2026-09-09_cd80deafabd01bcc4147ad1b614a6a96_icedid_luca-stealer_njrat_stealc_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-09_cd80deafabd01bcc4147ad1b614a6a96_icedid_luca-stealer_njrat_stealc_vidar
Size 4.5MB
Sample260910-3a5qeahq5s
SHA256 9a4627a76b30c8e30fead7c40f7535eb184620a4b70c0f73a481c4edab0f870e
MD5 cd80deafabd01bcc4147ad1b614a6a96
SHA1 9027b51201e1afc8d42a127c312adb060c04f86e
SHA512 c2bdce5a37703ffe39eaf11e6918e2479a638da55714d81a995426ed64a3602609d142c6f240a125ec2f307aa187edbf6cd4b77507363b03d1f1e4a21d0f3442
SSDEEP 49152:Wzm4cX5X74xFFq3+ZBtSRQJdJF3upz3TQptO:QwmtBdiCA
TLSH
T14226C64BEA7651E0C4F9C03A9553622BFC71389A833097C7A641AB575B33BE4E93E740
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-09_cd80deafabd01bcc4147ad1b614a6a96_icedid_luca-stealer_njrat_stealc_vidar

File Explorer

2026-09-09_cd80deafabd01bcc4147ad1b614a6a96_icedid_luca-stealer_njrat_stealc_vidar

.exe 4.5MB

2026-09-09_cd80deafabd01bcc4147ad1b614a6a96_icedid_luca-stealer_njrat_stealc_vidar

IMPHASH 3d2ec4c276722720b99a4ef2ef1b8cf3
SHA256 9a4627a76b30c8e30fead7c40f7535eb184620a4b70c0f73a481c4edab0f870e
MD5 cd80deafabd01bcc4147ad1b614a6a96
SHA1 9027b51201e1afc8d42a127c312adb060c04f86e
SHA512 c2bdce5a37703ffe39eaf11e6918e2479a638da55714d81a995426ed64a3602609d142c6f240a125ec2f307aa187edbf6cd4b77507363b03d1f1e4a21d0f3442
SSDEEP 49152:Wzm4cX5X74xFFq3+ZBtSRQJdJF3upz3TQptO:QwmtBdiCA
TLSH
T14226C64BEA7651E0C4F9C03A9553622BFC71389A833097C7A641AB575B33BE4E93E740
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2998648

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Build\Build_2023_D20251126T142817\fa_rss\engine\Release\PCAppStore.pdb

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

urlmon

CreateUri URLDownloadToFileW

kernel32

ResetEvent CreateEventW OpenEventW WaitForMultipleObjects GetModuleFileNameW LocalFree CreateFileW GetOverlappedResult ReadDirectoryChangesW CreateDirectoryW FreeLibrary LoadLibraryW ExpandEnvironmentStringsW GetTickCount64 VerSetConditionMask FindClose FindFirstFileExW FindNextFileW GetFileAttributesW ReadFile RemoveDirectoryW CreateProcessW OpenProcess VerifyVersionInfoW LCIDToLocaleName GetUserDefaultUILanguage GetLocaleInfoEx GetConsoleOutputCP K32EnumProcessModules K32GetModuleBaseNameW Sleep GetStartupInfoW GetTickCount CopyFileA TerminateProcess IsProcessCritical GlobalAlloc GlobalFree QueryFullProcessImageNameW CreateToolhelp32Snapshot Process32FirstW Process32NextW K32EnumProcesses K32GetModuleFileNameExW GetTempPathW GetExitCodeProcess GetProcessId InitializeProcThreadAttributeList DeleteProcThreadAttributeList UpdateProcThreadAttribute OpenMutexW OpenFileMappingW MapViewOfFile GetStdHandle GetEnvironmentVariableA SetCurrentDirectoryW FindFirstFileW GetCurrentProcess GetSystemTime SystemTimeToFileTime FileTimeToLocalFileTime lstrcmpA FileTimeToSystemTime FlushFileBuffers QueryPerformanceCounter CreateFileMappingW FormatMessageA GetSystemTimeAsFileTime GetFileSize LockFileEx UnlockFile HeapCompact GetSystemInfo DeleteFileA LoadLibraryA CreateFileA FlushViewOfFile GetFileAttributesExW GetFileAttributesA GetDiskFreeSpaceA GetTempPathA HeapValidate UnmapViewOfFile CreateMutexW UnlockFileEx SetEndOfFile GetFullPathNameA SetFilePointer LockFile OutputDebugStringA GetDiskFreeSpaceW WriteFile GetFullPathNameW SetEnvironmentVariableW AreFileApisANSI HeapReAlloc EnterCriticalSection LeaveCriticalSection TryEnterCriticalSection DeleteCriticalSection DecodePointer InitializeCriticalSectionEx GlobalUnlock GlobalLock LoadLibraryExW GetEnvironmentVariableW GetTimeZoneInformation RaiseException GetExitCodeThread ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive QueryPerformanceFrequency SleepConditionVariableSRW GetCurrentDirectoryW GetFileInformationByHandle SetFileInformationByHandle GetFileInformationByHandleEx GetStringTypeW InitOnceBeginInitialize InitOnceComplete WakeConditionVariable WakeAllConditionVariable RtlPcToFileHeader EncodePointer LCMapStringEx CompareStringEx GetCPInfo InitializeSListHead RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind GetCommandLineW UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent RtlUnwindEx SizeofResource InterlockedPushEntrySList SetEvent WideCharToMultiByte MultiByteToWideChar InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree CreateThread ExitThread ReadConsoleW FreeLibraryAndExitThread ExitProcess GetDriveTypeW GetFileType PeekNamedPipe SystemTimeToTzSpecificLocalTime LockResource LoadResource GetProcAddress GetModuleHandleExW GetModuleHandleW GetModuleFileNameA FindResourceExW GetCurrentThreadId GetCurrentProcessId CreateSemaphoreExW CreateMutexExW OpenSemaphoreW FindResourceW FlsAlloc FlsGetValue FlsSetValue FlsFree VirtualProtect GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW FormatMessageW SetFilePointerEx GetFileSizeEx GetConsoleMode EnumSystemLocalesW WaitForSingleObjectEx WaitForSingleObject ReleaseMutex ReleaseSemaphore GetProcessHeap HeapSize HeapCreate HeapFree WriteConsoleW FreeEnvironmentStringsW HeapAlloc HeapDestroy SetLastError GetLastError CloseHandle OutputDebugStringW DebugBreak IsDebuggerPresent DeleteFileW GetUserDefaultLCID GetEnvironmentStringsW GetCommandLineA GetOEMCP RtlUnwind GetACP IsValidCodePage InitializeCriticalSection IsValidLocale GetLocaleInfoW SetStdHandle

