2026-07-06_ae6843f11153631aac2ce260906d054e_icedid_njrat_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-06_ae6843f11153631aac2ce260906d054e_icedid_njrat_vidar
Size 1.2MB
Sample260706-y5rd2sdt3x
SHA256 9f4d48bd662a349f51c61c7c90f1f2e3b9cce5c7672ed81f6a264239d6f8c2ce
MD5 ae6843f11153631aac2ce260906d054e
SHA1 b4697f4d04fb29355318803ebeb0972eadb91267
SHA512 1804d193bd034ce326fd07c7b8b822c1ccf343a9e4ba484331dd7e1920615a92827ce2447628d50542bbbd544ed903f5a4a952ded3305d8f66eff1050322eadf
SSDEEP 24576:kGfVoado6wmiiNW0v8UQbT/n1Vdq/+171JSRvNyBo4kx929bL3Hnx:kGfOaC6wmrw0v8UQbT/n1VM/+171JSOl
TLSH
T1D545DF56B7E400F5E9BBD1749EAB5122F97274081B24AFEB4370489A1F32BE14B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-06_ae6843f11153631aac2ce260906d054e_icedid_njrat_vidar

File Explorer

2026-07-06_ae6843f11153631aac2ce260906d054e_icedid_njrat_vidar

.exe 1.2MB

2026-07-06_ae6843f11153631aac2ce260906d054e_icedid_njrat_vidar

IMPHASH fb7c45a8bc1b6a88a8ba37af06eb0c1f
SHA256 9f4d48bd662a349f51c61c7c90f1f2e3b9cce5c7672ed81f6a264239d6f8c2ce
MD5 ae6843f11153631aac2ce260906d054e
SHA1 b4697f4d04fb29355318803ebeb0972eadb91267
SHA512 1804d193bd034ce326fd07c7b8b822c1ccf343a9e4ba484331dd7e1920615a92827ce2447628d50542bbbd544ed903f5a4a952ded3305d8f66eff1050322eadf
SSDEEP 24576:kGfVoado6wmiiNW0v8UQbT/n1Vdq/+171JSRvNyBo4kx929bL3Hnx:kGfOaC6wmrw0v8UQbT/n1VM/+171JSOl
TLSH
T1D545DF56B7E400F5E9BBD1749EAB5122F97274081B24AFEB4370489A1F32BE14B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

354664

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\Recent\ATKRelation\Universal\AsLdrSrv\x64\Release_MyASUS\AsusOptimization.pdb

rpcrt4

NdrServerCallAll RpcServerUseProtseqEpW RpcServerRegisterIf3 NdrClientCall3 NdrServerCall2 RpcServerInqBindings RpcEpRegisterW RpcServerListen RpcServerUnregisterIf RpcServerInqCallAttributesW RpcBindingVectorFree RpcEpUnregister

api-ms-win-core-synch-l1-1-0

InitializeCriticalSection ReleaseMutex InitializeCriticalSectionAndSpinCount CreateMutexW OpenEventW DeleteCriticalSection CreateEventW SetEvent WaitForSingleObject LeaveCriticalSection EnterCriticalSection OpenMutexW InitializeCriticalSectionEx ResetEvent

api-ms-win-service-core-l1-1-0

StartServiceCtrlDispatcherW SetServiceStatus RegisterServiceCtrlHandlerExW

api-ms-win-core-processthreads-l1-1-0

OpenProcessToken TlsAlloc SuspendThread TlsGetValue CreateProcessAsUserW GetExitCodeProcess CreateProcessW CreateThread GetCurrentProcess ExitProcess GetStartupInfoW GetCurrentProcessId TerminateProcess GetCurrentThreadId TlsSetValue ResumeThread TlsFree

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-errorhandling-l1-1-0

SetUnhandledExceptionFilter SetLastError GetLastError UnhandledExceptionFilter RaiseException

api-ms-win-core-com-l1-1-0

IIDFromString CoInitializeEx CoCreateInstance CoTaskMemFree PropVariantClear StringFromGUID2 CLSIDFromString CoUninitialize

api-ms-win-core-synch-l1-2-1

WaitForMultipleObjects

api-ms-win-core-io-l1-1-0

DeviceIoControl

api-ms-win-core-file-l1-1-0

ReadFile SetFilePointerEx CreateFileW GetFileTime FlushFileBuffers FindClose FindFirstFileExW SetEndOfFile CompareFileTime FindNextFileW GetFileType SetFilePointer GetFileSize CreateDirectoryW FindFirstFileW DeleteFileW WriteFile GetFileAttributesExW

