2026-06-08_502a89e16dfc0abcdee2b939fbbe1425_icedid_njrat_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-06-08_502a89e16dfc0abcdee2b939fbbe1425_icedid_njrat_vidar
Size 2.4MB
Sample260608-p14ddadv9n
SHA256 f25f999f0c5575ca1cd738d79e8f7404f073b184be1e2038bb7b0193499bb209
MD5 502a89e16dfc0abcdee2b939fbbe1425
SHA1 14bce890c60603d763b1540377c96ba6be08d128
SHA512 f54ad059a793370031151fbb6dfeab22ed148ce2c8eccdcb7799352ac58e39008422493bfc7ac2c58c24f4e6280747bebd0431eed52e91a5446b46254e26b61f
SSDEEP 49152:RSUw2DiMEFY2Xk692ozYNXJZGF3ekGtGAlTwyl8sD1LNiXicJFFRGNzj3:RSUVDa92ozu6rGtP7wRGpj3
TLSH
T174B59E1AA7A840F8D17BD13CC9928A46F6B2740A1F749BDF0255065E2F77AF14E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-06-08_502a89e16dfc0abcdee2b939fbbe1425_icedid_njrat_vidar

File Explorer

2026-06-08_502a89e16dfc0abcdee2b939fbbe1425_icedid_njrat_vidar

.exe 2.4MB

2026-06-08_502a89e16dfc0abcdee2b939fbbe1425_icedid_njrat_vidar

IMPHASH 34789f1baed06f9e647c4beb8c5d421e
SHA256 f25f999f0c5575ca1cd738d79e8f7404f073b184be1e2038bb7b0193499bb209
MD5 502a89e16dfc0abcdee2b939fbbe1425
SHA1 14bce890c60603d763b1540377c96ba6be08d128
SHA512 f54ad059a793370031151fbb6dfeab22ed148ce2c8eccdcb7799352ac58e39008422493bfc7ac2c58c24f4e6280747bebd0431eed52e91a5446b46254e26b61f
SSDEEP 49152:RSUw2DiMEFY2Xk692ozYNXJZGF3ekGtGAlTwyl8sD1LNiXicJFFRGNzj3:RSUVDa92ozu6rGtP7wRGpj3
TLSH
T174B59E1AA7A840F8D17BD13CC9928A46F6B2740A1F749BDF0255065E2F77AF14E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

518292

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\BuildAgent\work\fac0970a3d49f93d\Out\Release\Win64\NahimicService.pdb

shlwapi

PathIsRelativeW PathFileExistsW

wtsapi32

WTSEnumerateSessionsExW WTSQueryUserToken WTSRegisterSessionNotification WTSUnRegisterSessionNotification WTSEnumerateSessionsW WTSQuerySessionInformationW WTSFreeMemoryExW WTSSendMessageW WTSFreeMemory

userenv

CreateEnvironmentBlock DestroyEnvironmentBlock

api-ms-win-core-winrt-string-l1-1-0

WindowsDeleteString WindowsGetStringRawBuffer WindowsCreateString WindowsCreateStringReference

api-ms-win-core-winrt-l1-1-0

RoInitialize RoActivateInstance

wintrust

WinVerifyTrust

crypt32

CertGetNameStringW CryptMsgGetParam CertCloseStore CryptQueryObject CertFreeCertificateContext CryptMsgClose CertFindCertificateInStore

setupapi

SetupGetInfDriverStoreLocationW

rpcrt4

RpcBindingVectorFree NdrServerCall2 RpcEpUnregister RpcEpRegisterW RpcServerUseProtseqEpW RpcServerUnregisterIf RpcServerRegisterIf3 RpcServerListen RpcServerInqBindings NdrClientCall2

api-ms-win-core-libraryloader-l1-2-0

FreeLibraryAndExitThread GetModuleFileNameA GetProcAddress GetModuleFileNameW GetModuleHandleExW LoadLibraryExW FreeLibrary GetModuleHandleW

