2026-07-09_0d7b289db7f6bcd915004df04ae1e305_amadey_hijackloader_icedid_njrat_ryuk_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-09_0d7b289db7f6bcd915004df04ae1e305_amadey_hijackloader_icedid_njrat_ryuk_vidar
Size 2.0MB
Sample260709-m5ff1ahs4k
SHA256 b1b3d37b09b029ee4ef542bcbcb2f1edabd151a8fbc75e502b9c610f96acfd95
MD5 0d7b289db7f6bcd915004df04ae1e305
SHA1 2737bc952839bfc5f5cac3a09881521f69184053
SHA512 67f4881ae1d52446b34ac419deeec9ac9f7a4f8c080a508fae292e14e53a645913db860dead7af031df7e22e78765abd1688f9267f86fd73ded092c18cccbde0
SSDEEP 24576:CnnzWj8PSeWygmNWZcb1pEKdUnHBt9GzauIZe0p4Ek4niOkl/A04szE87JKTvm:MuygmUSbHDUnU2ZeW4SkZP4sz9Mb
TLSH
T14E954A55B7B887B2E0B3D1B9C5E6A676FA7278421B3086CF0241C32E1E276D18D35736
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-09_0d7b289db7f6bcd915004df04ae1e305_amadey_hijackloader_icedid_njrat_ryuk_vidar

File Explorer

2026-07-09_0d7b289db7f6bcd915004df04ae1e305_amadey_hijackloader_icedid_njrat_ryuk_vidar

.exe 2.0MB

2026-07-09_0d7b289db7f6bcd915004df04ae1e305_amadey_hijackloader_icedid_njrat_ryuk_vidar

IMPHASH 4de88910f6e89625ec54b2440587d1b9
SHA256 b1b3d37b09b029ee4ef542bcbcb2f1edabd151a8fbc75e502b9c610f96acfd95
MD5 0d7b289db7f6bcd915004df04ae1e305
SHA1 2737bc952839bfc5f5cac3a09881521f69184053
SHA512 67f4881ae1d52446b34ac419deeec9ac9f7a4f8c080a508fae292e14e53a645913db860dead7af031df7e22e78765abd1688f9267f86fd73ded092c18cccbde0
SSDEEP 24576:CnnzWj8PSeWygmNWZcb1pEKdUnHBt9GzauIZe0p4Ek4niOkl/A04szE87JKTvm:MuygmUSbHDUnU2ZeW4SkZP4sz9Mb
TLSH
T14E954A55B7B887B2E0B3D1B9C5E6A676FA7278421B3086CF0241C32E1E276D18D35736
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

111464

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

P:\Target\x64\ship\outlook\x-none\cnfnot32.pdb

vcruntime140

__std_terminate __C_specific_handler memcpy memset memmove strchr _CxxThrowException wcschr wcsrchr __telemetry_main_invoke_trigger __telemetry_main_return_trigger __CxxFrameHandler3

api-ms-win-crt-heap-l1-1-0

_msize _expand _set_new_mode malloc free

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode __stdio_common_vsprintf __stdio_common_vswprintf

api-ms-win-crt-string-l1-1-0

isspace strncpy_s isdigit _strdup _stricmp _wcsicmp wcsncpy_s wcsncat_s

api-ms-win-crt-filesystem-l1-1-0

_makepath_s _splitpath_s

api-ms-win-crt-runtime-l1-1-0

_c_exit _register_thread_local_exe_atexit_callback exit _initterm_e _initterm _get_narrow_winmain_command_line _initialize_narrow_environment _configure_narrow_argv _set_app_type _initialize_onexit_table _seh_filter_exe _register_onexit_function _crt_atexit terminate _exit _cexit abort _set_new_handler

api-ms-win-crt-locale-l1-1-0

__initialize_lconv_for_unsigned_char _setmbcp _configthreadlocale

api-ms-win-crt-math-l1-1-0

__setusermatherr

ole32

GetClassFile OleCreateLinkToFile OleLoad OleSave OleSetContainedObject ReadClassStg StgIsStorageILockBytes StgOpenStorageOnILockBytes CoBuildVersion CoRevokeClassObject CoRegisterClassObject

kernel32

FormatMessageA GetSystemInfo VirtualQuery LoadLibraryExA GetTickCount64 OutputDebugStringW GetStartupInfoW IsDebuggerPresent InitializeSListHead IsProcessorFeaturePresent TerminateProcess GetCurrentProcess SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext FileTimeToLocalFileTime FileTimeToSystemTime GetDateFormatW GetTimeFormatW SetCurrentDirectoryW GetCurrentDirectoryW OutputDebugStringA GetLastError SetLastError GetSystemDirectoryW FreeLibrary GetModuleFileNameW GetModuleHandleW GetModuleHandleExW GetProcAddress LoadLibraryExW LoadLibraryW lstrcmpiA CreateActCtxW ActivateActCtx DeactivateActCtx FindActCtxSectionStringW QueryActCtxW MultiByteToWideChar SetCurrentDirectoryA GetCurrentDirectoryA CompareFileTime DeleteFileA GetFileAttributesA GetFileTime GetTempPathA CloseHandle GetSystemTime lstrlenA SystemTimeToFileTime IsBadReadPtr GetProfileStringA IsDBCSLeadByte GetSystemDefaultLCID GetCurrentThreadId lstrlenW GetACP WideCharToMultiByte RaiseException TlsGetValue TlsSetValue LocalAlloc LocalFree lstrcmpA TlsAlloc GetVersion GetVersionExA FindResourceA RaiseFailFastException EnterCriticalSection LeaveCriticalSection FreeResource LoadResource LockResource FindResourceW GlobalAddAtomA GetCurrentThread SizeofResource lstrcmpW InitializeCriticalSectionEx DeleteCriticalSection GetModuleHandleA GetCurrentProcessId GetProcessHeap QueryPerformanceCounter HeapSetInformation GetSystemTimeAsFileTime GetTickCount VirtualProtect WerRegisterMemoryBlock

advapi32

RegGetValueW RegOpenKeyExA RegQueryValueExA RegCloseKey

gdi32

SetBkColor GetStockObject ExtTextOutW TextOutW GetTextExtentPointW ScaleWindowExtEx ScaleViewportExtEx OffsetViewportOrgEx SetWindowExtEx SetViewportOrgEx SetViewportExtEx ExtTextOutA TextOutA SetTextColor CreateFontIndirectA SetMapMode SelectObject SaveDC RestoreDC RectVisible PtVisible GetClipBox Escape DeleteDC GetObjectW GetDeviceCaps DeleteObject CreateFontIndirectW PatBlt GetObjectA GetTextMetricsA

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-09_0d7b289db7f6bcd915004df04ae1e305_amadey_hijackloader_icedid_njrat_ryuk_vidar

vcruntime140

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-math-l1-1-0

ole32

kernel32

advapi32

gdi32

generic