2026-06-27_7593ec7d195848ee0caf807414c7120e_icedid_njrat_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-06-27_7593ec7d195848ee0caf807414c7120e_icedid_njrat_vidar
Size 5.3MB
Sample260629-grzd3aev3s
SHA256 3e59480d509892747743853bec7942b9107d5c5885e98207fee0b65762304fbd
MD5 7593ec7d195848ee0caf807414c7120e
SHA1 6a75647e77a154532a8105a7568f72fd841d31c1
SHA512 72ed3f2e987295fbb9e5ba4f5d4f77bc41f6a2b65d0bb3ac360901ecdc4940598a38eba7e8323889c34175e37627cc555cd751c2c08015a27411957e3296c1ec
SSDEEP 49152:XTBFzA0dWNPQbrABOgxbW5tZhUsgtdH5qQRrLKcq60csOGTO7LhNlbaSvxwiKGgw:3poP52O7Lhj9qJqhJd9JP+k
TLSH
T1B8467C4527EE01A8E53BE17A8BB3C50BE67278904F3996EB0092825F0F376D19F75721
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-06-27_7593ec7d195848ee0caf807414c7120e_icedid_njrat_vidar

File Explorer

2026-06-27_7593ec7d195848ee0caf807414c7120e_icedid_njrat_vidar

.exe 5.3MB

2026-06-27_7593ec7d195848ee0caf807414c7120e_icedid_njrat_vidar

IMPHASH a7ac8be690120bc85d5c85b2edab268c
SHA256 3e59480d509892747743853bec7942b9107d5c5885e98207fee0b65762304fbd
MD5 7593ec7d195848ee0caf807414c7120e
SHA1 6a75647e77a154532a8105a7568f72fd841d31c1
SHA512 72ed3f2e987295fbb9e5ba4f5d4f77bc41f6a2b65d0bb3ac360901ecdc4940598a38eba7e8323889c34175e37627cc555cd751c2c08015a27411957e3296c1ec
SSDEEP 49152:XTBFzA0dWNPQbrABOgxbW5tZhUsgtdH5qQRrLKcq60csOGTO7LhNlbaSvxwiKGgw:3poP52O7Lhj9qJqhJd9JP+k
TLSH
T1B8467C4527EE01A8E53BE17A8BB3C50BE67278904F3996EB0092825F0F376D19F75721
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2165424

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\jenkins\workspace\MainRel4_Dell\Consumer\MainRel4_Dell\Products\Release\x64\WavesSysSvc64.pdb

kernel32

SetEvent CreateEventW WideCharToMultiByte CloseHandle HeapAlloc DecodePointer RtlUnwind WaitForSingleObject ResetEvent EnterCriticalSection LeaveCriticalSection InitializeCriticalSection LocalAlloc LoadLibraryW FreeLibrary GetProcessHeap CreateTimerQueueTimer DeleteTimerQueueEx DeleteCriticalSection Sleep GetThreadId DeleteTimerQueueTimer CreateTimerQueue GetProcAddress LocalFree ConnectNamedPipe WaitNamedPipeW CreateIoCompletionPort GetSystemTime VerifyVersionInfoW GetCurrentProcess lstrlenW GetModuleHandleW ReadFile GetModuleHandleExW TerminateProcess GetModuleFileNameW K32GetModuleFileNameExW GetSystemPowerStatus CreateFileW OpenProcess CreateToolhelp32Snapshot ProcessIdToSessionId FormatMessageW Process32NextW Process32FirstW WTSGetActiveConsoleSessionId GetCurrentProcessId CreateProcessW QueryFullProcessImageNameW GetExitCodeProcess CreateThread SetDllDirectoryW WaitForMultipleObjects OpenEventW CreateMutexW GetSystemInfo K32EnumProcesses DeviceIoControl OpenFileMappingW UnmapViewOfFile CreateFileMappingW MapViewOfFile FindResourceW DeleteFileW CopyFileW FindFirstFileW FindNextFileW FindClose WriteFile IsDebuggerPresent SleepEx VerSetConditionMask GetOverlappedResult QueueUserAPC TerminateThread PostQueuedCompletionStatus PeekNamedPipe GetQueuedCompletionStatus CreateNamedPipeW CreateWaitableTimerW SetWaitableTimer GetFirmwareEnvironmentVariableExW CreateEventExW FormatMessageA GetPhysicallyInstalledSystemMemory GetFileTime MoveFileExW SetFileAttributesW GetFileAttributesW GetTempPathW RemoveDirectoryW LoadLibraryExA VirtualQuery LoadResource WriteConsoleW SetEndOfFile SetStdHandle SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP GetACP IsValidCodePage FindFirstFileExW ReadConsoleW GetFileAttributesExW GetConsoleMode GetConsoleOutputCP FlushFileBuffers EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetTimeFormatW GetDateFormatW FlsFree FlsSetValue FlsGetValue FlsAlloc SetFilePointerEx GetFileSizeEx GetTimeZoneInformation GetFileType GetStdHandle ExitProcess ExitThread GetCommandLineW GetCommandLineA RtlUnwindEx WaitForMultipleObjectsEx VirtualFree VirtualProtect VirtualAlloc GetVersionExW UnregisterWaitEx ReleaseSemaphore UnregisterWait RegisterWaitForSingleObject SetThreadAffinityMask GetProcessAffinityMask GetNumaHighestNodeNumber ChangeTimerQueueTimer GetLogicalProcessorInformation GetThreadPriority SetThreadPriority SignalObjectAndWait LoadLibraryExW GetModuleHandleA FreeLibraryAndExitThread GetThreadTimes QueryDepthSList InterlockedFlushSList InterlockedPushEntrySList InterlockedPopEntrySList FindResourceExW RaiseException HeapReAlloc LockResource LoadLibraryA GetCurrentThread OutputDebugStringW GetLastError GetTickCount64 MultiByteToWideChar HeapSize InitializeCriticalSectionEx HeapFree SizeofResource HeapDestroy CreateDirectoryW ReleaseMutex

