2026-09-16_e8f72bbbd3afc1a9882700483618fd35_icedid_luca-stealer_njrat_stealc_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-16_e8f72bbbd3afc1a9882700483618fd35_icedid_luca-stealer_njrat_stealc_vidar
Size 5.0MB
Sample260916-tccb7s1tas
SHA256 e36455fa44c56f434cdf95b07c45ac860823d45a7d6fa34daca804c3440b70e6
MD5 e8f72bbbd3afc1a9882700483618fd35
SHA1 d4edf33c17bc1b97f8e63da69c78bff995abcc07
SHA512 5f8365e89312e1d574786dcdf98470124cc268b4842b0a4061d76da2500fe05adc924ed1257dbe2ce75749e08c196a2e1b9e4870092d9301d4962feb54baf208
SSDEEP 49152:cWzmVatCoFGrjgGBfaTn5UrLSGf8gy+AQPzppzIAhG17mL8Ez3TQptO:cWPKLSGkVEpNhxpCQ
TLSH
T1DA36F75BAA7551D1C4F9C03DC693622BF871789A833097CB9641AA1B1B33BF4E93E740
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-16_e8f72bbbd3afc1a9882700483618fd35_icedid_luca-stealer_njrat_stealc_vidar

File Explorer

2026-09-16_e8f72bbbd3afc1a9882700483618fd35_icedid_luca-stealer_njrat_stealc_vidar

.exe 5.0MB

2026-09-16_e8f72bbbd3afc1a9882700483618fd35_icedid_luca-stealer_njrat_stealc_vidar

IMPHASH 2281a9ec8bb8b783447b3c434fa628ef
SHA256 e36455fa44c56f434cdf95b07c45ac860823d45a7d6fa34daca804c3440b70e6
MD5 e8f72bbbd3afc1a9882700483618fd35
SHA1 d4edf33c17bc1b97f8e63da69c78bff995abcc07
SHA512 5f8365e89312e1d574786dcdf98470124cc268b4842b0a4061d76da2500fe05adc924ed1257dbe2ce75749e08c196a2e1b9e4870092d9301d4962feb54baf208
SSDEEP 49152:cWzmVatCoFGrjgGBfaTn5UrLSGf8gy+AQPzppzIAhG17mL8Ez3TQptO:cWPKLSGkVEpNhxpCQ
TLSH
T1DA36F75BAA7551D1C4F9C03DC693622BF871789A833097CB9641AA1B1B33BF4E93E740
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

3169944

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Build\Build_2040_D20260225T165711\fa_rss\Release\PCAppStore.pdb

urlmon

URLDownloadToFileW CreateUri

ws2_32

closesocket send WSAConnectByNameW recv WSAStartup WSAGetLastError socket shutdown WSACleanup

winhttp

WinHttpConnect WinHttpOpenRequest WinHttpSetTimeouts WinHttpSendRequest WinHttpOpen WinHttpSetOption WinHttpQueryDataAvailable WinHttpReadData WinHttpQueryHeaders WinHttpCloseHandle WinHttpReceiveResponse

wininet

InternetQueryDataAvailable InternetReadFile HttpSendRequestW InternetSetOptionW HttpAddRequestHeadersW HttpOpenRequestW InternetConnectW InternetOpenW InternetCloseHandle HttpQueryInfoW

secur32

AcquireCredentialsHandleW FreeContextBuffer ApplyControlToken DecryptMessage QueryContextAttributesW FreeCredentialsHandle DeleteSecurityContext InitializeSecurityContextW EncryptMessage

wtsapi32

WTSUnRegisterSessionNotification WTSRegisterSessionNotification

shlwapi

PathFindFileNameW PathCreateFromUrlW PathAddBackslashW UrlCreateFromPathW AssocCreate SHCreateStreamOnFileEx PathRenameExtensionW

