2026-09-29_25bc7c1b84e230e5ed17817fa8d847ed_icedid_luca-stealer_njrat_stealc_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-29_25bc7c1b84e230e5ed17817fa8d847ed_icedid_luca-stealer_njrat_stealc_vidar
Size 5.1MB
Sample260930-2zrdms1s3k
SHA256 2d932a5a955005c984c663df562349a8e8ff351e50c47bbdda523592bebea07a
MD5 25bc7c1b84e230e5ed17817fa8d847ed
SHA1 293ab798932065bd114801cd37fee0d249ada6ee
SHA512 d1af03462c25edb9ed42482a05fd68c407f970a985ee766b7d771221149b621ec6d8618993a8d0eaf12fad1647fffa9b7523f8670ab9fd9fb8441e3249c0c5e2
SSDEEP 49152:owihubgtNRtw8OWnWcyeoCIRiNCCIyBvHZoz3TQptJ:PoWmW4/5QC7
TLSH
T16336C65BEA7651E1C4B9C03DD1D3622BF87138A6833157C7A681AA571B33BE4E93E700
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-29_25bc7c1b84e230e5ed17817fa8d847ed_icedid_luca-stealer_njrat_stealc_vidar

File Explorer

2026-09-29_25bc7c1b84e230e5ed17817fa8d847ed_icedid_luca-stealer_njrat_stealc_vidar

.exe 5.1MB

2026-09-29_25bc7c1b84e230e5ed17817fa8d847ed_icedid_luca-stealer_njrat_stealc_vidar

IMPHASH 77fcdffcbcb9906b8a657520b8521f4e
SHA256 2d932a5a955005c984c663df562349a8e8ff351e50c47bbdda523592bebea07a
MD5 25bc7c1b84e230e5ed17817fa8d847ed
SHA1 293ab798932065bd114801cd37fee0d249ada6ee
SHA512 d1af03462c25edb9ed42482a05fd68c407f970a985ee766b7d771221149b621ec6d8618993a8d0eaf12fad1647fffa9b7523f8670ab9fd9fb8441e3249c0c5e2
SSDEEP 49152:owihubgtNRtw8OWnWcyeoCIRiNCCIyBvHZoz3TQptJ:PoWmW4/5QC7
TLSH
T16336C65BEA7651E1C4B9C03DD1D3622BF87138A6833157C7A681AA571B33BE4E93E700
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

3194056

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Build\Build_2025_D20251222T173115\fa_rss\Release\PCAppStore.pdb

