2026-07-06_c5ecd39017f027c8def5cffcccf191ce_icedid_njrat_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-06_c5ecd39017f027c8def5cffcccf191ce_icedid_njrat_vidar
Size 2.2MB
Sample260706-l52tkadt5v
SHA256 f191c508a09082775f06078813f779ca60c098695f10a610fece901cf2f07a88
MD5 c5ecd39017f027c8def5cffcccf191ce
SHA1 bffcd3d60cddce8f065d50c57ace17af7db837ec
SHA512 78c17ef8deda856ebf4bc3c08b01679813ea721b1896b97c4009010688cbc28ef5974caf8df29101962fab0ff88c88b789a76c68387b36fbd9a9cd31c6216311
SSDEEP 49152:yXq2F8ywfDrTJ5VE6DfyCR4eDS/EQDv66mG:j2k/2RTDv6V
TLSH
T183B5AE1ABA5C40E0C166C17CC991DA8BF2B17C144F75EBEF1A605A2E6F375E04E3A721
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-06_c5ecd39017f027c8def5cffcccf191ce_icedid_njrat_vidar

File Explorer

2026-07-06_c5ecd39017f027c8def5cffcccf191ce_icedid_njrat_vidar

.exe 2.2MB

2026-07-06_c5ecd39017f027c8def5cffcccf191ce_icedid_njrat_vidar

IMPHASH a27c9c011dd85fdb4f13890252d101a3
SHA256 f191c508a09082775f06078813f779ca60c098695f10a610fece901cf2f07a88
MD5 c5ecd39017f027c8def5cffcccf191ce
SHA1 bffcd3d60cddce8f065d50c57ace17af7db837ec
SHA512 78c17ef8deda856ebf4bc3c08b01679813ea721b1896b97c4009010688cbc28ef5974caf8df29101962fab0ff88c88b789a76c68387b36fbd9a9cd31c6216311
SSDEEP 49152:yXq2F8ywfDrTJ5VE6DfyCR4eDS/EQDv66mG:j2k/2RTDv6V
TLSH
T183B5AE1ABA5C40E0C166C17CC991DA8BF2B17C144F75EBEF1A605A2E6F375E04E3A721
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

625024

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\dvs\p4\build\sw\rel\gpu_drv\installer_core\installer_core_vs2017\Build\Core\Out\x64\Release\CoInstaller64.pdb

kernel32

DecodePointer RaiseException SetDefaultDllDirectories DebugBreak Sleep IsDebuggerPresent CreateEventW GetCommandLineW InitializeCriticalSectionEx DeleteCriticalSection SetLastError GetProcessHeap HeapAlloc HeapFree HeapReAlloc HeapSize HeapDestroy FindResourceExW FindResourceW LoadResource LockResource SizeofResource VerSetConditionMask VerifyVersionInfoW GetTempPathW GetCurrentProcessId WaitForSingleObject ReleaseMutex GetFileSizeEx WriteFile ExpandEnvironmentStringsW GetModuleFileNameW GetFileAttributesW RemoveDirectoryW CreateFileW CreateMutexW GetLastError GetCurrentThreadId WaitForSingleObjectEx SetEvent CreateEventA FormatMessageA FormatMessageW LocalFree WideCharToMultiByte CloseHandle OutputDebugStringW GetCurrentProcess GetProcessTimes WriteConsoleW ReadConsoleW SetStdHandle SetEnvironmentVariableA FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetOEMCP IsValidCodePage FindFirstFileExW ReadFile GetConsoleMode GetConsoleCP GetFileType EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetTimeFormatW GetDateFormatW GetTimeZoneInformation GetACP GetStdHandle ExitProcess RtlPcToFileHeader RtlUnwindEx CreateTimerQueue UnregisterWaitEx QueryDepthSList InterlockedFlushSList InterlockedPushEntrySList InterlockedPopEntrySList ReleaseSemaphore VirtualFree GetSystemTimeAsFileTime QueryPerformanceFrequency QueryPerformanceCounter VirtualProtect VirtualAlloc GetSystemInfo GetVersionExW LocalAlloc MultiByteToWideChar GetLocalTime DuplicateHandle TerminateProcess GetExitCodeProcess CreateProcessW GetProcessId OpenProcess GetTickCount GetCurrentDirectoryW CreateDirectoryW DeleteFileW FindClose FindFirstFileW FindNextFileW GetFileTime QueryDosDeviceW SetFileAttributesW DeviceIoControl EnterCriticalSection LeaveCriticalSection GetCurrentThread GetSystemDirectoryW GetWindowsDirectoryW GetSystemWindowsDirectoryW CreateFileMappingW MapViewOfFile UnmapViewOfFile CopyFileW CopyFileExW MoveFileExW FileTimeToSystemTime FreeLibrary GetModuleHandleExW GetProcAddress LoadLibraryW OpenEventW SystemTimeToFileTime GetFullPathNameW GetModuleFileNameA GetModuleHandleW LoadLibraryExW GetStringTypeW TryEnterCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree EncodePointer CompareStringW LCMapStringW GetLocaleInfoW GetCPInfo FlushFileBuffers GetFileInformationByHandle SetFilePointerEx AreFileApisANSI ResetEvent InitializeSListHead RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent GetStartupInfoW SignalObjectAndWait SwitchToThread CreateThread SetThreadPriority GetThreadPriority GetLogicalProcessorInformation CreateTimerQueueTimer ChangeTimerQueueTimer DeleteTimerQueueTimer GetNumaHighestNodeNumber GetProcessAffinityMask SetThreadAffinityMask RegisterWaitForSingleObject UnregisterWait GetThreadTimes FreeLibraryAndExitThread GetModuleHandleA

