2026-07-08_5e97a266d58d2f8075d68b5a8bd660e2_icedid_njrat_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-08_5e97a266d58d2f8075d68b5a8bd660e2_icedid_njrat_vidar
Size 3.0MB
Sample260708-e78xbsbw8l
SHA256 ca731fd7cb3a3b405ffc833da11b3c9d48b3eece5af9056c44a41078b52a31fb
MD5 5e97a266d58d2f8075d68b5a8bd660e2
SHA1 a06ad01e7248a90660fff3aef5037a2085504e72
SHA512 9bdd9c37f4b241349e53c438d7aa6b02c80f0f869647028258e75223acbb39372cf3cb8b6d7f40b28182c55823600134f74feb3aadde73ca6a1c90806b697313
SSDEEP 49152:Khv90KQvtcqDsDT8sXbR7yckopz/rFTX/UGE0Z8YuTH+C097rQOUwq:IZQvtc585cjrUGXZ8Yl93Awq
TLSH
T12EE56B1A6A6842B8D177C07CCAC78E46E5B23C050B314BDF0A916B7E1F37AD55E3A721
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-08_5e97a266d58d2f8075d68b5a8bd660e2_icedid_njrat_vidar

File Explorer

2026-07-08_5e97a266d58d2f8075d68b5a8bd660e2_icedid_njrat_vidar

.exe 3.0MB

2026-07-08_5e97a266d58d2f8075d68b5a8bd660e2_icedid_njrat_vidar

IMPHASH 89fc557f925f579f70988c400eee5dbf
SHA256 ca731fd7cb3a3b405ffc833da11b3c9d48b3eece5af9056c44a41078b52a31fb
MD5 5e97a266d58d2f8075d68b5a8bd660e2
SHA1 a06ad01e7248a90660fff3aef5037a2085504e72
SHA512 9bdd9c37f4b241349e53c438d7aa6b02c80f0f869647028258e75223acbb39372cf3cb8b6d7f40b28182c55823600134f74feb3aadde73ca6a1c90806b697313
SSDEEP 49152:Khv90KQvtcqDsDT8sXbR7yckopz/rFTX/UGE0Z8YuTH+C097rQOUwq:IZQvtc585cjrUGXZ8Yl93Awq
TLSH
T12EE56B1A6A6842B8D177C07CCAC78E46E5B23C050B314BDF0A916B7E1F37AD55E3A721
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1626284

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\jenkins\workspace\pc-2345mpcsafe-build\RhinoProtect\Publish\OutPut\bin\Win32\release\pdb\2345SFGuard64.pdb

