2026-10-22_d918d1131e53bc4bb640d1c578007d8f_icedid_luca-stealer_njrat_stealc_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-22_d918d1131e53bc4bb640d1c578007d8f_icedid_luca-stealer_njrat_stealc_vidar
Size 5.2MB
Sample261023-we7bgaft7n
SHA256 9e49dc9720e3ff0803fd8a26f61823b59e32f5dff6b86f8b55804977c39f291a
MD5 d918d1131e53bc4bb640d1c578007d8f
SHA1 3b12739f45f0ae932f068254967ec5278c9ba4df
SHA512 d6b6225bb384f0e92c3ecd52c53acba2361779201e6bae05671f5e052d0072179a1d482f71fb89a8148035f85dbbd24a8ee6ee475dcaaff3234af7187eea7e2e
SSDEEP 49152:1zB6w4sPZsJv6M3TBGSfGNBJWHYQ1a+BRz3TQptWA:Hyg4OJMCn
TLSH
T1EC46B55AEA6541E1C4F9C03DD553622FF87138A68330A7C7A681AB175B337E4EA3E740
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-22_d918d1131e53bc4bb640d1c578007d8f_icedid_luca-stealer_njrat_stealc_vidar

File Explorer

2026-10-22_d918d1131e53bc4bb640d1c578007d8f_icedid_luca-stealer_njrat_stealc_vidar

.exe 5.2MB

2026-10-22_d918d1131e53bc4bb640d1c578007d8f_icedid_luca-stealer_njrat_stealc_vidar

IMPHASH 80b47e87db0df52795ff4b375d587fd0
SHA256 9e49dc9720e3ff0803fd8a26f61823b59e32f5dff6b86f8b55804977c39f291a
MD5 d918d1131e53bc4bb640d1c578007d8f
SHA1 3b12739f45f0ae932f068254967ec5278c9ba4df
SHA512 d6b6225bb384f0e92c3ecd52c53acba2361779201e6bae05671f5e052d0072179a1d482f71fb89a8148035f85dbbd24a8ee6ee475dcaaff3234af7187eea7e2e
SSDEEP 49152:1zB6w4sPZsJv6M3TBGSfGNBJWHYQ1a+BRz3TQptWA:Hyg4OJMCn
TLSH
T1EC46B55AEA6541E1C4F9C03DD553622FF87138A68330A7C7A681AB175B337E4EA3E740
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

3253144

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Build\Build_2027a_D20260204T153521\fa_rss\Release\PCAppStore.pdb

