2026-08-25_8aaec634bc1e67313a479c5cc2a1ae2a_icedid_luca-stealer_njrat_stealc_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-25_8aaec634bc1e67313a479c5cc2a1ae2a_icedid_luca-stealer_njrat_stealc_vidar
Size 4.5MB
Sample260826-wt5q7a1vbv
SHA256 05266d0d5a3c9af48af55e7814227c923698fa8a0de6f83aa5dc9415a24e6ecd
MD5 8aaec634bc1e67313a479c5cc2a1ae2a
SHA1 6f66700205791d69df32b3fa4d4b02dd9d5e4f2f
SHA512 a825eefd24cfc768312bf03b9f7ae3733ad92d508fda5cecfc9cd27aca5b711f68f9a09efae10728a46559bad91cd5eca8b2b38b6f4ad9b3c14f2e1067867e0a
SSDEEP 49152:9VODyl5egDHjvLdktzcMkMD0qSP9VjTp0nuduVwf95P8m37O1A1:9TXDfwX
TLSH
T15A267D2A62A811E9E07AC178CA8B8707EF7278550F2476EF13E046591F2BEE05F7D711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-25_8aaec634bc1e67313a479c5cc2a1ae2a_icedid_luca-stealer_njrat_stealc_vidar

File Explorer

2026-08-25_8aaec634bc1e67313a479c5cc2a1ae2a_icedid_luca-stealer_njrat_stealc_vidar

.exe 4.5MB

2026-08-25_8aaec634bc1e67313a479c5cc2a1ae2a_icedid_luca-stealer_njrat_stealc_vidar

IMPHASH 66875a5492468e20d1dfde3bd3659d6c
SHA256 05266d0d5a3c9af48af55e7814227c923698fa8a0de6f83aa5dc9415a24e6ecd
MD5 8aaec634bc1e67313a479c5cc2a1ae2a
SHA1 6f66700205791d69df32b3fa4d4b02dd9d5e4f2f
SHA512 a825eefd24cfc768312bf03b9f7ae3733ad92d508fda5cecfc9cd27aca5b711f68f9a09efae10728a46559bad91cd5eca8b2b38b6f4ad9b3c14f2e1067867e0a
SSDEEP 49152:9VODyl5egDHjvLdktzcMkMD0qSP9VjTp0nuduVwf95P8m37O1A1:9TXDfwX
TLSH
T15A267D2A62A811E9E07AC178CA8B8707EF7278550F2476EF13E046591F2BEE05F7D711
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1322020

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

FreeResource GetUserDefaultLCID ReadFile SetLastError GetCommandLineW FindNextFileW GetModuleFileNameW PeekNamedPipe FindClose GetFileAttributesW GetLastError GlobalFlags GetSystemInfo GetCurrentDirectoryW SetCurrentDirectoryW CreateProcessW VirtualQuery HeapFree HeapReAlloc HeapAlloc GetProcessHeap GetLocalTime VirtualProtect VirtualFree VirtualAlloc SuspendThread GetThreadContext FlushInstructionCache SetThreadContext WriteFile CreateFileW GetNamedPipeInfo WaitNamedPipeW GetModuleHandleA GetLocaleInfoA LoadLibraryA VerSetConditionMask WriteConsoleW SetEndOfFile HeapSize SetStdHandle SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP GetACP IsValidCodePage FindFirstFileExW FlushFileBuffers EnumSystemLocalesW GlobalUnlock LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW FlsFree FlsSetValue FlsGetValue FlsAlloc GetFileSizeEx GetConsoleOutputCP ReadConsoleW GetConsoleMode SetFilePointerEx GetFileType GetStdHandle GetCommandLineA GetModuleHandleExW FreeLibraryAndExitThread ExitThread TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount RaiseException RtlPcToFileHeader RtlUnwindEx InitializeSListHead GetStartupInfoW IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext GetCPInfo GetStringTypeW LCMapStringEx DecodePointer EncodePointer InitializeCriticalSectionEx SleepConditionVariableSRW WakeAllConditionVariable TryAcquireSRWLockExclusive AcquireSRWLockExclusive ReleaseSRWLockExclusive LoadLibraryExW GlobalLock GlobalFree GlobalAlloc LeaveCriticalSection GetCurrentThreadId MulDiv IsDebuggerPresent IsValidLocale CreateThread GetTickCount GetTimeZoneInformation QueryPerformanceCounter QueryPerformanceFrequency CloseHandle GetSystemTimeAsFileTime FreeLibrary LockResource SizeofResource LoadResource FindResourceW OutputDebugStringW Sleep WideCharToMultiByte DeleteFileW TryEnterCriticalSection EnterCriticalSection MultiByteToWideChar GetProcessId TerminateProcess ResumeThread OpenProcess CreateEventW ExitProcess OpenEventW SetWaitableTimer CreateWaitableTimerW IsBadStringPtrW GetCurrentProcess GetCurrentProcessId GetCurrentThread LoadLibraryW GetModuleHandleW GetProcAddress InitializeCriticalSection DeleteCriticalSection GetLocaleInfoW