version

VerQueryValueW GetFileVersionInfoW GetFileVersionInfoSizeW

kernel32

lstrcmpiW LoadLibraryExW GetModuleFileNameW GetModuleHandleW FindResourceW IsBadStringPtrW MultiByteToWideChar VirtualAllocEx VirtualFreeEx OpenProcess CreateRemoteThread WriteProcessMemory SetEvent ResetEvent WaitForSingleObject OpenMutexW CreateEventW LoadLibraryA QueryDosDeviceW GetEnvironmentVariableW GetLogicalDriveStringsW VirtualQuery WriteFile CreateFileW GetModuleHandleExW CreateMutexW ReleaseMutex SizeofResource HeapAlloc LocalFree GetProcessHeap CreateDirectoryW GetWindowsDirectoryW ReadFile SetFilePointer SetEndOfFile Sleep DeleteFileW GetFileSize GetTickCount SetLastError lstrlenW GetPrivateProfileStringW LoadLibraryW GlobalMemoryStatusEx ExpandEnvironmentStringsW GetVersionExW GetCurrentProcess GetFileAttributesW WriteConsoleW SetStdHandle WaitForSingleObjectEx OutputDebugStringA SetEnvironmentVariableW SetEnvironmentVariableA FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW LoadResource WaitForMultipleObjects LeaveCriticalSection EnterCriticalSection GetCurrentThreadId GetProcAddress FreeLibrary CloseHandle DeleteCriticalSection InitializeCriticalSectionAndSpinCount SetErrorMode GetLastError RaiseException DecodePointer GetCurrentProcessId GetShortPathNameW GetCommandLineA GetOEMCP IsValidCodePage FindNextFileA FindFirstFileExW FindFirstFileExA GetTimeZoneInformation FlushFileBuffers EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetTimeFormatW GetDateFormatW SearchPathW LockResource GetSystemInfo ResumeThread OpenEventW OpenFileMappingW UnmapViewOfFile CreateFileMappingW MapViewOfFile GetACP WideCharToMultiByte GetVolumeInformationW GetDiskFreeSpaceW GetDriveTypeW FindFirstFileW GetLongPathNameW RtlUnwind GetFileAttributesExW TryEnterCriticalSection InitializeCriticalSection FindNextFileW FindClose LocalFileTimeToFileTime FileTimeToSystemTime FileTimeToLocalFileTime SystemTimeToFileTime GetSystemTime DosDateTimeToFileTime FileTimeToDosDateTime HeapFree GetComputerNameExW GlobalAlloc GlobalFree SetFileTime GetFileTime GetFullPathNameW RemoveDirectoryW GetTempPathW GetSystemDirectoryW SetFileAttributesW GetCurrentDirectoryW SetCurrentDirectoryW MoveFileExW CopyFileW GetTempFileNameW MoveFileW DeviceIoControl lstrcatW lstrcpyW GetFileSizeEx CreateProcessW GetExitCodeProcess FormatMessageW SwitchToThread TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemTimeAsFileTime EncodePointer GetStringTypeW CompareStringW LCMapStringW GetLocaleInfoW GetCPInfo IsDebuggerPresent OutputDebugStringW GetLocalTime RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent GetStartupInfoW QueryPerformanceCounter InitializeSListHead VirtualQueryEx CreateThread GetProcessId OpenThread TerminateThread GetThreadContext SuspendThread ReleaseSemaphore CreateSemaphoreW DuplicateHandle SetNamedPipeHandleState TransactNamedPipe WaitNamedPipeW GetStdHandle GetFileType RtlUnwindEx RtlPcToFileHeader InterlockedPushEntrySList InterlockedFlushSList ExitThread FreeLibraryAndExitThread ExitProcess GetModuleFileNameA SetConsoleCtrlHandler GetCurrentThread HeapSize HeapReAlloc SetFilePointerEx GetConsoleMode ReadConsoleW GetConsoleCP

user32

GetProcessWindowStation MessageBoxW GetUserObjectInformationW UnregisterClassW GetMessageW CharNextW PostThreadMessageW PeekMessageW DispatchMessageW TranslateMessage

advapi32

SetSecurityDescriptorDacl ReportEventW RegisterEventSourceW DeregisterEventSource AllocateAndInitializeSid FreeSid InitializeSecurityDescriptor InitializeAcl GetLengthSid AddAccessAllowedAce RegSetValueExW RegQueryInfoKeyW RegOpenKeyExW RegEnumKeyExW RegDeleteValueW RegDeleteKeyW RegCreateKeyExW RegCloseKey

shell32

SHGetFolderPathW SHGetSpecialFolderPathW

ole32

CoTaskMemRealloc CoTaskMemAlloc CoCreateInstance CoTaskMemFree

oleaut32

SysFreeString VarUI4FromStr

shlwapi

PathFileExistsW

generic

count=10, id=241, version=40116,

count=166, id=243, version=40116,

count=26, id=242, version=40116,

count=2, productName=Unmarked objects (old),

count=3, id=260, productName=VS2017 v15.9.5 build 27026, version=27026,

count=3, id=261, version=27035,

count=9, id=259, version=26706,

count=9, id=260, version=27035,

count=73, id=261, version=26706,

count=35, id=260, version=26706,

count=3, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=2, id=135, version=30729,

count=17, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=236, id=1, productName=Unmarked objects,

count=119, id=265, version=27054,

count=3, id=261, version=27054,

count=1, id=255, version=27054,

count=1, id=151,

count=1, id=258, version=27054,