version

GetFileVersionInfoW GetFileVersionInfoSizeW VerQueryValueW

urlmon

CreateUri URLDownloadToFileW

kernel32

CreateFileW OpenEventW GetOverlappedResult ReadDirectoryChangesW LocalFree CreateDirectoryW FreeLibrary LoadLibraryW ExpandEnvironmentStringsW HeapDestroy HeapReAlloc HeapSize GetTickCount64 FindResourceExW VerSetConditionMask FindClose FindFirstFileExW FindNextFileW GetFileAttributesW ReadFile RemoveDirectoryW CreateProcessW OpenProcess VerifyVersionInfoW LCIDToLocaleName GetUserDefaultUILanguage GetLocaleInfoEx GetConsoleOutputCP K32EnumProcessModules K32GetModuleBaseNameW GetStartupInfoW GetTickCount CopyFileA IsProcessCritical QueryFullProcessImageNameW CreateToolhelp32Snapshot Process32FirstW Process32NextW K32EnumProcesses K32GetModuleFileNameExW GetTempPathW GetExitCodeProcess GetProcessId InitializeProcThreadAttributeList DeleteProcThreadAttributeList UpdateProcThreadAttribute OpenMutexW OpenFileMappingW MapViewOfFile GetStdHandle GetEnvironmentVariableA SetCurrentDirectoryW FindFirstFileW GetCurrentProcess GetSystemTime SystemTimeToFileTime FileTimeToLocalFileTime lstrcmpA FileTimeToSystemTime FlushFileBuffers QueryPerformanceCounter CreateFileMappingW FormatMessageA GetSystemTimeAsFileTime GetFileSize LockFileEx UnlockFile HeapCompact GetSystemInfo DeleteFileA LoadLibraryA CreateFileA FlushViewOfFile GetFileAttributesExW GetFileAttributesA GetDiskFreeSpaceA GetTempPathA MultiByteToWideChar HeapValidate UnmapViewOfFile CreateMutexW UnlockFileEx SetEndOfFile GetFullPathNameA SetFilePointer LockFile OutputDebugStringA GetDiskFreeSpaceW WriteFile GetFullPathNameW HeapCreate AreFileApisANSI SetEnvironmentVariableW WaitForMultipleObjects LeaveCriticalSection TryEnterCriticalSection DeleteCriticalSection DecodePointer InitializeCriticalSectionEx GlobalAlloc GlobalUnlock GlobalLock LoadLibraryExW GetEnvironmentVariableW GetCommandLineA GetExitCodeThread ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive GetCurrentDirectoryW GetFileInformationByHandle SetFileInformationByHandle GetFileInformationByHandleEx GetStringTypeW InitOnceBeginInitialize InitOnceComplete QueryPerformanceFrequency SleepConditionVariableSRW WakeConditionVariable WakeAllConditionVariable EncodePointer LCMapStringEx CompareStringEx GetCPInfo InitializeSListHead RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter Sleep SetUnhandledExceptionFilter IsProcessorFeaturePresent TerminateProcess RtlPcToFileHeader GetCommandLineW RtlUnwindEx GetModuleFileNameW CreateEventW ResetEvent InterlockedPushEntrySList InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree CreateThread ExitThread GetEnvironmentStringsW FreeLibraryAndExitThread ExitProcess GetDriveTypeW GetFileType PeekNamedPipe SystemTimeToTzSpecificLocalTime FindResourceW SizeofResource LockResource LoadResource WideCharToMultiByte FormatMessageW GetProcAddress GetModuleHandleExW GetModuleHandleW GetModuleFileNameA GetCurrentThreadId GetCurrentProcessId FlsAlloc FlsGetValue FlsSetValue GetProcessHeap FlsFree VirtualProtect GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW SetEvent ReadConsoleW SetFilePointerEx GetFileSizeEx CreateSemaphoreExW CreateMutexExW OpenSemaphoreW WaitForSingleObjectEx WaitForSingleObject ReleaseMutex InitializeCriticalSection ReleaseSemaphore WriteConsoleW FreeEnvironmentStringsW HeapAlloc HeapFree SetLastError GetLastError CloseHandle OutputDebugStringW DebugBreak IsDebuggerPresent DeleteFileW GetOEMCP GetACP IsValidCodePage RtlUnwind RaiseException GetConsoleMode SetStdHandle EnterCriticalSection EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW GetTimeZoneInformation

user32

RegisterClassExW AttachThreadInput SendMessageTimeoutW RegisterWindowMessageW UpdateWindow GetWindowLongPtrW SetWindowLongW SetRectEmpty FillRect AdjustWindowRectEx GetClientRect SetWindowTextW GetWindowPlacement UnregisterClassW CreatePopupMenu TrackMouseEvent DestroyMenu GetMenuItemCount InsertMenuW AppendMenuW RemoveMenu TrackPopupMenu LoadIconW MonitorFromWindow LoadCursorW EqualRect InvalidateRect EndPaint BeginPaint ShowWindow DestroyWindow CreateWindowExW RegisterClassW PostQuitMessage EmptyClipboard FindWindowExW UnhookWinEvent GetClassInfoExW GetForegroundWindow keybd_event GetCapture SetCapture PtInRect SetClipboardData SetClassLongPtrW OpenClipboard CloseClipboard ChangeWindowMessageFilterEx GetShellWindow SetCursorPos GetWindowTextW SetWindowPos GetPhysicalCursorPos GetSystemMetrics GetAsyncKeyState CallNextHookEx UnhookWindowsHookEx SetWindowsHookExW EnumChildWindows WindowFromPoint ScreenToClient GetCursorPos IsChild PostThreadMessageW SendMessageW GetMessageW GetThreadDpiAwarenessContext SetThreadDpiAwarenessContext EnumDisplayMonitors FindWindowW IntersectRect GetMonitorInfoW MonitorFromRect DialogBoxParamW MonitorFromPoint SystemParametersInfoW GetWindow GetWindowThreadProcessId GetClassNameW EnumWindows ReleaseDC GetDC SendInput EndDialog IsWindowVisible SetWinEventHook PeekMessageW DispatchMessageW TranslateMessage KillTimer SetTimer IsIconic SetForegroundWindow SetFocus IsWindow GetWindowRect ReleaseCapture PostMessageW OpenIcon SetWindowPlacement SetWindowLongPtrW DefWindowProcW IsZoomed

gdi32

CreateCompatibleBitmap CreateCompatibleDC DeleteDC SelectObject DeleteObject CreateSolidBrush BitBlt

winspool.drv

EnumPrintersW

comdlg32

GetOpenFileNameW

advapi32

EventUnregister RegGetValueW EventWriteTransfer EventSetInformation EventRegister RegNotifyChangeKeyValue RegCreateKeyExW GetUserNameW RegSetValueExW RegQueryValueExW RegOpenKeyExW RegDeleteValueW RegCloseKey