api-ms-win-core-sysinfo-l1-1-0

GlobalMemoryStatusEx GetSystemTime GetWindowsDirectoryW GetTickCount64 GetSystemInfo GetVersionExW GetSystemTimeAsFileTime GetSystemDirectoryW

api-ms-win-core-kernel32-legacy-l1-1-0

GetSystemPowerStatus

api-ms-win-core-registry-l1-1-0

RegCreateKeyExW RegSetValueExW RegDeleteValueW RegQueryValueExW RegCloseKey RegEnumKeyExW RegNotifyChangeKeyValue RegOpenKeyExW

api-ms-win-core-privateprofile-l1-1-0

WritePrivateProfileStringW GetPrivateProfileIntW GetPrivateProfileStringW

api-ms-win-core-path-l1-1-0

PathCchRemoveFileSpec

api-ms-win-shell-shdirectory-l1-1-0

ord290

api-ms-win-core-timezone-l1-1-0

FileTimeToSystemTime SystemTimeToFileTime

api-ms-win-devices-config-l1-1-1

CM_Register_Notification CM_Unregister_Notification CM_Get_Device_Interface_ListW CM_Get_Device_Interface_PropertyW CM_Get_DevNode_PropertyW CM_Get_Device_ID_List_SizeW CM_Locate_DevNodeW CM_Get_Device_Interface_List_SizeW CM_Get_Device_ID_ListW CM_Get_Parent

api-ms-win-core-file-l1-2-0

CreateFile2

api-ms-win-core-libraryloader-l1-2-0

FreeResource LoadResource FreeLibrary LoadLibraryExW GetModuleHandleExW GetModuleHandleW GetProcAddress GetModuleFileNameW LoadLibraryExA LockResource

api-ms-win-core-sysinfo-l1-2-1

GetPhysicallyInstalledSystemMemory

api-ms-win-core-heap-l1-1-0

HeapFree HeapSize GetProcessHeap HeapReAlloc HeapAlloc

hid

HidD_GetPreparsedData HidP_GetCaps HidD_SetFeature HidD_GetFeature HidD_FreePreparsedData HidD_GetAttributes HidD_GetHidGuid

api-ms-win-security-base-l1-1-0

AllocateAndInitializeSid AddAccessAllowedAce IsValidSecurityDescriptor AdjustTokenPrivileges SetSecurityDescriptorDacl InitializeSecurityDescriptor FreeSid AddAce InitializeAcl GetLengthSid DuplicateTokenEx SetFileSecurityW SetTokenInformation

propsys

InitPropVariantFromCLSID

api-ms-win-core-namedpipe-l1-1-0

DisconnectNamedPipe WaitNamedPipeW ConnectNamedPipe CreateNamedPipeW

api-ms-win-core-libraryloader-l1-2-1

FindResourceW LoadLibraryW

api-ms-win-oobe-notification-l1-1-0

OOBEComplete RegisterWaitUntilOOBECompleted UnregisterWaitUntilOOBECompleted

api-ms-win-core-heap-l2-1-0

LocalFree LocalAlloc

api-ms-win-ntuser-sysparams-l1-1-0

GetSystemMetrics

powrprof

PowerDeterminePlatformRole PowerReadDCValueIndex SetSuspendState

api-ms-win-core-sysinfo-l1-2-0

GetSystemFirmwareTable GetProductInfo

api-ms-win-power-setting-l1-1-0

PowerWriteDCValueIndex PowerSettingRegisterNotification PowerSetActiveScheme PowerWriteACValueIndex PowerSettingUnregisterNotification PowerGetActiveScheme