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

urlmon

CreateUri URLDownloadToFileW

kernel32

CreateFileW OpenEventW GetOverlappedResult ReadDirectoryChangesW LocalFree CreateDirectoryW FreeLibrary LoadLibraryW ExpandEnvironmentStringsW HeapDestroy HeapReAlloc HeapSize GetTickCount64 FindResourceExW VerSetConditionMask FindClose FindFirstFileExW FindNextFileW GetFileAttributesW ReadFile RemoveDirectoryW CreateProcessW OpenProcess VerifyVersionInfoW LCIDToLocaleName GetUserDefaultUILanguage GetLocaleInfoEx GetConsoleOutputCP K32EnumProcessModules K32GetModuleBaseNameW GetStartupInfoW GetTickCount CopyFileA IsProcessCritical QueryFullProcessImageNameW CreateToolhelp32Snapshot Process32FirstW Process32NextW K32EnumProcesses K32GetModuleFileNameExW GetTempPathW GetExitCodeProcess GetProcessId InitializeProcThreadAttributeList DeleteProcThreadAttributeList UpdateProcThreadAttribute OpenMutexW OpenFileMappingW MapViewOfFile GetStdHandle GetEnvironmentVariableA SetCurrentDirectoryW FindFirstFileW GetCurrentProcess GetSystemTime SystemTimeToFileTime FileTimeToLocalFileTime lstrcmpA FileTimeToSystemTime FlushFileBuffers QueryPerformanceCounter CreateFileMappingW FormatMessageA GetSystemTimeAsFileTime GetFileSize LockFileEx UnlockFile HeapCompact GetSystemInfo DeleteFileA LoadLibraryA CreateFileA FlushViewOfFile GetFileAttributesExW GetFileAttributesA GetDiskFreeSpaceA GetTempPathA MultiByteToWideChar HeapValidate UnmapViewOfFile CreateMutexW UnlockFileEx SetEndOfFile GetFullPathNameA SetFilePointer LockFile OutputDebugStringA GetDiskFreeSpaceW WriteFile GetFullPathNameW HeapCreate AreFileApisANSI InitializeCriticalSection EnterCriticalSection WaitForMultipleObjects TryEnterCriticalSection DeleteCriticalSection DecodePointer InitializeCriticalSectionEx GlobalAlloc GlobalUnlock GlobalLock LoadLibraryExW GetEnvironmentVariableW SetStdHandle EnumSystemLocalesW IsValidCodePage GetACP GetOEMCP RaiseException GetExitCodeThread ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive GetCurrentDirectoryW GetFileInformationByHandle SetFileInformationByHandle GetFileInformationByHandleEx GetStringTypeW InitOnceBeginInitialize InitOnceComplete QueryPerformanceFrequency SleepConditionVariableSRW WakeConditionVariable WakeAllConditionVariable RtlPcToFileHeader EncodePointer LCMapStringEx CompareStringEx GetCPInfo InitializeSListHead RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter Sleep SetUnhandledExceptionFilter IsProcessorFeaturePresent TerminateProcess RtlUnwindEx CreateEventW InterlockedPushEntrySList GetModuleFileNameW ResetEvent SetEvent InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue GetCommandLineA TlsSetValue TlsFree CreateThread ExitThread FreeLibraryAndExitThread ExitProcess GetDriveTypeW GetFileType PeekNamedPipe SystemTimeToTzSpecificLocalTime SetEnvironmentVariableW GetCommandLineW FindResourceW SizeofResource LockResource LoadResource WideCharToMultiByte FormatMessageW GetProcAddress GetModuleHandleExW GetModuleHandleW GetModuleFileNameA GetCurrentThreadId FlsAlloc FlsGetValue FlsSetValue FlsFree VirtualProtect GetDateFormatW GetTimeFormatW CompareStringW GetCurrentProcessId CreateSemaphoreExW CreateMutexExW OpenSemaphoreW WaitForSingleObjectEx WaitForSingleObject ReleaseMutex ReleaseSemaphore WriteConsoleW FreeEnvironmentStringsW GetProcessHeap HeapFree HeapAlloc SetLastError GetLastError CloseHandle OutputDebugStringW DebugBreak IsDebuggerPresent DeleteFileW GetTimeZoneInformation LCMapStringW ReadConsoleW SetFilePointerEx RtlUnwind GetFileSizeEx GetConsoleMode LeaveCriticalSection GetEnvironmentStringsW GetUserDefaultLCID IsValidLocale GetLocaleInfoW

user32

InsertMenuW GetMenuItemCount DestroyMenu CreatePopupMenu GetClassInfoExW RegisterClassExW AttachThreadInput SendMessageTimeoutW RegisterWindowMessageW UpdateWindow GetWindowLongPtrW SetWindowLongW SetRectEmpty RemoveMenu TrackPopupMenu LoadIconW ChangeWindowMessageFilterEx TrackMouseEvent GetCapture SetCapture PtInRect SetClassLongPtrW FillRect AdjustWindowRectEx GetClientRect SetWindowTextW GetWindowPlacement UnregisterClassW MonitorFromWindow LoadCursorW EqualRect InvalidateRect EndPaint BeginPaint ShowWindow DestroyWindow AppendMenuW CreateWindowExW RegisterClassW CloseClipboard SetClipboardData EmptyClipboard OpenIcon SetWindowPlacement SetWindowLongPtrW PostMessageW OpenClipboard PostQuitMessage DefWindowProcW FindWindowExW UnhookWinEvent GetForegroundWindow keybd_event GetShellWindow SetCursorPos GetWindowTextW SetWindowPos GetPhysicalCursorPos GetSystemMetrics GetAsyncKeyState CallNextHookEx UnhookWindowsHookEx SetWindowsHookExW EnumChildWindows WindowFromPoint ScreenToClient GetCursorPos IsChild PostThreadMessageW SendMessageW GetMessageW GetThreadDpiAwarenessContext SetThreadDpiAwarenessContext EnumDisplayMonitors FindWindowW IntersectRect GetMonitorInfoW MonitorFromRect DialogBoxParamW MonitorFromPoint SystemParametersInfoW GetWindow GetWindowThreadProcessId GetClassNameW EnumWindows GetDesktopWindow ReleaseDC GetDC SendInput EndDialog IsWindowVisible SetWinEventHook PeekMessageW DispatchMessageW TranslateMessage KillTimer SetTimer IsIconic SetForegroundWindow SetFocus ReleaseCapture IsWindow GetWindowRect IsZoomed

gdi32

DeleteObject BitBlt CreateCompatibleBitmap CreateCompatibleDC DeleteDC SelectObject CreateSolidBrush

winspool.drv

EnumPrintersW

comdlg32

GetOpenFileNameW

advapi32

EventRegister RegCloseKey RegGetValueW EventUnregister EventWriteTransfer EventSetInformation RegNotifyChangeKeyValue RegCreateKeyExW GetUserNameW RegSetValueExW RegQueryValueExW RegOpenKeyExW RegDeleteValueW

