2026-07-09_9d71e2c828da0e78bf548d97a27e6d2d_icedid_njrat_vidar

General

Target
2026-07-09_9d71e2c828da0e78bf548d97a27e6d2d_icedid_njrat_vidar
Size 1.3MB
Sample260709-2npexaav5q
SHA256 d8bec5474e07a929965691efeae00cca55b64086adb33d9bc5e08b957496ad0b
MD5 9d71e2c828da0e78bf548d97a27e6d2d
SHA1 0c78c2c733c9ead898e42a882b9f1e374e5429dd
SHA512 c0d9da853ea80bcc49aaa7854718949a4a780e8156316ec6d31194ccd3e6e170574c6e639c4a0eb088765ef464bd234c8a0e0ec2cd53510ea93a942e344891c3
SSDEEP 24576:8AJOrcws1e/9XfDFthM1T5rx5nXmp/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:8AQhDPhYT7hWLNiXicJFFRGNzj3
TLSH
T16B55AD2ABEA482F4D4BAD039C892662AF9F17456473097CB5291471F2F37BE09D3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-09_9d71e2c828da0e78bf548d97a27e6d2d_icedid_njrat_vidar

File Explorer

2026-07-09_9d71e2c828da0e78bf548d97a27e6d2d_icedid_njrat_vidar

.exe 1.3MB

2026-07-09_9d71e2c828da0e78bf548d97a27e6d2d_icedid_njrat_vidar

IMPHASH fa81b7de7eb4df00b88694f99cad79f2
SHA256 d8bec5474e07a929965691efeae00cca55b64086adb33d9bc5e08b957496ad0b
MD5 9d71e2c828da0e78bf548d97a27e6d2d
SHA1 0c78c2c733c9ead898e42a882b9f1e374e5429dd
SHA512 c0d9da853ea80bcc49aaa7854718949a4a780e8156316ec6d31194ccd3e6e170574c6e639c4a0eb088765ef464bd234c8a0e0ec2cd53510ea93a942e344891c3
SSDEEP 24576:8AJOrcws1e/9XfDFthM1T5rx5nXmp/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:8AQhDPhYT7hWLNiXicJFFRGNzj3
TLSH
T16B55AD2ABEA482F4D4BAD039C892662AF9F17456473097CB5291471F2F37BE09D3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

289072

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\cruser\workspace\CR-Windows-x64-Client-Builder\CRLogTransport\public\binary\Win\x64\Release\CRLogTransport.pdb

shlwapi

PathFileExistsW PathIsDirectoryW

wininet

InternetConnectW InternetCloseHandle InternetSetOptionW InternetCrackUrlW InternetReadFile HttpSendRequestW InternetOpenW InternetSetStatusCallbackW InternetQueryDataAvailable InternetQueryOptionW HttpOpenRequestW HttpQueryInfoW InternetSetOptionA

kernel32

GetACP MultiByteToWideChar WideCharToMultiByte CompareFileTime FindFirstFileW FindNextFileW FindClose CreateFileW FreeEnvironmentStringsW DeleteFileW CloseHandle GetProcAddress MoveFileExW FreeLibrary GetEnvironmentStringsW GetFileTime GetConsoleCP ReadFile GetModuleFileNameW HeapFree InitializeCriticalSectionEx HeapSize Sleep HeapReAlloc RaiseException HeapAlloc DecodePointer DeleteCriticalSection GetProcessHeap GetSystemTimeAsFileTime FlushFileBuffers GetFileSizeEx GetCommandLineW GetConsoleMode GetDateFormatW GetTimeFormatW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW ReadConsoleW SetStdHandle GetTimeZoneInformation FindFirstFileExW IsValidCodePage GetOEMCP SetEnvironmentVariableW WriteConsoleW GetLastError EnterCriticalSection GetCommandLineA WriteFile GetStdHandle GetModuleHandleExW FormatMessageW GetStringTypeW RtlUnwind LeaveCriticalSection SetLastError InitializeCriticalSectionAndSpinCount CreateEventW SwitchToThread TlsAlloc TlsGetValue TlsSetValue TlsFree GetModuleHandleW EncodePointer CompareStringW LCMapStringW GetLocaleInfoW GetCPInfo RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent SetEvent ResetEvent WaitForSingleObjectEx IsDebuggerPresent GetStartupInfoW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId InitializeSListHead FormatMessageA LocalFree SetEndOfFile SetFilePointerEx AreFileApisANSI OutputDebugStringW RtlUnwindEx RtlPcToFileHeader LoadLibraryExW GetFileType SetConsoleCtrlHandler ExitProcess

shell32

SHCreateDirectoryExW SHGetFolderPathW

Name

.text

Size

504KB

Virtual Size

504KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

190KB

Virtual Size

189KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

8KB

Virtual Size

1.0MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

30KB

Virtual Size

30KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

572KB

Virtual Size

576KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-09_9d71e2c828da0e78bf548d97a27e6d2d_icedid_njrat_vidar

shlwapi

wininet

kernel32

shell32

generic