2026-10-02_e9b23c490983c5d3db268d3facf64859_icedid_luca-stealer_njrat_stealc_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-02_e9b23c490983c5d3db268d3facf64859_icedid_luca-stealer_njrat_stealc_vidar
Size 30.0MB
Sample261002-3fa3zsaa82
SHA256 b40493b45d9e8a0b18ff0fb6d96a43bbe507d3605dc9ababbf88c2b9f24ac43c
MD5 e9b23c490983c5d3db268d3facf64859
SHA1 53a8498df7f79bb09a4580410f1a535a7a4159eb
SHA512 9bdfed7ff0465bbbad65c0323f1e571270702fa380a7e4fd8096f93f2119de792a7a65bc82f042b646f46b110118f52138ae2eb1b5b35f772fede52160d7fc6a
SSDEEP 393216:3AnVeyUdcSG4F4N6DdvhN/i18EczA7nfoPDpwQSpQowf3fET4wOdKVK:WefdclNJNfSpzAef7wOEK
TLSH
T16D670247B2D60399CFA3E93D91139313E272BC96232186D76B9C0E169F17BE0597EB04
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects executables referencing many IR and analysis tools 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_References_SecTools

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-02_e9b23c490983c5d3db268d3facf64859_icedid_luca-stealer_njrat_stealc_vidar

File Explorer

2026-10-02_e9b23c490983c5d3db268d3facf64859_icedid_luca-stealer_njrat_stealc_vidar

.exe 30.0MB

2026-10-02_e9b23c490983c5d3db268d3facf64859_icedid_luca-stealer_njrat_stealc_vidar

IMPHASH e1f13ab30329d047014f0c5087534f68
SHA256 b40493b45d9e8a0b18ff0fb6d96a43bbe507d3605dc9ababbf88c2b9f24ac43c
MD5 e9b23c490983c5d3db268d3facf64859
SHA1 53a8498df7f79bb09a4580410f1a535a7a4159eb
SHA512 9bdfed7ff0465bbbad65c0323f1e571270702fa380a7e4fd8096f93f2119de792a7a65bc82f042b646f46b110118f52138ae2eb1b5b35f772fede52160d7fc6a
SSDEEP 393216:3AnVeyUdcSG4F4N6DdvhN/i18EczA7nfoPDpwQSpQowf3fET4wOdKVK:WefdclNJNfSpzAef7wOEK
TLSH
T16D670247B2D60399CFA3E93D91139313E272BC96232186D76B9C0E169F17BE0597EB04
MD5 SHA1 SHA512 SSDEEP TLSH

Detects executables referencing many IR and analysis tools
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1221076

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\MAGICIANS\MULTI LOADER\Axio Silent Aim C++\examples\EXE\MAGICIANS SILENTAIM.pdb

d3d11

D3D11CreateDeviceAndSwapChain

d3dcompiler_43

D3DCompile

kernel32

GetLastError CloseHandle GetCurrentProcessId GetModuleFileNameW GetTickCount64 SizeofResource Process32First WriteProcessMemory HeapFree VirtualFree GetCurrentProcess VirtualAlloc TerminateProcess InitializeCriticalSectionEx FindResourceA WaitForSingleObject OpenProcess CreateToolhelp32Snapshot Sleep Process32NextW CreateFileA GetCurrentThread LockResource Process32Next Process32FirstW FreeConsole GetSystemInfo LoadResource HeapAlloc Module32FirstW GetThreadContext Beep VirtualAllocEx DeleteCriticalSection ExitProcess ReadProcessMemory GetModuleHandleW CreateRemoteThread Module32NextW CreateDirectoryA VirtualFreeEx IsDebuggerPresent VirtualQueryEx CheckRemoteDebuggerPresent GetCurrentThreadId CreateProcessA GetFileSizeEx MapViewOfFile UnmapViewOfFile CreateFileMappingA GetProcAddress AcquireSRWLockShared SleepConditionVariableSRW LocalFree FormatMessageA GetLocaleInfoEx FindClose FindFirstFileW GetFileAttributesExW SetFileInformationByHandle AreFileApisANSI GetFileInformationByHandleEx InitOnceComplete InitOnceBeginInitialize WakeAllConditionVariable UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent GetStartupInfoW GetSystemTimeAsFileTime InitializeSListHead OutputDebugStringW CreateFileW ReadFile QueryPerformanceCounter FlushInstructionCache QueryPerformanceFrequency LoadLibraryA GetLocaleInfoA GetModuleHandleA GetTickCount GlobalUnlock WideCharToMultiByte GlobalLock GlobalFree GlobalAlloc FreeLibrary MultiByteToWideChar AcquireSRWLockExclusive ReleaseSRWLockShared ReleaseSRWLockExclusive

