2026-04-23_dc60dfd88d594cb147bff15f4894beed_amadey_icedid_njrat_vidar

General

Target
2026-04-23_dc60dfd88d594cb147bff15f4894beed_amadey_icedid_njrat_vidar
Size 2.9MB
Sample260423-wch6vsdw21
SHA256 5c99e39bc34ee75b36b375de0a091ed0a0c0ed2f9960c8281599ac402c61c071
MD5 dc60dfd88d594cb147bff15f4894beed
SHA1 f45b2fa73ddf26ef92f96716dea26d736a893688
SHA512 f6fac27d7a0b84c88f52ec8ec452314a4af8f7092a1a6f7c7fcb7565ba5e36fd7bb400ab0c4a5e8bf9b67bf0d792c24c0de2c477f8aca2300ab1aa34019ae857
SSDEEP 49152:4r/pYq+y6i1zuajsauZnJTpYq+y6i1zuajsauZnJG:4/6htD6ht2
TLSH
T1B6E55B1AB3F841E5D073C179C6A29656EA7274622730DACF1390C67C2F27AE19D39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-04-23_dc60dfd88d594cb147bff15f4894beed_amadey_icedid_njrat_vidar

File Explorer

2026-04-23_dc60dfd88d594cb147bff15f4894beed_amadey_icedid_njrat_vidar

.exe 2.9MB

2026-04-23_dc60dfd88d594cb147bff15f4894beed_amadey_icedid_njrat_vidar

IMPHASH a26cb263b9dc97b5627f1e68caac6231
SHA256 5c99e39bc34ee75b36b375de0a091ed0a0c0ed2f9960c8281599ac402c61c071
MD5 dc60dfd88d594cb147bff15f4894beed
SHA1 f45b2fa73ddf26ef92f96716dea26d736a893688
SHA512 f6fac27d7a0b84c88f52ec8ec452314a4af8f7092a1a6f7c7fcb7565ba5e36fd7bb400ab0c4a5e8bf9b67bf0d792c24c0de2c477f8aca2300ab1aa34019ae857
SSDEEP 49152:4r/pYq+y6i1zuajsauZnJTpYq+y6i1zuajsauZnJG:4/6htD6ht2
TLSH
T1B6E55B1AB3F841E5D073C179C6A29656EA7274622730DACF1390C67C2F27AE19D39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

10

Entry point

32016

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

bootsect.pdb

advapi32

EventUnregister EventRegister EventWriteTransfer RegOpenKeyExW RegCloseKey RegQueryValueExW

kernel32

GetModuleHandleExW SetFilePointer GetLastError GetProcAddress FreeLibrary GetConsoleOutputCP GetStdHandle GetModuleFileNameW LocalAlloc GetConsoleMode FormatMessageW QueryDosDeviceW LocalFree WideCharToMultiByte GetFileType TerminateProcess GetCurrentProcess UnhandledExceptionFilter GetTickCount GetSystemTimeAsFileTime GetCurrentThreadId GetCurrentProcessId QueryPerformanceCounter GetModuleHandleW SetUnhandledExceptionFilter Sleep ReadFile WriteFile WriteConsoleW SetLastError GetSystemDefaultUILanguage GetUserDefaultUILanguage GetLocaleInfoW CreateFileW GetVersionExW SearchPathW UnmapViewOfFile CloseHandle FindResourceExW LoadResource CreateFileMappingW MapViewOfFile LoadLibraryExW

msvcrt

_snwscanf_s bsearch wcsncmp wcsstr wcsnlen memcpy ?terminate@@YAXXZ _fmode __C_specific_handler _initterm memset __setusermatherr _cexit _exit exit __set_app_type __getmainargs _amsg_exit _XcptFilter iswxdigit _vsnwprintf _wcsnicmp _stricmp swprintf_s isalpha wcscpy_s _wcsicmp _wcslwr _commode

ntdll

RtlVirtualUnwind RtlLookupFunctionEntry NtWaitForSingleObject RtlFreeHeap NtQueryDirectoryObject NtCreateEvent NtOpenDirectoryObject NtDeviceIoControlFile NtQuerySymbolicLinkObject RtlAllocateHeap NtOpenSymbolicLinkObject NtResetEvent NtOpenFile NtQueryVolumeInformationFile RtlNtStatusToDosError NtFsControlFile NtClose RtlInitUnicodeString NtQuerySystemInformation RtlCaptureContext NtQueryValueKey NtQueryBootEntryOrder NtQueryBootOptions NtTranslateFilePath NtEnumerateBootEntries NtAdjustPrivilegesToken NtOpenProcessTokenEx NtSetInformationThread NtOpenThreadTokenEx RtlImpersonateSelf NtOpenKey

Sharing

General

Malware Config

Signatures

File Explorer

2026-04-23_dc60dfd88d594cb147bff15f4894beed_amadey_icedid_njrat_vidar

advapi32

kernel32

msvcrt

ntdll

generic