2026-07-10_63cc4c237256eb17c7fc8956f803da9f_icedid_njrat_stealc_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-10_63cc4c237256eb17c7fc8956f803da9f_icedid_njrat_stealc_vidar
Size 1.4MB
Sample260710-mf4sasaw21
SHA256 a028391795fb0ce64cdb0f73111c7770e7165afb22fdaa9cf3e8acaefa26011a
MD5 63cc4c237256eb17c7fc8956f803da9f
SHA1 c8b18efee56ff17c35ba6956333c8bc7a9b3e20b
SHA512 9ca95355bf2e1c5bca756d72bdc362c5ceec71b941ebec7f8f5e75b71430bdb391af7a2425c96b2720086fa4214e6d58853504b2f0211a363968bdba6b956036
SSDEEP 24576:n5VYYjxJXjTfQEFa4Tusf+BQ2kQmlbBW8sRPEbyJlTaN8D1o:n5VYaj0EFNTjWBQPFBURPcyJpaNIK
TLSH
T198659D45AE9BC9E9C17BA13F84454947F2BEF602076383DB47410A3A7F671934D3A3A2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-10_63cc4c237256eb17c7fc8956f803da9f_icedid_njrat_stealc_vidar

File Explorer

2026-07-10_63cc4c237256eb17c7fc8956f803da9f_icedid_njrat_stealc_vidar

.exe 1.4MB

2026-07-10_63cc4c237256eb17c7fc8956f803da9f_icedid_njrat_stealc_vidar

IMPHASH 70e997002ea0846b531533e07c8316a3
SHA256 a028391795fb0ce64cdb0f73111c7770e7165afb22fdaa9cf3e8acaefa26011a
MD5 63cc4c237256eb17c7fc8956f803da9f
SHA1 c8b18efee56ff17c35ba6956333c8bc7a9b3e20b
SHA512 9ca95355bf2e1c5bca756d72bdc362c5ceec71b941ebec7f8f5e75b71430bdb391af7a2425c96b2720086fa4214e6d58853504b2f0211a363968bdba6b956036
SSDEEP 24576:n5VYYjxJXjTfQEFa4Tusf+BQ2kQmlbBW8sRPEbyJlTaN8D1o:n5VYaj0EFNTjWBQPFBURPcyJpaNIK
TLSH
T198659D45AE9BC9E9C17BA13F84454947F2BEF602076383DB47410A3A7F671934D3A3A2
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

183888

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\dvs\p4\build\sw\rel\gfclient\rel_03_23\backend\build\bin\x64\Release\NvProfileUpdater64.pdb

kernel32

InitializeCriticalSection EnterCriticalSection LeaveCriticalSection WaitForSingleObject Sleep GetExitCodeProcess CreateDirectoryW LoadLibraryExW VerifyVersionInfoW FreeLibrary GetModuleHandleW CreateProcessW VerSetConditionMask LocalFree GetProcAddress CloseHandle FileTimeToSystemTime OutputDebugStringW GetLastError GetSystemDirectoryW lstrcmpA GetFileAttributesW CreateFileW LocalAlloc GetModuleFileNameW GetFullPathNameW DeleteCriticalSection SetLastError MultiByteToWideChar WideCharToMultiByte SetEnvironmentVariableW DeleteFileW GetFileAttributesExW RemoveDirectoryW GetCurrentProcess GetModuleHandleExW GetFileInformationByHandle ReadFile SetEndOfFile SetFilePointerEx WriteFile FindClose FindFirstFileW FindNextFileW GetSystemTimeAsFileTime GetTickCount GetVersionExW GetNativeSystemInfo FormatMessageW SetEvent ResetEvent CreateEventW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent InitializeCriticalSectionAndSpinCount WaitForSingleObjectEx IsDebuggerPresent GetStartupInfoW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId InitializeSListHead FindFirstFileExW AreFileApisANSI MoveFileExW GetStringTypeW SwitchToThread TryEnterCriticalSection TlsAlloc TlsGetValue TlsSetValue TlsFree EncodePointer DecodePointer CompareStringW LCMapStringW GetLocaleInfoW GetCPInfo RtlUnwindEx RtlPcToFileHeader RaiseException InterlockedPushEntrySList InterlockedFlushSList GetStdHandle ExitProcess CreateThread FreeLibraryAndExitThread GetCurrentThread HeapAlloc HeapFree GetFileType FlushFileBuffers GetConsoleCP GetConsoleMode GetDateFormatW GetTimeFormatW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetFileSizeEx ReadConsoleW GetTimeZoneInformation HeapReAlloc IsValidCodePage GetACP GetOEMCP GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle GetProcessHeap HeapSize WriteConsoleW CreateTimerQueue SignalObjectAndWait SetThreadPriority GetThreadPriority GetLogicalProcessorInformation CreateTimerQueueTimer ChangeTimerQueueTimer DeleteTimerQueueTimer GetNumaHighestNodeNumber GetProcessAffinityMask SetThreadAffinityMask RegisterWaitForSingleObject UnregisterWait GetThreadTimes GetModuleHandleA VirtualAlloc VirtualProtect VirtualFree DuplicateHandle ReleaseSemaphore InterlockedPopEntrySList QueryDepthSList UnregisterWaitEx LoadLibraryW RtlUnwind

winhttp

WinHttpQueryDataAvailable WinHttpReceiveResponse WinHttpQueryHeaders WinHttpSetOption WinHttpOpen WinHttpCrackUrl WinHttpSetStatusCallback WinHttpQueryOption WinHttpOpenRequest WinHttpAddRequestHeaders WinHttpCloseHandle WinHttpSendRequest WinHttpConnect WinHttpReadData

ws2_32

InetNtopW ntohl

advapi32

RegCloseKey RegOpenKeyExW RegQueryValueExW CryptAcquireContextW CryptReleaseContext CryptGetHashParam CryptCreateHash CryptHashData CryptDestroyHash

shell32

SHGetFolderPathW

Name

.text

Size

491KB

Virtual Size

491KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

205KB

Virtual Size

204KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

13KB

Virtual Size

38KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

27KB

Virtual Size

26KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

148B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

134KB

Virtual Size

133KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

572KB

Virtual Size

576KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-10_63cc4c237256eb17c7fc8956f803da9f_icedid_njrat_stealc_vidar

kernel32

winhttp

ws2_32

advapi32

shell32

generic