shell32

SHEmptyRecycleBinW SHQueryRecycleBinW SHGetFolderPathW SHGetKnownFolderPath SHAppBarMessage ShellExecuteW ShellExecuteExW Shell_NotifyIconW CommandLineToArgvW

ole32

RevokeDragDrop CoTaskMemAlloc OleInitialize CoSetProxyBlanket CoInitializeSecurity OleRun CoInitialize CoCreateInstance RegisterDragDrop CoInitializeEx CoTaskMemFree CoUninitialize CoCreateFreeThreadedMarshaler CoAllowSetForegroundWindow

oleaut32

VariantInit VariantChangeType SysFreeString SysAllocString SysStringLen VariantClear GetErrorInfo SetErrorInfo

iphlpapi

IcmpCloseHandle IcmpCreateFile

winhttp

WinHttpSendRequest WinHttpSetTimeouts WinHttpConnect WinHttpCloseHandle WinHttpOpen WinHttpReadData WinHttpQueryDataAvailable WinHttpOpenRequest WinHttpSetOption WinHttpQueryHeaders WinHttpReceiveResponse

crypt32

CryptMsgClose CryptQueryObject CertGetNameStringW CertFreeCertificateContext CertFindCertificateInStore CertCloseStore CertOpenStore CryptDecodeObjectEx CryptDecodeObject CryptMsgOpenToDecode CryptMsgUpdate CryptMsgGetParam

ws2_32

WSAConnectByNameW closesocket recv send shutdown socket WSAStartup WSACleanup WSAGetLastError

sspicli

QueryContextAttributesW DecryptMessage EncryptMessage FreeContextBuffer FreeCredentialsHandle ApplyControlToken DeleteSecurityContext InitializeSecurityContextW AcquireCredentialsHandleW

ext-ms-win-networking-wlanapi-l1-1-0

WlanCloseHandle WlanFreeMemory WlanGetAvailableNetworkList WlanEnumInterfaces WlanOpenHandle

wlanapi

WlanScan WlanRegisterNotification WlanAllocateMemory

shlwapi

PathCreateFromUrlW PathFindFileNameW AssocCreate PathAddBackslashW SHCreateStreamOnFileEx UrlCreateFromPathW PathRenameExtensionW

api-ms-win-shcore-scaling-l1-1-1

GetDpiForMonitor

dwmapi

DwmGetWindowAttribute DwmSetWindowAttribute

wtsapi32

WTSRegisterSessionNotification WTSUnRegisterSessionNotification

gdiplus

GdipCreateMatrix GdipCloneBrush GdipSetStringFormatAlign GdipDeleteStringFormat GdipDeleteBrush GdipCreateSolidFill GdipDisposeImage GdipCreateBitmapFromHBITMAP GdiplusStartup GdipCreateStringFormat GdiplusShutdown GdipDrawString GdipAlloc GdipCloneImage GdipFree GdipFlush GdipCreateFromHDC GdipDeleteGraphics GdipSetSmoothingMode GdipSetWorldTransform GdipTranslateWorldTransform GdipScaleWorldTransform GdipFillEllipse GdipDrawImageI GdipCreateFontFamilyFromName GdipDeleteFontFamily GdipCreateFont GdipDeleteFont GdipDeleteMatrix

msi

ord70 ord45 ord92 ord8 ord32 ord159 ord160 ord118

wininet

InternetCloseHandle InternetConnectW InternetReadFile InternetQueryDataAvailable InternetSetOptionW HttpOpenRequestW HttpAddRequestHeadersW HttpSendRequestW HttpQueryInfoW InternetCheckConnectionW InternetOpenW

setupapi

SetupDiEnumDeviceInfo SetupDiGetDeviceRegistryPropertyW SetupDiGetClassDevsW SetupDiDestroyDeviceInfoList

api-ms-win-core-winrt-error-l1-1-1

RoOriginateLanguageException

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory

Name

.text

Size

3.6MB

Virtual Size

3.6MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

839KB

Virtual Size

839KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

185KB

Virtual Size

317KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

257KB

Virtual Size

257KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

328KB

Virtual Size

328KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

13KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-22_d918d1131e53bc4bb640d1c578007d8f_icedid_luca-stealer_njrat_stealc_vidar

version

urlmon

kernel32

user32

gdi32

winspool.drv

comdlg32

advapi32

shell32

ole32

oleaut32

iphlpapi

winhttp

crypt32

ws2_32

sspicli

ext-ms-win-networking-wlanapi-l1-1-0

wlanapi

shlwapi

api-ms-win-shcore-scaling-l1-1-1

dwmapi

wtsapi32

gdiplus

msi

wininet

setupapi

api-ms-win-core-winrt-error-l1-1-1

api-ms-win-core-winrt-l1-1-0

generic