user32

TranslateMessage DispatchMessageW GetShellWindow GetWindowThreadProcessId PeekMessageW PostMessageW GetMessageW IsWindow FindWindowExW GetAncestor GetWindowRect EnumWindows GetWindowInfo SetWindowLongPtrW CallWindowProcW GetAsyncKeyState PostQuitMessage DefWindowProcW FindWindowW MapVirtualKeyA GetKeyNameTextA SetFocus MsgWaitForMultipleObjects LoadIconW RegisterClassExW CreateWindowExW ShowWindow UpdateWindow DestroyWindow UnregisterClassW SetWindowPos GetWindowLongPtrW SendMessageW GetSystemMetrics SetWindowLongA MessageBoxW SetWindowsHookExA UnhookWindowsHookEx GetClassInfoExW ReleaseDC GetClientRect GetDC LoadImageW GetParent GetDesktopWindow LoadCursorW SetPropW RegisterClassW GetClassInfoW LoadStringW RemovePropW AdjustWindowRectEx GetMessageExtraInfo SetPropA GetPropW SetForegroundWindow EnumDisplayMonitors ScreenToClient WindowFromPoint GetCapture IsChild TrackMouseEvent GetKeyboardLayout GetForegroundWindow GetPropA SetLayeredWindowAttributes BringWindowToTop SetCursor SetWindowLongW IsWindowUnicode IsIconic SetCursorPos CallNextHookEx ClientToScreen SetCapture SetWindowsHookExW ReleaseCapture GetCursorPos GetKeyState GetWindowLongW MonitorFromWindow WaitForInputIdle OpenClipboard GetMonitorInfoW CloseClipboard EmptyClipboard GetClipboardData SetClipboardData

gdi32

CreateRectRgn SelectObject CreateDIBSection SetDIBColorTable CreateCompatibleDC GetStockObject GetDeviceCaps DeleteDC GetObjectW DeleteObject

advapi32

RegQueryValueW RegOpenCurrentUser RegOpenKeyExW RegQueryValueExW RegCloseKey

shell32

ShellExecuteW

ole32

CoCreateInstance CreateStreamOnHGlobal CoInitializeEx CoUninitialize

oleaut32

SystemTimeToVariantTime VarUdateFromDate

comctl32

ImageList_Create ImageList_Destroy ImageList_AddMasked

bcrypt

BCryptOpenAlgorithmProvider BCryptGetProperty BCryptGenerateSymmetricKey BCryptEncrypt BCryptCloseAlgorithmProvider BCryptSetProperty BCryptDecrypt BCryptCreateHash BCryptHashData BCryptDestroyHash BCryptFinishHash BCryptDestroyKey

d3d11

D3D11CreateDeviceAndSwapChain

d3dcompiler_47

D3DCompile

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

gdiplus

GdipGetImageWidth GdipCreateBitmapFromFile GdipCreateBitmapFromScan0 GdipSetCompositingMode GdipGetImagePalette GdipDeleteGraphics GdipGetImageGraphicsContext GdipBitmapLockBits GdipFree GdipGetImagePixelFormat GdipDisposeImage GdipDrawImageRectI GdipAlloc GdipCreateBitmapFromStream GdipBitmapUnlockBits GdipCloneImage GdipGetImagePaletteSize GdipGetImageHeight GdiplusShutdown GdiplusStartup

ws2_32

WSACleanup

iphlpapi

GetAdaptersInfo

dwmapi

DwmIsCompositionEnabled DwmGetColorizationColor DwmEnableBlurBehindWindow

imm32

ImmAssociateContext ImmSetCandidateWindow ImmSetCompositionWindow ImmReleaseContext ImmGetContext

Name

.text

Size

1.5MB

Virtual Size

1.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

379KB

Virtual Size

378KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

18KB

Virtual Size

33KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

57KB

Virtual Size

56KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.detourc

Size

8KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.detourd

Size

512B

Virtual Size

24B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

2.5MB

Virtual Size

2.5MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

8KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-25_8aaec634bc1e67313a479c5cc2a1ae2a_icedid_luca-stealer_njrat_stealc_vidar

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

comctl32

bcrypt

d3d11

d3dcompiler_47

version

gdiplus

ws2_32

iphlpapi

dwmapi

imm32

generic