user32

CreatePopupMenu GetClassInfoExW RegisterClassExW AttachThreadInput SendMessageTimeoutW RegisterWindowMessageW UpdateWindow GetWindowLongPtrW SetWindowLongW SetRectEmpty FillRect AdjustWindowRectEx GetClientRect SetWindowTextW IsZoomed SetCapture GetMenuItemCount InsertMenuW AppendMenuW RemoveMenu TrackPopupMenu LoadIconW ChangeWindowMessageFilterEx TrackMouseEvent UnregisterClassW MonitorFromWindow LoadCursorW EqualRect InvalidateRect EndPaint BeginPaint ShowWindow DestroyWindow CreateWindowExW RegisterClassW SetWindowPlacement DefWindowProcW FindWindowExW DestroyMenu UnhookWinEvent GetForegroundWindow PtInRect SetClassLongPtrW OpenIcon OpenClipboard CloseClipboard SetClipboardData EmptyClipboard GetCapture keybd_event GetShellWindow SetCursorPos GetWindowTextW SetWindowPos wsprintfW GetPhysicalCursorPos GetSystemMetrics GetAsyncKeyState CallNextHookEx UnhookWindowsHookEx SetWindowsHookExW EnumChildWindows WindowFromPoint ScreenToClient GetCursorPos IsChild PostThreadMessageW SendMessageW GetMessageW GetThreadDpiAwarenessContext SetThreadDpiAwarenessContext EnumDisplayMonitors FindWindowW IntersectRect GetMonitorInfoW MonitorFromRect DialogBoxParamW MonitorFromPoint SystemParametersInfoW GetWindow GetWindowThreadProcessId GetClassNameW EnumWindows GetDesktopWindow ReleaseDC GetDC SendInput EndDialog IsWindowVisible SetWinEventHook PeekMessageW DispatchMessageW TranslateMessage KillTimer SetTimer SetForegroundWindow SetFocus IsWindow GetWindowRect ReleaseCapture PostMessageW IsIconic SetWindowLongPtrW PostQuitMessage GetWindowPlacement

gdi32

CreateCompatibleBitmap CreateCompatibleDC DeleteDC SelectObject DeleteObject CreateSolidBrush BitBlt

winspool.drv

EnumPrintersW

advapi32

RegNotifyChangeKeyValue RegGetValueW EventUnregister EventWriteTransfer EventSetInformation EventRegister RegCreateKeyExW RegSetKeyValueW RegDeleteValueW RegCreateKeyW GetUserNameW RegSetValueExW RegQueryValueExW RegOpenKeyExW RegCloseKey