api-ms-win-core-libraryloader-l1-2-1

LoadLibraryW

api-ms-win-core-threadpool-l1-2-0

SubmitThreadpoolWork CloseThreadpoolTimer CreateThreadpoolWait SetThreadpoolWait CreateThreadpoolWork CreateThreadpoolTimer SetThreadpoolTimer CloseThreadpoolWork CloseThreadpoolWait WaitForThreadpoolWaitCallbacks

api-ms-win-core-kernel32-legacy-l1-1-0

RegisterWaitForSingleObject WTSGetActiveConsoleSessionId UnregisterWait

api-ms-win-core-heap-l1-1-0

HeapFree HeapSize GetProcessHeap HeapAlloc HeapReAlloc HeapDestroy

api-ms-win-core-errorhandling-l1-1-0

SetUnhandledExceptionFilter RaiseException GetLastError UnhandledExceptionFilter SetLastError

api-ms-win-core-synch-l1-1-0

CreateEventW InitializeCriticalSectionEx WaitForSingleObject CreateMutexW OpenMutexW InitializeCriticalSectionAndSpinCount CreateMutexExW OpenSemaphoreW CreateEventExW OpenEventW LeaveCriticalSection WaitForSingleObjectEx ResetEvent DeleteCriticalSection ReleaseSemaphore TryEnterCriticalSection AcquireSRWLockExclusive ReleaseSRWLockExclusive CreateSemaphoreExW ReleaseMutex EnterCriticalSection SetEvent

api-ms-win-core-file-l1-1-0

GetFileInformationByHandle FindNextFileA CreateDirectoryW GetFullPathNameW GetFileAttributesExW SetFilePointerEx ReadFile FlushFileBuffers CreateFileW UnlockFileEx LockFileEx GetFileTime FindClose FindNextFileW WriteFile GetFileType FindFirstFileW FindFirstFileExA SetEndOfFile GetDriveTypeW FindFirstFileExW DeleteFileW

api-ms-win-core-processthreads-l1-1-0

OpenProcessToken SetPriorityClass ProcessIdToSessionId GetCurrentThread GetPriorityClass GetCurrentProcess CreateProcessAsUserW GetThreadPriority GetExitCodeThread SwitchToThread SetThreadPriority CreateProcessW GetCurrentProcessId GetStartupInfoW TerminateThread ExitProcess GetExitCodeProcess GetCurrentThreadId TerminateProcess SetThreadToken TlsFree TlsSetValue TlsAlloc TlsGetValue ExitThread

api-ms-win-core-privateprofile-l1-1-0

GetPrivateProfileStringW

api-ms-win-core-localization-l1-2-0

GetUserDefaultLCID GetACP FormatMessageW EnumSystemLocalesW LCMapStringW IsValidCodePage GetOEMCP GetCPInfo IsValidLocale GetLocaleInfoW

api-ms-win-core-debug-l1-1-0

DebugBreak IsDebuggerPresent OutputDebugStringW OutputDebugStringA

api-ms-win-core-registry-l1-1-0

RegNotifyChangeKeyValue RegOpenCurrentUser RegQueryValueExW RegSetValueExW RegGetValueW RegCreateKeyExW RegOpenKeyExW RegSetKeySecurity RegEnumValueW RegCloseKey RegEnumKeyExW RegDeleteTreeW

api-ms-win-core-handle-l1-1-0

CloseHandle DuplicateHandle

api-ms-win-core-util-l1-1-0

DecodePointer EncodePointer

api-ms-win-security-base-l1-1-0

GetTokenInformation DuplicateTokenEx GetSidSubAuthority CopySid DuplicateToken GetAclInformation EqualSid AddAce InitializeAcl GetLengthSid GetAce CreateWellKnownSid InitializeSid RevertToSelf AddAccessAllowedAce IsValidSid AddAccessAllowedAceEx CheckTokenMembership SetSecurityDescriptorDacl AdjustTokenPrivileges InitializeSecurityDescriptor FreeSid GetSidLengthRequired AllocateAndInitializeSid