shell32

Shell_NotifyIconW ShellExecuteExW SHGetFolderPathW SHEmptyRecycleBinW SHQueryRecycleBinW CommandLineToArgvW SHGetKnownFolderPath SHAppBarMessage ShellExecuteW

ole32

RevokeDragDrop CoTaskMemAlloc CoAllowSetForegroundWindow CoSetProxyBlanket CoInitializeSecurity OleRun CoInitialize CoCreateInstance RegisterDragDrop CoInitializeEx CoTaskMemFree CoUninitialize OleInitialize CoCreateFreeThreadedMarshaler

oleaut32

VariantClear SysFreeString SysAllocString VariantChangeType SysStringLen GetErrorInfo VariantInit SetErrorInfo

iphlpapi

IcmpCreateFile IcmpCloseHandle

winhttp

WinHttpSetTimeouts WinHttpConnect WinHttpCloseHandle WinHttpOpen WinHttpQueryHeaders WinHttpOpenRequest WinHttpReceiveResponse WinHttpReadData WinHttpQueryDataAvailable WinHttpSendRequest

crypt32

CryptQueryObject CertGetNameStringW CertFreeCertificateContext CryptMsgOpenToDecode CertFindCertificateInStore CertCloseStore CertOpenStore CryptMsgGetParam CryptMsgUpdate CryptDecodeObjectEx CryptDecodeObject CryptMsgClose

ws2_32

WSAConnectByNameW closesocket recv send shutdown socket WSAStartup WSACleanup WSAGetLastError

sspicli

DecryptMessage EncryptMessage FreeContextBuffer QueryContextAttributesW ApplyControlToken DeleteSecurityContext InitializeSecurityContextW FreeCredentialsHandle AcquireCredentialsHandleW

ext-ms-win-networking-wlanapi-l1-1-0

WlanOpenHandle WlanCloseHandle WlanFreeMemory WlanGetAvailableNetworkList WlanEnumInterfaces

wlanapi

WlanRegisterNotification WlanScan WlanAllocateMemory

shlwapi

PathCreateFromUrlW PathFindFileNameW AssocCreate PathRenameExtensionW PathAddBackslashW SHCreateStreamOnFileEx UrlCreateFromPathW

api-ms-win-shcore-scaling-l1-1-1

GetDpiForMonitor

dwmapi

DwmSetWindowAttribute DwmGetWindowAttribute

wtsapi32

WTSRegisterSessionNotification WTSUnRegisterSessionNotification

gdiplus

GdipDeleteBrush GdiplusStartup GdiplusShutdown GdipSetStringFormatAlign GdipDisposeImage GdipCreateSolidFill GdipCloneImage GdipCreateBitmapFromHBITMAP GdipFlush GdipAlloc GdipDeleteStringFormat GdipFree GdipCreateStringFormat GdipCreateMatrix GdipDeleteMatrix GdipCloneBrush GdipCreateFromHDC GdipDeleteGraphics GdipSetSmoothingMode GdipSetWorldTransform GdipTranslateWorldTransform GdipScaleWorldTransform GdipFillEllipse GdipDrawImageI GdipCreateFontFamilyFromName GdipDeleteFontFamily GdipCreateFont GdipDeleteFont GdipDrawString

msi

ord70 ord45 ord118 ord8 ord32 ord159 ord92 ord160

wininet

InternetReadFile InternetOpenUrlW InternetOpenW InternetQueryDataAvailable HttpQueryInfoW InternetCheckConnectionW InternetCloseHandle

setupapi

SetupDiEnumDeviceInfo SetupDiGetClassDevsW SetupDiGetDeviceRegistryPropertyW SetupDiDestroyDeviceInfoList

api-ms-win-core-winrt-error-l1-1-1

RoOriginateLanguageException

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory

Name

.text

Size

3.5MB

Virtual Size

3.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

828KB

Virtual Size

827KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

186KB

Virtual Size

316KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

252KB

Virtual Size

252KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

328KB

Virtual Size

328KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

13KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-29_25bc7c1b84e230e5ed17817fa8d847ed_icedid_luca-stealer_njrat_stealc_vidar

version

urlmon

kernel32

user32

gdi32

winspool.drv

comdlg32

advapi32

shell32

ole32

oleaut32

iphlpapi

winhttp

crypt32

ws2_32

sspicli

ext-ms-win-networking-wlanapi-l1-1-0

wlanapi

shlwapi

api-ms-win-shcore-scaling-l1-1-1

dwmapi

wtsapi32

gdiplus

msi

wininet

setupapi

api-ms-win-core-winrt-error-l1-1-1

api-ms-win-core-winrt-l1-1-0

generic