2026-07-03_ed0d9a5373c3afd95b09237d0245e381_icedid_njrat_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-03_ed0d9a5373c3afd95b09237d0245e381_icedid_njrat_vidar
Size 1.3MB
Sample260703-yrdk2afv6s
SHA256 65e3dc07ef01b5e9cd66181262a22bc51ea81c8cb513098c172f44f5ec1bf8da
MD5 ed0d9a5373c3afd95b09237d0245e381
SHA1 e6efe614af94deabca41628268bf582493222354
SHA512 645a9b3ea3bbaebe8e459a360bfe8029c72d6eee36b5fb8d44e2dfe5754af55024fffb545a8bab397cef762f959f5d1319224276537e05804277d0585ad49070
SSDEEP 24576:TEgxVkhGJEk75NUiBR1NyBo4kx929bL3Hnx:TE8Vktk75OiBoB+kn3Hnx
TLSH
T13F55CF2937E501F5E177D23AC9A64656E9B278051B21D7CF03A403BA2F337A14E7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-03_ed0d9a5373c3afd95b09237d0245e381_icedid_njrat_vidar

File Explorer

2026-07-03_ed0d9a5373c3afd95b09237d0245e381_icedid_njrat_vidar

.exe 1.3MB

2026-07-03_ed0d9a5373c3afd95b09237d0245e381_icedid_njrat_vidar

IMPHASH db0dab94225fef23692c8e1575f38f1f
SHA256 65e3dc07ef01b5e9cd66181262a22bc51ea81c8cb513098c172f44f5ec1bf8da
MD5 ed0d9a5373c3afd95b09237d0245e381
SHA1 e6efe614af94deabca41628268bf582493222354
SHA512 645a9b3ea3bbaebe8e459a360bfe8029c72d6eee36b5fb8d44e2dfe5754af55024fffb545a8bab397cef762f959f5d1319224276537e05804277d0585ad49070
SSDEEP 24576:TEgxVkhGJEk75NUiBR1NyBo4kx929bL3Hnx:TE8Vktk75OiBoB+kn3Hnx
TLSH
T13F55CF2937E501F5E177D23AC9A64656E9B278051B21D7CF03A403BA2F337A14E7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

143556

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\SVN\BTDevManager_Merge\vs2017_BTDevManager\BTDevManager\bin\x64\Win10 Release\RtkBtManServ.pdb

api-ms-win-core-util-l1-1-0

DecodePointer EncodePointer

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-errorhandling-l1-1-0

SetLastError SetUnhandledExceptionFilter RaiseException UnhandledExceptionFilter GetLastError SetErrorMode

api-ms-win-core-heap-l1-1-0

HeapSize GetProcessHeap HeapReAlloc HeapDestroy HeapAlloc HeapFree

api-ms-win-core-synch-l1-1-0

DeleteCriticalSection OpenEventW InitializeCriticalSectionEx LeaveCriticalSection EnterCriticalSection InitializeCriticalSectionAndSpinCount InitializeCriticalSection SetEvent TryEnterCriticalSection CreateEventW CreateMutexW WaitForSingleObject ReleaseMutex TryAcquireSRWLockExclusive ResetEvent InitializeSRWLock ReleaseSRWLockExclusive AcquireSRWLockExclusive

api-ms-win-core-synch-l1-2-0

InitOnceExecuteOnce Sleep SleepConditionVariableCS WakeAllConditionVariable InitializeConditionVariable

api-ms-win-core-synch-l1-2-1

WaitForMultipleObjects

api-ms-win-core-processthreads-l1-1-0

ExitThread CreateThread TlsSetValue GetCurrentProcessId GetCurrentProcess GetStartupInfoW TlsGetValue TerminateProcess ResumeThread TlsAlloc GetCurrentThreadId GetExitCodeProcess ExitProcess OpenProcessToken SuspendThread GetCurrentThread CreateProcessAsUserW TlsFree

api-ms-win-core-libraryloader-l1-2-0

FreeLibraryAndExitThread GetModuleFileNameW LoadLibraryExW FindResourceExW GetProcAddress LoadResource GetModuleHandleW GetModuleHandleExW SizeofResource LockResource FreeLibrary