api-ms-win-core-sysinfo-l1-1-0

GetVersionExW GetSystemTimeAsFileTime GetTickCount GetSystemDirectoryW GetLogicalProcessorInformation

oleaut32

VariantClear SysAllocString SysFreeString VariantInit SafeArrayCopy SafeArrayCreate SafeArrayGetLBound SafeArrayUnlock SafeArrayGetUBound SafeArrayDestroy SafeArrayLock SafeArrayGetVartype

api-ms-win-core-string-l1-1-0

GetStringTypeW MultiByteToWideChar CompareStringW WideCharToMultiByte

api-ms-win-core-com-l1-1-0

CoCreateInstance CoTaskMemFree CoInitializeSecurity CoUninitialize CoSetProxyBlanket PropVariantClear CoInitializeEx

api-ms-win-core-rtlsupport-l1-1-0

RtlUnwind RtlCaptureContext RtlPcToFileHeader RtlVirtualUnwind RtlLookupFunctionEntry RtlUnwindEx

api-ms-win-core-processthreads-l1-1-1

OpenProcess GetThreadTimes IsProcessorFeaturePresent

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead InterlockedPushEntrySList QueryDepthSList InterlockedFlushSList InterlockedPopEntrySList

api-ms-win-security-base-l1-2-2

DeriveCapabilitySidsFromName

api-ms-win-core-heap-l2-1-0

LocalFree LocalAlloc

api-ms-win-security-provider-l1-1-0

SetNamedSecurityInfoW GetNamedSecurityInfoW SetEntriesInAclW

api-ms-win-core-synch-l1-2-0

SignalObjectAndWait Sleep

api-ms-win-core-file-l2-1-2

CopyFileW

api-ms-win-security-sddl-l1-1-0

ConvertSidToStringSidW ConvertStringSecurityDescriptorToSecurityDescriptorW

api-ms-win-core-toolhelp-l1-1-0

Process32FirstW CreateToolhelp32Snapshot Process32NextW

api-ms-win-core-shutdown-l1-1-0

InitiateSystemShutdownExW

api-ms-win-security-lsalookup-l2-1-0

LookupPrivilegeValueW LookupAccountSidW

api-ms-win-core-psapi-l1-1-0

K32EnumProcesses K32GetModuleBaseNameW K32EnumProcessModules

api-ms-win-core-version-l1-1-1

GetFileVersionInfoSizeW GetFileVersionInfoW

api-ms-win-core-version-l1-1-0

VerQueryValueW

api-ms-win-core-processenvironment-l1-1-0

GetCurrentDirectoryW GetStdHandle GetEnvironmentVariableW GetCommandLineA GetCommandLineW SetStdHandle GetEnvironmentStringsW SetEnvironmentVariableW SetEnvironmentVariableA FreeEnvironmentStringsW

api-ms-win-core-datetime-l1-1-0

GetDateFormatW GetTimeFormatW

api-ms-win-core-console-l1-1-0

GetConsoleCP ReadConsoleW GetConsoleMode WriteConsoleW

api-ms-win-core-timezone-l1-1-0

FileTimeToSystemTime SystemTimeToTzSpecificLocalTime GetTimeZoneInformation

api-ms-win-core-versionansi-l1-1-1

GetFileVersionInfoSizeA GetFileVersionInfoA

api-ms-win-core-versionansi-l1-1-0

VerQueryValueA

kernel32

SleepConditionVariableCS WakeConditionVariable InitializeConditionVariable GetTickCount64 QueryPerformanceFrequency LoadLibraryA CreateThread Module32NextW Module32FirstW VirtualQuery InitOnceExecuteOnce InitializeCriticalSection SystemTimeToFileTime GetSystemTime GetThreadId GetModuleHandleA RemoveDirectoryW