advapi32

EnumDependentServicesW RegOpenCurrentUser RegDeleteKeyW RegDeleteValueW RegEnumKeyExW RegQueryInfoKeyW RegSetValueExW OpenThreadToken AccessCheck DuplicateToken GetFileSecurityW MapGenericMask ChangeServiceConfig2W CloseServiceHandle ControlService RegQueryValueExW OpenSCManagerW OpenServiceW QueryServiceConfig2W QueryServiceStatusEx StartServiceW RegOpenKeyExW OpenProcessToken GetTokenInformation RegEnumValueW RegCreateKeyExW RegCloseKey LsaNtStatusToWinError

shell32

ShellExecuteExW SHGetFolderPathW

oleaut32

SysAllocStringLen SysStringLen VariantInit VariantClear VariantChangeType SafeArrayCreate SafeArrayDestroy SafeArrayGetUBound SafeArrayGetLBound SafeArrayLock SafeArrayUnlock SysFreeString

psapi

GetProcessImageFileNameW

shlwapi

PathFindFileNameW

rpcrt4

UuidToStringW RpcStringFreeW

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

setupapi

SetupDiDeleteDeviceInfo SetupDiGetDeviceInstanceIdW SetupGetStringFieldW SetupGetFieldCount SetupFindNextMatchLineW SetupDiCallClassInstaller SetupFindFirstLineW SetupOpenAppendInfFileW CM_Get_DevNode_Status SetupDiBuildDriverInfoList SetupCloseInfFile SetupDiGetDriverInfoDetailW SetupDiOpenDeviceInfoW SetupDiCreateDeviceInfoList CM_Get_Device_IDW SetupOpenInfFileW SetupDiGetClassDevsW SetupDiDestroyDeviceInfoList SetupDiOpenDevRegKey SetupDiGetDeviceRegistryPropertyW SetupDiSetDeviceRegistryPropertyW SetupDiEnumDeviceInfo SetupDiEnumDriverInfoW SetupDiGetDeviceInstallParamsW SetupDiGetClassInstallParamsW SetupDiSetDeviceInstallParamsW SetupDiSetClassInstallParamsW SetupDiSetSelectedDriverW SetupDiSetSelectedDevice SetupDiGetActualSectionToInstallExW CM_Get_Parent

userenv

UnloadUserProfile

Name

.text

Size

1.0MB

Virtual Size

1.0MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

423KB

Virtual Size

422KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

44KB

Virtual Size

53KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

50KB

Virtual Size

49KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

113KB

Virtual Size

113KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

576KB

Virtual Size

580KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-06_c5ecd39017f027c8def5cffcccf191ce_icedid_njrat_vidar

kernel32

advapi32

shell32

oleaut32

psapi

shlwapi

rpcrt4

version

setupapi

userenv

generic