2026-10-17_a87f169535ec575a5428b7bd8b83f221_icedid_stealc_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-17_a87f169535ec575a5428b7bd8b83f221_icedid_stealc_vidar
Size 1.3MB
Sample261018-13d22sbs2x
SHA256 8200628dc2013e7a77b3e7e7082dbe81e7324f284cf0f457cecc6851e63c15c6
MD5 a87f169535ec575a5428b7bd8b83f221
SHA1 f2f2600bf43e88d7cd9656a2584fab1cb3fdf391
SHA512 9a1ed5e8e3f115bd5d6f6b994f105fc7f49ecb101c76775eea7b712b7d8f2570ddc0b8c56e32578b77c7232eb1f8d76a11dcefa85e0cd73a9e9205615cee3650
SSDEEP 24576:TRpVu5OJjqjFikOsB+HipayOObWqBdgWYQd7eMqLOGiLzOl6Qi:TRpVoOJOZiXCpICYQ0MUV
TLSH
T19955120B729670F5E1778439C8129A16E772BC354771EE3F13A482779E236846E2AF31
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-17_a87f169535ec575a5428b7bd8b83f221_icedid_stealc_vidar

File Explorer

2026-10-17_a87f169535ec575a5428b7bd8b83f221_icedid_stealc_vidar

.exe 1.3MB

2026-10-17_a87f169535ec575a5428b7bd8b83f221_icedid_stealc_vidar

IMPHASH 1de439d5b59f56615e711270cd94d1e9
SHA256 8200628dc2013e7a77b3e7e7082dbe81e7324f284cf0f457cecc6851e63c15c6
MD5 a87f169535ec575a5428b7bd8b83f221
SHA1 f2f2600bf43e88d7cd9656a2584fab1cb3fdf391
SHA512 9a1ed5e8e3f115bd5d6f6b994f105fc7f49ecb101c76775eea7b712b7d8f2570ddc0b8c56e32578b77c7232eb1f8d76a11dcefa85e0cd73a9e9205615cee3650
SSDEEP 24576:TRpVu5OJjqjFikOsB+HipayOObWqBdgWYQd7eMqLOGiLzOl6Qi:TRpVoOJOZiXCpICYQ0MUV
TLSH
T19955120B729670F5E1778439C8129A16E772BC354771EE3F13A482779E236846E2AF31
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x64 arch:x64

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

966402

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

advapi32

RegCloseKey RegOverridePredefKey RegOpenKeyExW

kernel32

GetModuleFileNameA GetModuleHandleExW GetACP GetFileType FindFirstFileExA FindNextFileA IsValidCodePage GetOEMCP GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle GetConsoleCP GetConsoleMode SetFilePointerEx WriteConsoleW FindResourceW SizeofResource LockResource LoadResource GetProcAddress GetModuleHandleW FindResourceExW DeleteCriticalSection InitializeCriticalSectionAndSpinCount GetProcessHeap HeapSize HeapFree HeapReAlloc HeapAlloc HeapDestroy GetLastError RaiseException DecodePointer GetCommandLineW GetModuleFileNameW CloseHandle GetCurrentProcessId VirtualQuery LocalFree SetLastError GetCurrentProcess GetEnvironmentVariableW FindClose LoadLibraryW FreeLibrary lstrcmpiW GetTickCount TerminateProcess Sleep lstrlenW MultiByteToWideChar WideCharToMultiByte WriteFile CreateFileW GetFileAttributesExW GetSystemTimeAsFileTime FlushFileBuffers GetPrivateProfileIntW OutputDebugStringA GetCurrentThreadId GetPrivateProfileStringW OutputDebugStringW TryEnterCriticalSection EnterCriticalSection LeaveCriticalSection InitializeCriticalSection ExitProcess IsDebuggerPresent GetStdHandle GlobalAlloc GlobalFree GlobalLock GlobalUnlock RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent QueryPerformanceCounter InitializeSListHead GetStartupInfoW TlsAlloc TlsGetValue TlsSetValue TlsFree EncodePointer LCMapStringW GetStringTypeW GetCPInfo RtlUnwindEx RtlPcToFileHeader LoadLibraryExW

shell32

CommandLineToArgvW

shlwapi

PathAppendW PathRemoveFileSpecW PathStripPathW PathRemoveExtensionW

user32

CloseClipboard OpenClipboard EmptyClipboard SetClipboardData CharLowerBuffW wsprintfW MessageBoxW

Name

.text

Size

78KB

Virtual Size

77KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

71KB

Virtual Size

71KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

12KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

148B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

UPX1

Size

764KB

Virtual Size

764KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-17_a87f169535ec575a5428b7bd8b83f221_icedid_stealc_vidar

advapi32

kernel32

shell32

shlwapi

user32

generic