api-ms-win-core-libraryloader-l1-2-1

LoadLibraryW FindResourceW

api-ms-win-security-base-l1-1-0

DuplicateTokenEx InitializeSecurityDescriptor AdjustTokenPrivileges SetTokenInformation SetSecurityDescriptorDacl

api-ms-win-core-registry-l1-1-0

RegQueryValueExW RegEnumValueW RegSetValueExW RegQueryInfoKeyW RegDeleteValueW RegCloseKey RegOpenKeyExW RegNotifyChangeKeyValue RegCreateKeyExW

api-ms-win-devices-config-l1-1-1

CM_Locate_DevNodeW CM_Get_Device_Interface_PropertyW CM_Get_Device_Interface_List_SizeW CM_Get_Device_Interface_ListW CM_Get_DevNode_Status CM_Get_Device_ID_ListW CM_Get_Device_IDW CM_Get_Parent CM_Disable_DevNode CM_Enable_DevNode CM_MapCrToWin32Err CM_Unregister_Notification CM_Register_Notification CM_Get_Device_ID_List_SizeW

api-ms-win-core-file-l1-1-0

GetFileType SetFilePointerEx GetFileSize SetEndOfFile ReadFile CreateDirectoryW FindClose WriteFile FindFirstFileExW FindNextFileW DeleteFileW CreateFileW FlushFileBuffers

api-ms-win-core-file-l1-2-0

GetTempPathW

api-ms-win-core-debug-l1-1-0

OutputDebugStringW IsDebuggerPresent

api-ms-win-core-sysinfo-l1-1-0

GetLocalTime GetTickCount64 GetVersionExW GetSystemTimeAsFileTime GetSystemDirectoryW GetSystemInfo

api-ms-win-core-string-obsolete-l1-1-0

lstrlenW lstrcmpiW

api-ms-win-core-version-l1-1-1

GetFileVersionInfoSizeW GetFileVersionInfoW

api-ms-win-core-version-l1-1-0

VerQueryValueW

api-ms-win-service-management-l2-1-0

ChangeServiceConfig2W

api-ms-win-service-management-l1-1-0

DeleteService StartServiceW CloseServiceHandle OpenSCManagerW CreateServiceW OpenServiceW

api-ms-win-service-winsvc-l1-1-0

ControlService QueryServiceStatus

api-ms-win-service-core-l1-1-0

SetServiceStatus RegisterServiceCtrlHandlerExW StartServiceCtrlDispatcherW

ws2_32

WSACleanup WSAStartup

api-ms-win-shell-shdirectory-l1-1-0

ord290

ext-ms-win-shell32-shellfolders-l1-1-0

SHGetFolderPathW

api-ms-win-core-processthreads-l1-1-1

OpenProcess IsProcessorFeaturePresent

api-ms-win-core-kernel32-legacy-l1-1-0

WTSGetActiveConsoleSessionId

userenv

CreateEnvironmentBlock DestroyEnvironmentBlock

api-ms-win-core-toolhelp-l1-1-0

Process32FirstW CreateToolhelp32Snapshot Process32NextW

oleaut32

SysAllocStringLen

api-ms-win-core-heap-l2-1-0

GlobalAlloc LocalAlloc LocalFree GlobalFree

api-ms-win-core-processenvironment-l1-1-0

GetStdHandle ExpandEnvironmentStringsW GetEnvironmentStringsW FreeEnvironmentStringsW GetCommandLineA GetCommandLineW SetStdHandle SetEnvironmentVariableW

api-ms-win-core-memory-l1-1-0

ReadProcessMemory

api-ms-win-security-lsalookup-l2-1-0

LookupPrivilegeValueW

api-ms-win-core-io-l1-1-0

GetOverlappedResult DeviceIoControl

api-ms-win-core-namedpipe-l1-1-0

WaitNamedPipeW

api-ms-win-core-psapi-l1-1-0

K32GetModuleBaseNameW K32EnumProcesses K32EnumProcessModules

api-ms-win-core-heap-obsolete-l1-1-0

GlobalHandle GlobalLock GlobalUnlock

rpcrt4

RpcStringFreeW UuidToStringW

ext-ms-win-networking-wlanapi-l1-1-0

WlanQueryInterface WlanOpenHandle WlanFreeMemory WlanCloseHandle WlanEnumInterfaces