user32

AllowSetForegroundWindow UnregisterDeviceNotification UnregisterClassW DestroyWindow CreateWindowExW PeekMessageW RegisterClassExW DefWindowProcW PostMessageW MessageBoxW TranslateMessage GetMessageW DispatchMessageW UnregisterPowerSettingNotification RegisterPowerSettingNotification RegisterDeviceNotificationW

shell32

CommandLineToArgvW ShellExecuteExW

ole32

CoInitialize

dbghelp

SymFromAddr SymInitialize SymGetOptions SymSetOptions

winhttp

WinHttpOpen WinHttpCloseHandle WinHttpReceiveResponse WinHttpCrackUrl WinHttpSendRequest WinHttpQueryHeaders WinHttpConnect WinHttpOpenRequest

ext-ms-win-shell32-shellfolders-l1-1-0

SHGetKnownFolderPath

api-ms-win-core-sysinfo-l1-2-0

VerSetConditionMask

api-ms-win-core-kernel32-legacy-l1-1-1

VerifyVersionInfoW

api-ms-win-ntuser-sysparams-l1-1-0

GetSystemMetrics

api-ms-win-core-file-l1-2-2

AreFileApisANSI

api-ms-win-core-file-l2-1-0

CreateHardLinkW

api-ms-win-core-threadpool-legacy-l1-1-0

ChangeTimerQueueTimer QueueUserWorkItem DeleteTimerQueueTimer CreateTimerQueueTimer UnregisterWaitEx CreateTimerQueue

api-ms-win-core-kernel32-legacy-l1-1-2

GetBinaryTypeW

api-ms-win-core-synch-l1-2-1

WaitForMultipleObjects

api-ms-win-core-memory-l1-1-0

CreateFileMappingW UnmapViewOfFile VirtualAlloc VirtualFree MapViewOfFile VirtualProtect

api-ms-win-core-console-l2-1-0

SetConsoleCursorPosition AttachConsole ReadConsoleOutputW GetConsoleScreenBufferInfo

api-ms-win-service-management-l1-1-0

OpenSCManagerW CreateServiceW OpenServiceW DeleteService CloseServiceHandle

api-ms-win-service-core-l1-1-0

StartServiceCtrlDispatcherW RegisterServiceCtrlHandlerExW SetServiceStatus

api-ms-win-service-management-l2-1-0

ChangeServiceConfig2W

api-ms-win-service-winsvc-l1-1-0

QueryServiceStatus ControlService

api-ms-win-core-namedpipe-l1-1-0

PeekNamedPipe

api-ms-win-core-systemtopology-l1-1-0

GetNumaHighestNodeNumber

api-ms-win-core-processtopology-obsolete-l1-1-0

GetProcessAffinityMask SetThreadAffinityMask

api-ms-win-core-registry-l1-1-1

RegSetKeyValueW RegDeleteKeyValueW

Name

.text

Size

1.3MB

Virtual Size

1.3MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

463KB

Virtual Size

463KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

21KB

Virtual Size

74KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

68KB

Virtual Size

68KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1024B

Virtual Size

776B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

580KB

Virtual Size

584KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

generic

count=20, id=260, version=25203,

count=12, id=259, version=25203,

count=194, id=261, version=25203,

count=1, id=260, version=25548,

count=9, id=259, version=26706,

count=41, id=261, version=25548,

count=27, id=261, version=26731,

count=141, id=261, version=26706,

count=37, id=260, version=26706,

count=27, id=261, productName=VS2017 v15.4.5 build 25547, version=25547,

count=5, id=262, version=25203,

count=30, id=260, version=26731,

count=134, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=25, id=257, version=25203,

count=400, id=1, productName=Unmarked objects,

count=1, id=259, version=26731,

count=33, id=265, version=26731,

count=1, id=255, version=26731,

count=1, id=258, version=26731,