api-ms-win-core-toolhelp-l1-1-0

CreateToolhelp32Snapshot Process32NextW Process32FirstW

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent OpenProcess

api-ms-win-core-string-l1-1-0

WideCharToMultiByte GetStringTypeW MultiByteToWideChar

ext-ms-win-networking-wlanapi-l1-1-0

WlanCloseHandle WlanOpenHandle WlanFreeMemory WlanEnumInterfaces

api-ms-win-service-management-l1-1-0

DeleteService StartServiceW OpenServiceW CloseServiceHandle OpenSCManagerW

api-ms-win-power-base-l1-1-0

GetPwrCapabilities

api-ms-win-security-lsalookup-l2-1-0

LookupPrivilegeValueW

api-ms-win-core-shutdown-l1-1-0

InitiateSystemShutdownExW

api-ms-win-shcore-registry-l1-1-0

SHDeleteKeyW

api-ms-win-security-base-l1-2-2

DeriveCapabilitySidsFromName

api-ms-win-security-provider-l1-1-0

SetEntriesInAclW

api-ms-win-service-winsvc-l1-1-0

ControlService

api-ms-win-service-management-l2-1-0

ChangeServiceConfig2W ChangeServiceConfigW QueryServiceStatusEx

userenv

DestroyEnvironmentBlock CreateEnvironmentBlock

ext-ms-win-shell32-shellfolders-l1-1-0

SHGetKnownFolderPath

api-ms-win-core-version-l1-1-0

VerQueryValueW

api-ms-win-core-psapi-l1-1-0

K32GetModuleFileNameExW

api-ms-win-core-firmware-l1-1-0

SetFirmwareEnvironmentVariableExW GetFirmwareEnvironmentVariableW

oleaut32

SysFreeString

api-ms-win-eventing-classicprovider-l1-1-0

GetTraceEnableLevel GetTraceLoggerHandle TraceMessage GetTraceEnableFlags RegisterTraceGuidsW UnregisterTraceGuids

cfgmgr32

CM_Reenumerate_DevNode_Ex

api-ms-win-core-memory-l1-1-0

VirtualQuery VirtualProtect

api-ms-win-core-rtlsupport-l1-1-0

RtlVirtualUnwind RtlPcToFileHeader RtlLookupFunctionEntry RtlCaptureContext RtlUnwindEx

api-ms-win-core-debug-l1-1-0

IsDebuggerPresent

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

api-ms-win-core-fibers-l1-1-0

FlsFree FlsAlloc FlsSetValue FlsGetValue

api-ms-win-core-util-l1-1-0

EncodePointer

api-ms-win-core-processenvironment-l1-1-0

FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA SetStdHandle GetStdHandle GetCommandLineW

api-ms-win-core-localization-l1-2-0

LCMapStringW GetACP GetCPInfo GetOEMCP IsValidCodePage

api-ms-win-core-console-l1-1-0

WriteConsoleW GetConsoleMode GetConsoleCP

Name

.text

Size

445KB

Virtual Size

445KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

134KB

Virtual Size

134KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

22KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

24KB

Virtual Size

23KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

8KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

568KB

Virtual Size

572KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-06_ae6843f11153631aac2ce260906d054e_icedid_njrat_vidar

rpcrt4

api-ms-win-core-synch-l1-1-0

api-ms-win-service-core-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-com-l1-1-0

api-ms-win-core-synch-l1-2-1

api-ms-win-core-io-l1-1-0

api-ms-win-core-file-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-kernel32-legacy-l1-1-0

api-ms-win-core-registry-l1-1-0

api-ms-win-core-privateprofile-l1-1-0

api-ms-win-core-path-l1-1-0

api-ms-win-shell-shdirectory-l1-1-0

api-ms-win-core-timezone-l1-1-0

api-ms-win-devices-config-l1-1-1

api-ms-win-core-file-l1-2-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-sysinfo-l1-2-1

api-ms-win-core-heap-l1-1-0

hid

api-ms-win-security-base-l1-1-0

propsys

api-ms-win-core-namedpipe-l1-1-0

api-ms-win-core-libraryloader-l1-2-1

api-ms-win-oobe-notification-l1-1-0

api-ms-win-core-heap-l2-1-0

api-ms-win-ntuser-sysparams-l1-1-0

powrprof

api-ms-win-core-sysinfo-l1-2-0

api-ms-win-power-setting-l1-1-0

api-ms-win-core-toolhelp-l1-1-0

api-ms-win-core-processthreads-l1-1-1

api-ms-win-core-string-l1-1-0

ext-ms-win-networking-wlanapi-l1-1-0

api-ms-win-service-management-l1-1-0

api-ms-win-power-base-l1-1-0

api-ms-win-security-lsalookup-l2-1-0

api-ms-win-core-shutdown-l1-1-0

api-ms-win-shcore-registry-l1-1-0

api-ms-win-security-base-l1-2-2

api-ms-win-security-provider-l1-1-0

api-ms-win-service-winsvc-l1-1-0

api-ms-win-service-management-l2-1-0

userenv

ext-ms-win-shell32-shellfolders-l1-1-0

api-ms-win-core-version-l1-1-0

api-ms-win-core-psapi-l1-1-0

api-ms-win-core-firmware-l1-1-0

oleaut32

api-ms-win-eventing-classicprovider-l1-1-0

cfgmgr32

api-ms-win-core-memory-l1-1-0

api-ms-win-core-rtlsupport-l1-1-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-interlocked-l1-1-0

api-ms-win-core-fibers-l1-1-0

api-ms-win-core-util-l1-1-0

api-ms-win-core-processenvironment-l1-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-console-l1-1-0

generic