shell32

SHEmptyRecycleBinW SHQueryRecycleBinW SHGetFolderPathW SHGetKnownFolderPath SHAppBarMessage ShellExecuteW ShellExecuteExW Shell_NotifyIconW CommandLineToArgvW

ole32

RevokeDragDrop CoTaskMemAlloc CoAllowSetForegroundWindow OleRun CoInitialize CoCreateInstance CoSetProxyBlanket CoInitializeSecurity RegisterDragDrop CoInitializeEx CoTaskMemFree CoUninitialize OleInitialize CoCreateFreeThreadedMarshaler

oleaut32

VariantClear VariantChangeType SysFreeString SysAllocString SysStringLen VariantInit GetErrorInfo SetErrorInfo

iphlpapi

IcmpCloseHandle IcmpCreateFile

winhttp

WinHttpSetTimeouts WinHttpConnect WinHttpCloseHandle WinHttpOpen WinHttpQueryHeaders WinHttpOpenRequest WinHttpReceiveResponse WinHttpReadData WinHttpQueryDataAvailable WinHttpSendRequest

crypt32

CryptMsgClose CryptQueryObject CertGetNameStringW CertFreeCertificateContext CertFindCertificateInStore CertCloseStore CertOpenStore CryptDecodeObjectEx CryptDecodeObject CryptMsgOpenToDecode CryptMsgUpdate CryptMsgGetParam

ws2_32

WSAConnectByNameW closesocket recv send shutdown socket WSAStartup WSACleanup WSAGetLastError

sspicli

ApplyControlToken DecryptMessage EncryptMessage FreeContextBuffer QueryContextAttributesW AcquireCredentialsHandleW DeleteSecurityContext InitializeSecurityContextW FreeCredentialsHandle

ext-ms-win-networking-wlanapi-l1-1-0

WlanOpenHandle WlanCloseHandle WlanFreeMemory WlanGetAvailableNetworkList WlanEnumInterfaces

wlanapi

WlanRegisterNotification WlanScan WlanAllocateMemory

shlwapi

PathCreateFromUrlW PathFindFileNameW AssocCreate PathRenameExtensionW SHCreateStreamOnFileEx UrlCreateFromPathW PathAddBackslashW

api-ms-win-shcore-scaling-l1-1-1

GetDpiForMonitor

dwmapi

DwmSetWindowAttribute DwmGetWindowAttribute

wtsapi32

WTSRegisterSessionNotification WTSUnRegisterSessionNotification

gdiplus

GdipDeleteBrush GdiplusStartup GdiplusShutdown GdipSetStringFormatAlign GdipDisposeImage GdipCreateSolidFill GdipCloneImage GdipCreateBitmapFromHBITMAP GdipFlush GdipAlloc GdipDeleteStringFormat GdipFree GdipCreateStringFormat GdipCreateMatrix GdipDeleteMatrix GdipCloneBrush GdipCreateFromHDC GdipDeleteGraphics GdipSetSmoothingMode GdipSetWorldTransform GdipTranslateWorldTransform GdipScaleWorldTransform GdipFillEllipse GdipDrawImageI GdipCreateFontFamilyFromName GdipDeleteFontFamily GdipCreateFont GdipDeleteFont GdipDrawString

msi

ord70 ord45 ord118 ord8 ord32 ord159 ord92 ord160

wininet

InternetReadFile InternetOpenUrlW InternetOpenW InternetQueryDataAvailable HttpQueryInfoW InternetCheckConnectionW InternetCloseHandle

setupapi

SetupDiGetDeviceRegistryPropertyW SetupDiDestroyDeviceInfoList SetupDiEnumDeviceInfo SetupDiGetClassDevsW

api-ms-win-core-winrt-error-l1-1-1

RoOriginateLanguageException

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory

Name

.text

Size

3.2MB

Virtual Size

3.2MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

576KB

Virtual Size

575KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

159KB

Virtual Size

232KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

213KB

Virtual Size

212KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

328KB

Virtual Size

328KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

13KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-09_cd80deafabd01bcc4147ad1b614a6a96_icedid_luca-stealer_njrat_stealc_vidar

version

urlmon

kernel32

user32

gdi32

winspool.drv

advapi32

shell32

ole32

oleaut32

iphlpapi

winhttp

crypt32

ws2_32

sspicli

ext-ms-win-networking-wlanapi-l1-1-0

wlanapi

shlwapi

api-ms-win-shcore-scaling-l1-1-1

dwmapi

wtsapi32

gdiplus

msi

wininet

setupapi

api-ms-win-core-winrt-error-l1-1-1

api-ms-win-core-winrt-l1-1-0

generic