user32

RegisterClassW GetClassInfoW EndDialog SendMessageW CreateWindowExW DefWindowProcW RegisterPowerSettingNotification DestroyWindow SendMessageTimeoutW IsWindow GetMessageW TranslateMessage DispatchMessageW RegisterWindowMessageW FindWindowExW PostMessageW SetTimer KillTimer UnregisterClassW ChangeWindowMessageFilterEx PostThreadMessageW UnregisterPowerSettingNotification MsgWaitForMultipleObjectsEx PeekMessageW

oleaut32

GetErrorInfo VariantClear VariantInit SetErrorInfo SysStringLen SysFreeString SysAllocStringLen SysAllocString VariantChangeType

ole32

CoInitializeEx CoTaskMemFree CoUninitialize CoInitialize CreateBindCtx CoCreateFreeThreadedMarshaler OleRun

api-ms-win-power-setting-l1-1-0

PowerGetActiveScheme PowerSetActiveScheme PowerWriteACValueIndex PowerWriteDCValueIndex

powrprof

PowerReadACValueIndex PowerReadDCValueIndex PowerReadFriendlyName

wtsapi32

WTSUnRegisterSessionNotification WTSQueryUserToken WTSRegisterSessionNotification

shell32

ShellExecuteExW SHCreateDirectoryExW SHGetKnownFolderPath SHGetSpecialFolderPathW ShellExecuteW

shlwapi

PathFileExistsW SHDeleteKeyW PathRemoveFileSpecW ord219

userenv

CreateEnvironmentBlock DestroyEnvironmentBlock

propsys

InitPropVariantFromStringVector InitPropVariantFromCLSID

netapi32

NetUserEnum NetApiBufferFree

api-ms-win-core-registry-l1-1-0

RegCloseKey RegGetKeySecurity RegEnumValueW RegQueryValueExW RegQueryValueExA RegOpenKeyExA RegNotifyChangeKeyValue RegDeleteValueW RegOpenKeyExW RegSetKeySecurity RegCreateKeyExW RegEnumKeyExW RegSetValueExW

api-ms-win-security-base-l1-1-0

GetAce IsValidSid SetSecurityDescriptorOwner AllocateAndInitializeSid RevertToSelf GetTokenInformation AddAce InitializeAcl CreateWellKnownSid GetSecurityDescriptorDacl InitializeSecurityDescriptor AddAccessAllowedAceEx GetAclInformation GetLengthSid SetSecurityDescriptorDacl AdjustTokenPrivileges ImpersonateLoggedOnUser FreeSid

api-ms-win-security-sddl-l1-1-0

ConvertStringSecurityDescriptorToSecurityDescriptorW ConvertSidToStringSidW ConvertStringSidToSidW

api-ms-win-core-processthreads-l1-1-0

GetStartupInfoW OpenProcessToken TlsFree TlsSetValue TlsGetValue TlsAlloc SwitchToThread GetCurrentThreadId GetExitCodeThread CreateProcessAsUserW SetThreadToken OpenThreadToken

api-ms-win-core-registry-l2-1-0

RegDeleteKeyW

api-ms-win-security-lsalookup-l2-1-0

LookupAccountSidW LookupPrivilegeValueW

api-ms-win-security-cryptoapi-l1-1-0

CryptReleaseContext CryptAcquireContextW CryptDecrypt CryptDeriveKey CryptDestroyHash CryptHashData CryptDestroyKey CryptCreateHash

api-ms-win-core-com-l1-1-0

CoCreateInstance StringFromCLSID CLSIDFromString CoSetProxyBlanket PropVariantClear CLSIDFromProgID CoCreateGuid