wlanapi

WlanIhvControl

shlwapi

PathRemoveFileSpecW

setupapi

SetupDiEnumDriverInfoW SetupDiGetDeviceInstallParamsW SetupDiDestroyDriverInfoList SetupDiCallClassInstaller SetupDiGetDeviceRegistryPropertyW SetupDiGetDriverInfoDetailW SetupDiSetDeviceInstallParamsW SetupDiSetClassInstallParamsW SetupDiEnumDeviceInterfaces SetupDiOpenDevRegKey SetupDiBuildDriverInfoList SetupDiGetClassDevsExW SetupDiGetClassDevsW SetupDiGetDeviceInterfaceDetailW SetupDiDestroyDeviceInfoList SetupDiEnumDeviceInfo

wtsapi32

WTSQueryUserToken

dbghelp

MiniDumpWriteDump

api-ms-win-core-profile-l1-1-0

QueryPerformanceFrequency QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-2-0

GetSystemTimePreciseAsFileTime

api-ms-win-core-localization-l1-2-0

GetLocaleInfoW LCMapStringW GetCPInfo FormatMessageW IsValidCodePage GetUserDefaultLCID GetOEMCP GetACP EnumSystemLocalesW IsValidLocale

api-ms-win-core-string-l1-1-0

GetStringTypeW WideCharToMultiByte MultiByteToWideChar CompareStringW

api-ms-win-core-rtlsupport-l1-1-0

RtlUnwindEx RtlUnwind RtlPcToFileHeader RtlCaptureContext RtlVirtualUnwind RtlLookupFunctionEntry

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead InterlockedPushEntrySList InterlockedFlushSList

api-ms-win-core-fibers-l1-1-0

FlsFree FlsSetValue FlsAlloc FlsGetValue

api-ms-win-core-datetime-l1-1-0

GetTimeFormatW GetDateFormatW

api-ms-win-core-console-l1-1-0

GetConsoleCP ReadConsoleW SetConsoleCtrlHandler GetConsoleMode WriteConsoleW

Name

.text

Size

526KB

Virtual Size

525KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

159KB

Virtual Size

158KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

18KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

27KB

Virtual Size

27KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

568KB

Virtual Size

572KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-03_ed0d9a5373c3afd95b09237d0245e381_icedid_njrat_vidar

api-ms-win-core-util-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-synch-l1-2-1

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-libraryloader-l1-2-1

api-ms-win-security-base-l1-1-0

api-ms-win-core-registry-l1-1-0

api-ms-win-devices-config-l1-1-1

api-ms-win-core-file-l1-1-0

api-ms-win-core-file-l1-2-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-string-obsolete-l1-1-0

api-ms-win-core-version-l1-1-1

api-ms-win-core-version-l1-1-0

api-ms-win-service-management-l2-1-0

api-ms-win-service-management-l1-1-0

api-ms-win-service-winsvc-l1-1-0

api-ms-win-service-core-l1-1-0

ws2_32

api-ms-win-shell-shdirectory-l1-1-0

ext-ms-win-shell32-shellfolders-l1-1-0

api-ms-win-core-processthreads-l1-1-1

api-ms-win-core-kernel32-legacy-l1-1-0

userenv

api-ms-win-core-toolhelp-l1-1-0

oleaut32

api-ms-win-core-heap-l2-1-0

api-ms-win-core-processenvironment-l1-1-0

api-ms-win-core-memory-l1-1-0

api-ms-win-security-lsalookup-l2-1-0

api-ms-win-core-io-l1-1-0

api-ms-win-core-namedpipe-l1-1-0

api-ms-win-core-psapi-l1-1-0

api-ms-win-core-heap-obsolete-l1-1-0

rpcrt4

ext-ms-win-networking-wlanapi-l1-1-0

wlanapi

shlwapi

setupapi

wtsapi32

dbghelp

api-ms-win-core-profile-l1-1-0

api-ms-win-core-sysinfo-l1-2-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-rtlsupport-l1-1-0

api-ms-win-core-interlocked-l1-1-0

api-ms-win-core-fibers-l1-1-0

api-ms-win-core-datetime-l1-1-0

api-ms-win-core-console-l1-1-0

generic