user32

CloseClipboard EmptyClipboard UpdateWindow IsWindowVisible EnumChildWindows GetClassNameA GetWindowTextA EnumWindows DefWindowProcA CreateWindowExA RegisterClassExA IsIconic GetWindowThreadProcessId DefWindowProcW DispatchMessageA GetWindowRect DestroyWindow GetClipboardData SetWindowPos SetWindowRgn SetClipboardData GetSystemMetrics UnregisterClassW OpenClipboard GetCursorPos GetAsyncKeyState GetDC SetCursorPos ReleaseCapture IsWindowUnicode SetProcessDPIAware GetClientRect SetCursor SetCapture GetForegroundWindow GetKeyboardLayout TrackMouseEvent ClientToScreen mouse_event ScreenToClient RegisterClassExW ShowWindow IsWindow SetWindowLongA GetWindowLongA CreateWindowExW GetCapture GetKeyState FindWindowA SetWindowLongPtrA PostQuitMessage UnregisterClassA GetWindowLongPtrA PeekMessageA TranslateMessage SetLayeredWindowAttributes MoveWindow MessageBoxA SetWindowDisplayAffinity GetMessageExtraInfo LoadCursorA

gdi32

CreateRoundRectRgn GetPixel

advapi32

GetCurrentHwProfileA LookupPrivilegeValueA GetUserNameA OpenProcessToken GetTokenInformation AdjustTokenPrivileges

shell32

ShellExecuteW SHGetFolderPathA

ole32

CoCreateInstance CoUninitialize CoInitialize

msvcp140

?always_noconv@codecvt_base@std@@QEBA_NXZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@I@Z ??Bios_base@std@@QEBA_NXZ ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ??7ios_base@std@@QEBA_NXZ ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z ?_Xlength_error@std@@YAXPEBD@Z ?_Xout_of_range@std@@YAXPEBD@Z ?_Xbad_alloc@std@@YAXXZ _Xtime_get_ticks _Query_perf_frequency ?_Throw_Cpp_error@std@@YAXH@Z _Mtx_lock _Cnd_do_broadcast_at_thread_exit _Thrd_id _Query_perf_counter _Thrd_join _Mtx_unlock _Cnd_broadcast _Thrd_yield ?_Random_device@std@@YAIXZ ?uncaught_exceptions@std@@YAHXZ ?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ?good@ios_base@std@@QEBA_NXZ _Thrd_detach ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@F@Z ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z ?__ExceptionPtrAssign@@YAXPEAXPEBX@Z ?GetCurrentThreadId@platform@details@Concurrency@@YAJXZ ?_ReportUnobservedException@details@Concurrency@@YAXXZ ?_Schedule_chore@details@Concurrency@@YAHPEAU_Threadpool_chore@12@@Z ?_LogWorkItemCompleted@_TaskEventLogger@details@Concurrency@@QEAAXXZ ?_LogWorkItemStarted@_TaskEventLogger@details@Concurrency@@QEAAXXZ ?_LogTaskExecutionCompleted@_TaskEventLogger@details@Concurrency@@QEAAXXZ ?_LogTaskCompleted@_TaskEventLogger@details@Concurrency@@QEAAXXZ ?_LogCancelTask@_TaskEventLogger@details@Concurrency@@QEAAXXZ ?_LogScheduleTask@_TaskEventLogger@details@Concurrency@@QEAAX_N@Z ?_Release_chore@details@Concurrency@@YAXPEAU_Threadpool_chore@12@@Z ?ReportUnhandledError@_ExceptionHolder@details@Concurrency@@AEAAXXZ ?_Capture@_ContextCallback@details@Concurrency@@AEAAXXZ ?_Reset@_ContextCallback@details@Concurrency@@AEAAXXZ ?_CallInContext@_ContextCallback@details@Concurrency@@QEBAXV?$function@$$A6AXXZ@std@@_N@Z ??0task_continuation_context@Concurrency@@AEAA@XZ _Cnd_unregister_at_thread_exit ?__ExceptionPtrCreate@@YAXPEAX@Z ?__ExceptionPtrCopy@@YAXPEAXPEBX@Z ??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?wcout@std@@3V?$basic_ostream@_WU?$char_traits@_W@std@@@1@A ?_Xinvalid_argument@std@@YAXPEBD@Z ?_Id_cnt@id@locale@std@@0HA ?_Winerror_map@std@@YAHH@Z ?_Xbad_function_call@std@@YAXXZ ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?_Syserror_map@std@@YAPEBDH@Z ?__ExceptionPtrToBool@@YA_NPEBX@Z ?__ExceptionPtrDestroy@@YAXPEAX@Z ?__ExceptionPtrCurrentException@@YAXPEAX@Z ?__ExceptionPtrRethrow@@YAXPEBX@Z _Cnd_register_at_thread_exit _Cnd_wait ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z ?widen@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEBA_WD@Z ?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAG_W@Z ?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAA_JPEB_W_J@Z ?put@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@_W@Z ?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z