api-ms-win-security-provider-l1-1-0

GetNamedSecurityInfoW SetNamedSecurityInfoW SetEntriesInAclW

api-ms-win-service-management-l1-1-0

OpenSCManagerW

api-ms-win-service-core-l1-1-0

RegisterServiceCtrlHandlerExW

api-ms-win-core-synch-l1-1-0

TryEnterCriticalSection WaitForSingleObjectEx InitializeCriticalSectionAndSpinCount

api-ms-win-core-profile-l1-1-0

QueryPerformanceFrequency QueryPerformanceCounter

api-ms-win-core-handle-l1-1-0

DuplicateHandle

api-ms-win-core-rtlsupport-l1-1-0

RtlLookupFunctionEntry RtlPcToFileHeader RtlCaptureContext RtlVirtualUnwind

api-ms-win-core-util-l1-1-0

EncodePointer

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent

api-ms-win-core-threadpool-legacy-l1-1-0

QueueUserWorkItem

api-ms-win-core-errorhandling-l1-1-0

SetLastError SetUnhandledExceptionFilter UnhandledExceptionFilter

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime GetTickCount

api-ms-win-core-string-l1-1-0

GetStringTypeW CompareStringW

api-ms-win-core-localization-l1-2-0

GetCPInfo GetLocaleInfoW LCMapStringW

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

rtworkq

RtwqPutWorkItem RtwqCreateAsyncResult

avrt

AvSetMmThreadCharacteristicsW AvRevertMmThreadCharacteristics

advapi32

ControlService QueryServiceStatusEx GetUserNameW OpenServiceW CloseServiceHandle StartServiceCtrlDispatcherW StartServiceW DeleteService ChangeServiceConfig2W SetServiceStatus QueryServiceStatus CreateServiceW

setupapi

SetupDiGetDeviceRegistryPropertyA SetupDiGetClassDevsW SetupDiGetDeviceRegistryPropertyW SetupDiGetDeviceInstanceIdW SetupDiGetDevicePropertyW SetupDiGetDeviceInterfaceDetailW SetupDiEnumDeviceInterfaces SetupDiEnumDeviceInfo SetupDiDestroyDeviceInfoList

ws2_32

WSASetLastError shutdown WSAStartup WSARecv WSAGetLastError WSASend WSACleanup

crypt32

CertFreeCertificateContext

api-ms-win-core-version-l1-1-0

VerQueryValueW

api-ms-win-core-version-l1-1-1

GetFileVersionInfoW

api-ms-win-devices-config-l1-1-1

CM_Get_Parent CM_Get_Device_IDW

api-ms-win-core-string-l2-1-0

CharUpperW

api-ms-win-core-namedpipe-l1-1-0

ImpersonateNamedPipeClient

cfgmgr32

CM_Get_DevNode_Status_Ex

api-ms-win-mm-misc-l1-1-0

mmioCreateChunk mmioClose mmioSeek mmioSetInfo mmioAscend mmioWrite mmioOpenW mmioGetInfo mmioDescend mmioAdvance

version

GetFileVersionInfoSizeW

Name

.text

Size

2.7MB

Virtual Size

2.7MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

RT_CODE

Size

405KB

Virtual Size

405KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.3MB

Virtual Size

1.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

78KB

Virtual Size

116KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

108KB

Virtual Size

108KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.didat

Size

512B

Virtual Size

280B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gxfg

Size

14KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.gehcont

Size

512B

Virtual Size

36B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

123KB

Virtual Size

122KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

584KB

Virtual Size

588KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-06-27_7593ec7d195848ee0caf807414c7120e_icedid_njrat_vidar

kernel32

user32

oleaut32

ole32

api-ms-win-power-setting-l1-1-0

powrprof

wtsapi32

shell32

shlwapi

userenv

propsys

netapi32

api-ms-win-core-registry-l1-1-0

api-ms-win-security-base-l1-1-0

api-ms-win-security-sddl-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-registry-l2-1-0

api-ms-win-security-lsalookup-l2-1-0

api-ms-win-security-cryptoapi-l1-1-0

api-ms-win-core-com-l1-1-0

api-ms-win-security-provider-l1-1-0

api-ms-win-service-management-l1-1-0

api-ms-win-service-core-l1-1-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-rtlsupport-l1-1-0

api-ms-win-core-util-l1-1-0

api-ms-win-core-processthreads-l1-1-1

api-ms-win-core-threadpool-legacy-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-interlocked-l1-1-0

rtworkq

avrt

advapi32

setupapi

ws2_32

crypt32

api-ms-win-core-version-l1-1-0

api-ms-win-core-version-l1-1-1

api-ms-win-devices-config-l1-1-1

api-ms-win-core-string-l2-1-0

api-ms-win-core-namedpipe-l1-1-0

cfgmgr32

api-ms-win-mm-misc-l1-1-0

version

generic