2026-08-17_616bb6b96ce60f85556677651500ad52_icedid_luca-stealer_njrat_stealc_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-17_616bb6b96ce60f85556677651500ad52_icedid_luca-stealer_njrat_stealc_vidar
Size 4.8MB
Sample260818-dvbkmavfjf
SHA256 005a4154750bc54d3d204f3f8e912a12f117eb692b5d67c0c6f4b79b05080f0f
MD5 616bb6b96ce60f85556677651500ad52
SHA1 6b40125b5f7b36c0c2d1f5befa7594101e5e3c37
SHA512 c53ced59bd9fbd3cd2aa3d6100c26e4ed88fd71dbac74134aa9d22b118e950acf708e96272aff9ad0185264b366d5751289b077071821b33398cff2b8a457b99
SSDEEP 49152:VQEP1yqBDFntk0KbDYvOUTDSXM7/lAmewtCTUyTT5rfXzzfs0:XyGeAS8rSmuTUyTTlfM0
TLSH
T16736F147B2A405FCC47B92399646A61BFB36785913209BCF13E085662F933E09FBE711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-17_616bb6b96ce60f85556677651500ad52_icedid_luca-stealer_njrat_stealc_vidar

File Explorer

2026-08-17_616bb6b96ce60f85556677651500ad52_icedid_luca-stealer_njrat_stealc_vidar

.exe 4.8MB

2026-08-17_616bb6b96ce60f85556677651500ad52_icedid_luca-stealer_njrat_stealc_vidar

IMPHASH 2327926916753620a0d575d4c8e6c229
SHA256 005a4154750bc54d3d204f3f8e912a12f117eb692b5d67c0c6f4b79b05080f0f
MD5 616bb6b96ce60f85556677651500ad52
SHA1 6b40125b5f7b36c0c2d1f5befa7594101e5e3c37
SHA512 c53ced59bd9fbd3cd2aa3d6100c26e4ed88fd71dbac74134aa9d22b118e950acf708e96272aff9ad0185264b366d5751289b077071821b33398cff2b8a457b99
SSDEEP 49152:VQEP1yqBDFntk0KbDYvOUTDSXM7/lAmewtCTUyTT5rfXzzfs0:XyGeAS8rSmuTUyTTlfM0
TLSH
T16736F147B2A405FCC47B92399646A61BFB36785913209BCF13E085662F933E09FBE711
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2662376

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

ExitProcess AllocConsole FreeConsole SetConsoleTitleA CreateFileA CreateFileW DeleteFileA DeleteFileW GetFileSize ReadFile WriteFile GetTempPathW GetTempPathA GetCurrentThreadId GetTickCount64 LoadLibraryA LocalAlloc LocalFree lstrlenA MoveFileExA GetTickCount Sleep WriteConsoleW SetEndOfFile ReadConsoleW HeapReAlloc HeapSize GetConsoleMode GetConsoleOutputCP FlushFileBuffers GetStringTypeW SetStdHandle GetProcessHeap SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW WideCharToMultiByte MultiByteToWideChar GetCommandLineW GetCommandLineA GetCPInfo GetOEMCP GetModuleHandleW CloseHandle QueryPerformanceCounter QueryPerformanceFrequency ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive InitializeCriticalSectionEx GetSystemTimeAsFileTime GetProcAddress RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW GetCurrentProcessId InitializeSListHead RtlPcToFileHeader RaiseException RtlUnwindEx GetLastError SetLastError EncodePointer EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW CreateThread ExitThread FreeLibraryAndExitThread GetModuleHandleExW GetModuleFileNameW GetStdHandle HeapAlloc HeapFree FlsAlloc FlsGetValue FlsSetValue FlsFree VirtualProtect CompareStringW LCMapStringW GetFileType WaitForSingleObject GetExitCodeProcess CreateProcessW GetFileAttributesExW GetFileSizeEx SetFilePointerEx FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP

user32

LoadCursorW SetWindowLongA SetWindowPos ShowWindow CreateWindowExA RegisterClassExA PostQuitMessage DefWindowProcW LoadIconW FindWindowA MessageBoxW MessageBoxA GetSystemMetrics GetAsyncKeyState IsWindow DispatchMessageW TranslateMessage GetMessageW GetWindowThreadProcessId

gdi32

CreateSolidBrush

Name

.text

Size

165KB

Virtual Size

164KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

56KB

Virtual Size

56KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

10KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

248B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.zl6j

Size

4.6MB

Virtual Size

4.6MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-17_616bb6b96ce60f85556677651500ad52_icedid_luca-stealer_njrat_stealc_vidar

kernel32

user32

gdi32

generic