imm32

ImmSetCompositionWindow ImmReleaseContext ImmGetContext ImmSetCandidateWindow

dwmapi

DwmExtendFrameIntoClientArea

wininet

HttpOpenRequestA HttpQueryInfoA InternetOpenA InternetReadFile InternetConnectA HttpSendRequestA InternetCloseHandle

ntdll

RtlAdjustPrivilege NtRaiseHardError ZwWriteVirtualMemory ZwReadVirtualMemory ZwProtectVirtualMemory RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind

shlwapi

PathFileExistsA

vcruntime140_1

__CxxFrameHandler4

vcruntime140

_CxxThrowException __current_exception __C_specific_handler memcmp __intrinsic_setjmp __current_exception_context memset memmove memcpy longjmp strrchr _purecall strstr __std_terminate __std_exception_copy __std_exception_destroy memchr

api-ms-win-crt-stdio-l1-1-0

ftell _get_stream_buffer_pointers _fseeki64 __acrt_iob_func fsetpos ungetc setvbuf fgetpos _set_fmode fgetc fflush fclose fseek __stdio_common_vfprintf fwrite fputc _wfopen __stdio_common_vsprintf fread __stdio_common_vsscanf __p__commode __stdio_common_vsprintf_s

api-ms-win-crt-runtime-l1-1-0

_initterm_e _exit _invoke_watson _c_exit _register_thread_local_exe_atexit_callback _seh_filter_exe _cexit _wassert _initterm system _beginthreadex terminate exit _crt_atexit abort _register_onexit_function _get_narrow_winmain_command_line _initialize_onexit_table _initialize_narrow_environment _configure_narrow_argv _errno _set_app_type

api-ms-win-crt-utility-l1-1-0

rand qsort

api-ms-win-crt-string-l1-1-0

strncmp strcpy_s strcmp isspace strncpy_s toupper tolower _wcsicmp strncpy towlower

api-ms-win-crt-heap-l1-1-0

realloc _set_new_mode _callnewh _msize malloc free

api-ms-win-crt-convert-l1-1-0

mbstowcs_s atof strtol

api-ms-win-crt-time-l1-1-0

_time64 _difftime64

api-ms-win-crt-filesystem-l1-1-0

_lock_file _unlock_file

api-ms-win-crt-math-l1-1-0

fmaxf _fdclass _hypotf acosf atan2f ceilf cosf expf fmodf sqrt log logf sinf roundf powf pow sqrtf __setusermatherr

api-ms-win-crt-multibyte-l1-1-0

_mbsicmp

api-ms-win-crt-environment-l1-1-0

getenv

api-ms-win-crt-locale-l1-1-0

_configthreadlocale ___lc_codepage_func

winhttp

WinHttpQueryDataAvailable WinHttpCloseHandle WinHttpReceiveResponse WinHttpOpen WinHttpSendRequest WinHttpConnect WinHttpOpenRequest WinHttpReadData

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-02_e9b23c490983c5d3db268d3facf64859_icedid_luca-stealer_njrat_stealc_vidar

d3d11

d3dcompiler_43

kernel32

user32

gdi32

advapi32

shell32

ole32

msvcp140

imm32

dwmapi

wininet

ntdll

shlwapi

vcruntime140_1

vcruntime140

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-multibyte-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-locale-l1-1-0

winhttp

generic