bruteratel | 2026-06-04_1ca4c9b85ea831f7b4ea937f29ca147c_icedid_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-06-04_1ca4c9b85ea831f7b4ea937f29ca147c_icedid_vidar
Size 16.6MB
Sample260604-rxstkshv4k
SHA256 7339d428ad8197bc73d0040ebe7b7cb3f234d4cae247dea4e7314a9b4ede3a5c
MD5 1ca4c9b85ea831f7b4ea937f29ca147c
SHA1 c87d65321867cc17d0aec485e6f06a769f04fdb1
SHA512 94e672d0e2f153052f4c89971f50c30a11f539d9212588ac62176df705daf064418dbdd42e705f5ed1910b41118a40babb60d3dc57f9a848489732f8bbb6894e
SSDEEP 196608:yBM6p/cY3zeS+YxWeBX+bzyzv6GEc3i1dapn2Sz1xWeBX+bzyzG6xMGrg8tbK:yBhbzOQpvvYXSnL7pvGgMGrg8JK
TLSH
T12107F1D625D461BDC4A2C630E39657FAF0D9B8580DB9941FBFC618012A31DC9ECB6B32
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

backdoor bruteratel

Malware Config

Signatures

Family: Brute Ratel C4
A customized command and control framework for red teaming and adversary simulation.
backdoor bruteratel

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-06-04_1ca4c9b85ea831f7b4ea937f29ca147c_icedid_vidar

File Explorer

2026-06-04_1ca4c9b85ea831f7b4ea937f29ca147c_icedid_vidar

.exe 16.6MB

2026-06-04_1ca4c9b85ea831f7b4ea937f29ca147c_icedid_vidar

IMPHASH d7fc74248dfaf06193c2eaf777a9b271
SHA256 7339d428ad8197bc73d0040ebe7b7cb3f234d4cae247dea4e7314a9b4ede3a5c
MD5 1ca4c9b85ea831f7b4ea937f29ca147c
SHA1 c87d65321867cc17d0aec485e6f06a769f04fdb1
SHA512 94e672d0e2f153052f4c89971f50c30a11f539d9212588ac62176df705daf064418dbdd42e705f5ed1910b41118a40babb60d3dc57f9a848489732f8bbb6894e
SSDEEP 196608:yBM6p/cY3zeS+YxWeBX+bzyzv6GEc3i1dapn2Sz1xWeBX+bzyzG6xMGrg8tbK:yBhbzOQpvvYXSnL7pvGgMGrg8JK
TLSH
T12107F1D625D461BDC4A2C630E39657FAF0D9B8580DB9941FBFC618012A31DC9ECB6B32
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

19256872

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

VirtualAlloc Sleep CloseHandle ExitProcess CreateEventA LoadLibraryExA GetProcAddress WideCharToMultiByte CreateEventW WriteConsoleW CreateFileW SetFilePointerEx GetConsoleMode GetConsoleOutputCP FlushFileBuffers GetStringTypeW SetStdHandle OutputDebugStringW GetFileType LCMapStringW CompareStringW VirtualProtect FlsFree FlsSetValue FlsGetValue FlsAlloc SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetCPInfo GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW FindClose WriteFile GetStdHandle GetModuleFileNameW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW GetModuleHandleW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead RaiseException GetLastError SetLastError HeapAlloc HeapReAlloc HeapFree HeapSize GetProcessHeap InitializeSRWLock EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionAndSpinCount DeleteCriticalSection GetSystemInfo ReleaseSRWLockExclusive TryAcquireSRWLockExclusive TlsGetValue TlsSetValue GetCurrentProcessorNumber AcquireSRWLockExclusive MultiByteToWideChar InitializeCriticalSectionEx FormatMessageA VirtualFree TlsAlloc RtlUnwindEx RtlPcToFileHeader EncodePointer TlsFree FreeLibrary LoadLibraryExW GetModuleHandleExW

ws2_32

WSACleanup closesocket WSAStartup

winmm

timeBeginPeriod timeGetDevCaps timeEndPeriod

Name

.text

Size

434KB

Virtual Size

433KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

90KB

Virtual Size

90KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

643KB

Virtual Size

2.7MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

21KB

Virtual Size

20KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.gehcont

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.cin

Size

7.8MB

Virtual Size

7.8MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.$rf

Size

1024B

Virtual Size

832B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.a3<

Size

7.5MB

Virtual Size

7.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

92KB

Virtual Size

92KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-06-04_1ca4c9b85ea831f7b4ea937f29ca147c_icedid_vidar

kernel32

ws2_32

winmm

generic