2026-05-08_276eea79cdfb2e73ecda1d86d6892e26_icedid_njrat_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-05-08_276eea79cdfb2e73ecda1d86d6892e26_icedid_njrat_vidar
Size 2.5MB
Sample260509-aetjqafy21
SHA256 6d2c0081984a95a21ff20a4f261077a08905add3cb06e42f23151fb5a98854fa
MD5 276eea79cdfb2e73ecda1d86d6892e26
SHA1 14510958519b4911a8e6a2e040c9255b31bdca2b
SHA512 05371d5cfee0109a411e15c46fdc0e0714f231f92204b0979b74329e281317c81f2d46c12bba937dea1994f79d0f6000ded4a14da1413758d475520723870993
SSDEEP 49152:uc3bJJcPuSlq+/BWNlmYm2w7fK8I2ytkTDsTXdCkVaQIVh0q4lYn6+xS/b:ue0uvhkyJ2ymP+XbVaQIVhulfb
TLSH
T1BFC5125377A405EEE57BD13CC9525A12E97278055720E38F03AC9A6A2F033916EFFB21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-05-08_276eea79cdfb2e73ecda1d86d6892e26_icedid_njrat_vidar

File Explorer

2026-05-08_276eea79cdfb2e73ecda1d86d6892e26_icedid_njrat_vidar

.exe 2.5MB

2026-05-08_276eea79cdfb2e73ecda1d86d6892e26_icedid_njrat_vidar

IMPHASH 14f5af7bd5df39e70479e5dcabbb6980
SHA256 6d2c0081984a95a21ff20a4f261077a08905add3cb06e42f23151fb5a98854fa
MD5 276eea79cdfb2e73ecda1d86d6892e26
SHA1 14510958519b4911a8e6a2e040c9255b31bdca2b
SHA512 05371d5cfee0109a411e15c46fdc0e0714f231f92204b0979b74329e281317c81f2d46c12bba937dea1994f79d0f6000ded4a14da1413758d475520723870993
SSDEEP 49152:uc3bJJcPuSlq+/BWNlmYm2w7fK8I2ytkTDsTXdCkVaQIVh0q4lYn6+xS/b:ue0uvhkyJ2ymP+XbVaQIVhulfb
TLSH
T1BFC5125377A405EEE57BD13CC9525A12E97278055720E38F03AC9A6A2F033916EFFB21
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

28780

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\WORK\BASE_UTILITY_SVN_ROOT\R0YVU34W\src\tphkload\clients\numlock\recv\obj\AMD64\tpnumlkd.pdb

kernel32

GetPrivateProfileStringW WTSGetActiveConsoleSessionId WideCharToMultiByte GetUserDefaultUILanguage FlushFileBuffers ReadFile WriteFile ConnectNamedPipe DisconnectNamedPipe CreateNamedPipeW GetSystemFirmwareTable WriteConsoleW lstrlenW lstrlenA LocalFree LocalAlloc LoadLibraryW GetProcAddress GetModuleHandleW GetModuleFileNameW FreeLibrary GetVersionExW GetTickCount ProcessIdToSessionId TerminateThread CreateThread ReadConsoleW GetConsoleMode GetCurrentProcessId HeapReAlloc HeapSize SetFilePointerEx GetFileSizeEx GetStringTypeW SetStdHandle OutputDebugStringW SetConsoleCtrlHandler GetProcessHeap SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW MultiByteToWideChar GetCommandLineA GetCPInfo GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW FindClose EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW Sleep OpenEventW CreateEventW CreateMutexW WaitForSingleObject ReleaseMutex SetEvent CancelIo GetOverlappedResult DeviceIoControl SetLastError GetCommandLineW GetLastError CloseHandle CreateFileW GetDateFormatW GetFileType HeapAlloc HeapFree GetCurrentThread GetStdHandle ExitProcess GetModuleHandleExW FreeLibraryAndExitThread ResumeThread ExitThread EncodePointer LoadLibraryExW TlsFree ExpandEnvironmentStringsW GetConsoleCP TlsSetValue TlsGetValue TlsAlloc InterlockedFlushSList InterlockedPushEntrySList EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionAndSpinCount DeleteCriticalSection ResetEvent WaitForSingleObjectEx RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW QueryPerformanceCounter GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead RtlUnwindEx RtlPcToFileHeader RaiseException RtlUnwind

advapi32

CreateProcessAsUserW AllocateAndInitializeSid FreeSid RegCloseKey RegCreateKeyExW RegNotifyChangeKeyValue RegOpenKeyExW RegQueryValueExW RegSetValueExW SetEntriesInAclW SetNamedSecurityInfoW ImpersonateLoggedOnUser RevertToSelf

user32

EndPaint TranslateMessage DispatchMessageW PeekMessageW PostMessageW PostThreadMessageW DefWindowProcW PostQuitMessage LoadImageW LoadCursorW SetClassLongPtrW SetWindowLongPtrW GetWindowLongPtrW GetCursorPos RegisterClassExW SetWindowRgn InvalidateRect BeginPaint UpdateWindow GetSystemMetrics MsgWaitForMultipleObjects SendInput GetAsyncKeyState GetKeyState SetFocus SetWindowPos SetLayeredWindowAttributes ShowWindow DestroyWindow CreateWindowExW

gdi32

BitBlt CreateDCW CombineRgn CreateCompatibleDC CreateRectRgn CreateRoundRectRgn CreateSolidBrush DeleteDC DeleteObject GetPixel SetPixel GetObjectW CreateCompatibleBitmap SelectObject

wtsapi32

WTSQuerySessionInformationW WTSQueryUserToken WTSUnRegisterSessionNotification WTSRegisterSessionNotification WTSFreeMemory

shlwapi

wnsprintfW StrStrW PathRemoveExtensionW PathFileExistsW StrRChrW StrCpyNW StrCpyW

imm32

ImmDisableIME

userenv

DestroyEnvironmentBlock CreateEnvironmentBlock

shell32

SHGetFolderPathW

Sharing

General

Malware Config

Signatures

File Explorer

2026-05-08_276eea79cdfb2e73ecda1d86d6892e26_icedid_njrat_vidar

kernel32

advapi32

user32

gdi32

wtsapi32

shlwapi

imm32

userenv

shell32

generic