdlg32

GetOpenFileNameW

advapi32

EventSetInformation RegGetValueW EventUnregister EventWriteTransfer EventRegister RegNotifyChangeKeyValue RegCreateKeyExW GetUserNameW RegSetValueExW RegQueryValueExW RegOpenKeyExW RegDeleteValueW RegCloseKey

shell32

SHEmptyRecycleBinW SHQueryRecycleBinW SHGetFolderPathW SHGetKnownFolderPath SHAppBarMessage ShellExecuteW ShellExecuteExW Shell_NotifyIconW CommandLineToArgvW

ole32

RevokeDragDrop CoTaskMemAlloc OleInitialize CoSetProxyBlanket CoInitializeSecurity OleRun CoCreateFreeThreadedMarshaler CoCreateInstance RegisterDragDrop CoInitializeEx CoTaskMemFree CoUninitialize CoAllowSetForegroundWindow CoInitialize

oleaut32

VariantInit VariantChangeType SysFreeString SysAllocString SysStringLen VariantClear GetErrorInfo SetErrorInfo

iphlpapi

IcmpCloseHandle IcmpCreateFile

winhttp

WinHttpConnect WinHttpCloseHandle WinHttpOpen WinHttpReceiveResponse WinHttpReadData WinHttpSetTimeouts WinHttpSendRequest WinHttpQueryDataAvailable WinHttpQueryHeaders WinHttpOpenRequest

crypt32

CryptMsgClose CryptQueryObject CertGetNameStringW CertFreeCertificateContext CertFindCertificateInStore CertCloseStore CertOpenStore CryptDecodeObjectEx CryptDecodeObject CryptMsgOpenToDecode CryptMsgUpdate CryptMsgGetParam

ws2_32

WSAConnectByNameW closesocket recv send shutdown socket WSAStartup WSACleanup WSAGetLastError

sspicli

QueryContextAttributesW DecryptMessage EncryptMessage FreeContextBuffer FreeCredentialsHandle ApplyControlToken DeleteSecurityContext InitializeSecurityContextW AcquireCredentialsHandleW

ext-ms-win-networking-wlanapi-l1-1-0

WlanOpenHandle WlanCloseHandle WlanFreeMemory WlanGetAvailableNetworkList WlanEnumInterfaces

wlanapi

WlanRegisterNotification WlanScan WlanAllocateMemory

shlwapi

PathCreateFromUrlW PathFindFileNameW PathRenameExtensionW PathAddBackslashW SHCreateStreamOnFileEx UrlCreateFromPathW AssocCreate

api-ms-win-shcore-scaling-l1-1-1

GetDpiForMonitor

dwmapi

DwmSetWindowAttribute DwmGetWindowAttribute

wtsapi32

WTSRegisterSessionNotification WTSUnRegisterSessionNotification

gdiplus

GdipDeleteBrush GdiplusStartup GdiplusShutdown GdipDisposeImage GdipSetStringFormatAlign GdipCreateSolidFill GdipCloneImage GdipCreateBitmapFromHBITMAP GdipFlush GdipAlloc GdipDeleteStringFormat GdipFree GdipCreateStringFormat GdipCreateMatrix GdipDeleteMatrix GdipCloneBrush GdipCreateFromHDC GdipDeleteGraphics GdipSetSmoothingMode GdipSetWorldTransform GdipTranslateWorldTransform GdipScaleWorldTransform GdipFillEllipse GdipDrawImageI GdipCreateFontFamilyFromName GdipDeleteFontFamily GdipCreateFont GdipDeleteFont GdipDrawString

msi

ord160 ord70 ord45 ord8 ord32 ord159 ord118 ord92

wininet

InternetOpenUrlW InternetReadFile InternetOpenW InternetSetOptionW HttpQueryInfoW InternetCheckConnectionW InternetQueryDataAvailable InternetCloseHandle

setupapi

SetupDiGetDeviceRegistryPropertyW SetupDiDestroyDeviceInfoList SetupDiEnumDeviceInfo SetupDiGetClassDevsW

api-ms-win-core-winrt-error-l1-1-1

RoOriginateLanguageException

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory

Name

.text

Size

3.6MB

Virtual Size

3.6MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

837KB

Virtual Size

836KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

184KB

Virtual Size

315KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

257KB

Virtual Size

256KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

328KB

Virtual Size

328KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

13KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-16_6d91f7df634be1853a1196bb1f359fb0_icedid_luca-stealer_njrat_stealc_vidar

version

urlmon

kernel32

user32

gdi32

winspool.drv

comdlg32

advapi32

shell32

ole32

oleaut32

iphlpapi

winhttp

crypt32

ws2_32

sspicli

ext-ms-win-networking-wlanapi-l1-1-0

wlanapi

shlwapi

api-ms-win-shcore-scaling-l1-1-1

dwmapi

wtsapi32

gdiplus

msi

wininet

setupapi

api-ms-win-core-winrt-error-l1-1-1

api-ms-win-core-winrt-l1-1-0

generic