dwmapi

DwmSetWindowAttribute DwmGetWindowAttribute

api-ms-win-shcore-scaling-l1-1-1

GetDpiForMonitor

msi

ord32 ord45 ord8 ord118 ord92 ord159 ord160 ord70

kernel32

InterlockedPushEntrySList InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree CreateThread RtlPcToFileHeader ExitThread RtlUnwind FreeLibraryAndExitThread RtlLookupFunctionEntry RtlUnwindEx WriteConsoleW GetCommandLineA GetOEMCP GetACP IsValidCodePage GetTimeZoneInformation SetStdHandle ReadConsoleW SetFilePointerEx GetFileSizeEx DeleteFileW IsDebuggerPresent DebugBreak OutputDebugStringW CloseHandle GetLastError SetLastError HeapAlloc HeapFree GetProcessHeap ReleaseSemaphore ReleaseMutex WaitForSingleObject WaitForSingleObjectEx OpenSemaphoreW CreateMutexExW CreateSemaphoreExW GetCurrentProcessId GetCurrentThreadId GetModuleFileNameA GetModuleHandleW GetModuleHandleExW GetProcAddress FormatMessageW WideCharToMultiByte LoadResource LockResource SizeofResource FindResourceW SetEnvironmentVariableW SetEvent ResetEvent CreateEventW Sleep WaitForMultipleObjects GetModuleFileNameW CreateFileW OpenEventW GetOverlappedResult ReadDirectoryChangesW CreateDirectoryW FreeLibrary LoadLibraryW ExpandEnvironmentStringsW GetStartupInfoW GetTickCount64 SetCurrentDirectoryW ReadFile CreateProcessW GetLocaleInfoEx GetConsoleOutputCP CopyFileA OpenProcess IsProcessCritical QueryFullProcessImageNameW CreateToolhelp32Snapshot Process32FirstW Process32NextW K32EnumProcesses K32GetModuleFileNameExW GetTempPathW GetExitCodeProcess GetProcessId InitializeProcThreadAttributeList DeleteProcThreadAttributeList UpdateProcThreadAttribute GetStdHandle GetEnvironmentVariableA FindClose TerminateProcess RtlCaptureContext GetSystemTime SystemTimeToFileTime FileTimeToLocalFileTime LocalFree lstrcmpA FileTimeToSystemTime FlushFileBuffers GetTickCount QueryPerformanceCounter MapViewOfFile CreateFileMappingW FormatMessageA GetSystemTimeAsFileTime GetFileSize LockFileEx UnlockFile HeapDestroy HeapCompact GetSystemInfo HeapReAlloc DeleteFileA LoadLibraryA CreateFileA FlushViewOfFile GetFileAttributesExW GetFileAttributesA GetDiskFreeSpaceA GetTempPathA MultiByteToWideChar HeapSize HeapValidate UnmapViewOfFile GetFileAttributesW CreateMutexW UnlockFileEx SetEndOfFile GetFullPathNameA SetFilePointer LockFile OutputDebugStringA GetDiskFreeSpaceW WriteFile GetFullPathNameW HeapCreate AreFileApisANSI InitializeCriticalSection EnterCriticalSection LeaveCriticalSection TryEnterCriticalSection DeleteCriticalSection DecodePointer InitializeCriticalSectionEx GlobalAlloc GlobalUnlock GlobalLock LoadLibraryExW GetEnvironmentVariableW VerSetConditionMask VerifyVersionInfoW FindFirstFileExW FindNextFileW RemoveDirectoryW LCIDToLocaleName GetUserDefaultUILanguage K32EnumProcessModules K32GetModuleBaseNameW GetEnvironmentStringsW FreeEnvironmentStringsW GetSystemFirmwareTable GetCommandLineW FindResourceExW OpenMutexW OpenFileMappingW IsProcessorFeaturePresent SetUnhandledExceptionFilter ExitProcess GetDriveTypeW GetFileType PeekNamedPipe SystemTimeToTzSpecificLocalTime InitializeSListHead RaiseException GetExitCodeThread ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive GetCurrentDirectoryW UnhandledExceptionFilter FindFirstFileW FlsAlloc FlsGetValue FlsSetValue FlsFree VirtualProtect GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetConsoleMode GetFileInformationByHandle SetFileInformationByHandle GetFileInformationByHandleEx GetStringTypeW InitOnceBeginInitialize InitOnceComplete QueryPerformanceFrequency WakeConditionVariable WakeAllConditionVariable SleepConditionVariableSRW RtlVirtualUnwind EncodePointer LCMapStringEx CompareStringEx GetCurrentProcess GetCPInfo

user32

SetCursorPos GetWindowTextW SetWindowPos GetPhysicalCursorPos GetSystemMetrics GetAsyncKeyState CallNextHookEx UnhookWindowsHookEx keybd_event GetForegroundWindow UnhookWinEvent FindWindowExW DefWindowProcW PostQuitMessage RegisterClassW CreateWindowExW DestroyWindow ShowWindow BeginPaint EndPaint SetWindowsHookExW EnumChildWindows WindowFromPoint PtInRect GetCursorPos IsChild PostThreadMessageW SendMessageW GetMessageW GetThreadDpiAwarenessContext SetThreadDpiAwarenessContext EnumDisplayMonitors EnumWindows InvalidateRect IntersectRect SetCapture GetCapture TrackMouseEvent ChangeWindowMessageFilterEx LoadIconW TrackPopupMenu RemoveMenu AppendMenuW GetMonitorInfoW MonitorFromRect MonitorFromPoint GetWindowThreadProcessId GetClassNameW ReleaseDC GetDC SendInput EndDialog IsWindowVisible DialogBoxParamW SetWinEventHook PeekMessageW DispatchMessageW TranslateMessage KillTimer SetTimer IsIconic SetForegroundWindow SetFocus IsWindow GetWindowRect ReleaseCapture InsertMenuW GetMenuItemCount DestroyMenu CreatePopupMenu GetClassInfoExW RegisterClassExW AttachThreadInput SendMessageTimeoutW EqualRect LoadCursorW RegisterWindowMessageW MonitorFromWindow UnregisterClassW GetWindowPlacement IsZoomed SetWindowTextW GetClientRect UpdateWindow GetWindowLongPtrW SetWindowLongW GetShellWindow SetWindowLongPtrW SetWindowPlacement OpenIcon EmptyClipboard SetClipboardData CloseClipboard OpenClipboard FindWindowW SetClassLongPtrW SetRectEmpty FillRect ScreenToClient AdjustWindowRectEx PostMessageW GetWindow

gdi32

DeleteObject SelectObject DeleteDC CreateCompatibleDC CreateCompatibleBitmap BitBlt CreateSolidBrush

winspool.drv

EnumPrintersW

comdlg32

GetOpenFileNameW

advapi32

RegCreateKeyExW RegNotifyChangeKeyValue GetUserNameW RegGetValueW EventUnregister RegCloseKey RegDeleteValueW RegOpenKeyExW RegQueryValueExW RegSetValueExW EventRegister EventSetInformation EventWriteTransfer

shell32

ShellExecuteW SHAppBarMessage SHGetKnownFolderPath SHQueryRecycleBinW SHEmptyRecycleBinW SHGetFolderPathW ShellExecuteExW CommandLineToArgvW Shell_NotifyIconW

ole32

CoInitializeEx CoInitialize CoUninitialize RegisterDragDrop CoCreateInstance OleRun CoInitializeSecurity CoAllowSetForegroundWindow CoSetProxyBlanket CoTaskMemAlloc RevokeDragDrop CoTaskMemFree OleInitialize CoCreateFreeThreadedMarshaler

oleaut32

VariantClear VariantInit SysFreeString SysAllocString VariantChangeType GetErrorInfo SetErrorInfo SysStringLen

iphlpapi

IcmpCreateFile IcmpCloseHandle

crypt32

CryptDecodeObjectEx CertFindCertificateInStore CertFreeCertificateContext CertGetNameStringW CryptQueryObject CertCloseStore CertOpenStore CryptDecodeObject CryptMsgOpenToDecode CryptMsgClose CryptMsgUpdate CryptMsgGetParam

ext-ms-win-networking-wlanapi-l1-1-0

WlanFreeMemory WlanOpenHandle WlanGetAvailableNetworkList WlanCloseHandle WlanEnumInterfaces

wlanapi

WlanAllocateMemory WlanRegisterNotification WlanScan

api-ms-win-core-version-l1-1-1

GetFileVersionInfoW

api-ms-win-core-version-l1-1-0

VerQueryValueW

gdiplus

GdipTranslateWorldTransform GdipSetWorldTransform GdipSetSmoothingMode GdipDeleteGraphics GdipCreateFromHDC GdipFlush GdipCreateBitmapFromHBITMAP GdipDisposeImage GdipCloneImage GdipFillEllipse GdipDeleteBrush GdipCloneBrush GdipDeleteMatrix GdipCreateMatrix GdipFree GdipAlloc GdiplusShutdown GdiplusStartup GdipDrawImageI GdipCreateFontFamilyFromName GdipScaleWorldTransform GdipDeleteFontFamily GdipCreateFont GdipDeleteFont GdipDrawString GdipSetStringFormatAlign GdipCreateStringFormat GdipDeleteStringFormat GdipCreateSolidFill

setupapi

SetupDiDestroyDeviceInfoList SetupDiGetClassDevsW SetupDiGetDeviceRegistryPropertyW SetupDiEnumDeviceInfo

version

GetFileVersionInfoSizeW

api-ms-win-core-winrt-error-l1-1-1

RoOriginateLanguageException

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory

Name

.text

Size

3.5MB

Virtual Size

3.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

844KB

Virtual Size

843KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

186KB

Virtual Size

313KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

236KB

Virtual Size

235KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

328KB

Virtual Size

328KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

13KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-16_e8f72bbbd3afc1a9882700483618fd35_icedid_luca-stealer_njrat_stealc_vidar

urlmon

ws2_32

winhttp

wininet

secur32

wtsapi32

shlwapi

dwmapi

api-ms-win-shcore-scaling-l1-1-1

msi

kernel32

user32

gdi32

winspool.drv

comdlg32

advapi32

shell32

ole32

oleaut32

iphlpapi

crypt32

ext-ms-win-networking-wlanapi-l1-1-0

wlanapi

api-ms-win-core-version-l1-1-1

api-ms-win-core-version-l1-1-0

gdiplus

setupapi

version

api-ms-win-core-winrt-error-l1-1-1

api-ms-win-core-winrt-l1-1-0

generic