2026-07-14_ddd524da6d369666de0826ab02e3a636_icedid_njrat_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-14_ddd524da6d369666de0826ab02e3a636_icedid_njrat_vidar
Size 1.1MB
Sample260714-lp2hvsas2n
SHA256 38c79c7730825d02d6a40e32c7e52cd0404af04af9a8a80f7e1fe1d00c155d07
MD5 ddd524da6d369666de0826ab02e3a636
SHA1 0c169afd478a9cfff29339ef776b9af96ecbdf6f
SHA512 d3f1821746a5762a1ad7232868c8fd04170e0da2c5c04fbe55bb10b05b683754ba26c9fac5dd83920a2fc6ee3cc50f235e9620f74c91e8f7752ccb717f5f12ef
SSDEEP 24576:mp7vuhws05pmWGv9qyOwTFqoBANTCwlGjkh0KaVjn:0uhws05pmWek8ANT/lGO0Nn
TLSH
T1A735F74AEBA981F1C4BAC1388972622AF8713895477497DB5B856B0B1F73BE0DD3D700
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

2026-07-14_ddd524da6d369666de0826ab02e3a636_icedid_njrat_vidar

.exe 1.1MB

2026-07-14_ddd524da6d369666de0826ab02e3a636_icedid_njrat_vidar

IMPHASH 44e05835c072eb6db3ae0de0d9df9bb7
SHA256 38c79c7730825d02d6a40e32c7e52cd0404af04af9a8a80f7e1fe1d00c155d07
MD5 ddd524da6d369666de0826ab02e3a636
SHA1 0c169afd478a9cfff29339ef776b9af96ecbdf6f
SHA512 d3f1821746a5762a1ad7232868c8fd04170e0da2c5c04fbe55bb10b05b683754ba26c9fac5dd83920a2fc6ee3cc50f235e9620f74c91e8f7752ccb717f5f12ef
SSDEEP 24576:mp7vuhws05pmWGv9qyOwTFqoBANTCwlGjkh0KaVjn:0uhws05pmWek8ANT/lGO0Nn
TLSH
T1A735F74AEBA981F1C4BAC1388972622AF8713895477497DB5B856B0B1F73BE0DD3D700
MD5 SHA1 SHA512 SSDEEP TLSH

Digest

a1:ac:bb:55:57:1f:39:c6:86:0d:3a:f4:63:02:e6:cb:a1:b8:67:ad:d8:7e:66:45:a2:52:75:22:3a:28:7b:6b

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=黄加贡,O=黄加贡,L=钦州,ST=广西,C=CN

Chains

Jul 10, 2026

CN=黄加贡,O=黄加贡,L=钦州,ST=广西,C=CN

CN=Certum Code Signing 2021 CA,O=Asseco Data Systems S.A.,C=PL

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Subject

CN=黄加贡,O=黄加贡,L=钦州,ST=广西,C=CN

Serial Number

6e:8a:4f:5e:34:58:01:49:d1:78:9e:4a:e8:a5:2b:bb

Issuer

CN=Certum Code Signing 2021 CA,O=Asseco Data Systems S.A.,C=PL

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 15, 2026 - May 15, 2027

Subject

CN=Certum Code Signing 2021 CA,O=Asseco Data Systems S.A.,C=PL

Serial Number

99:a3:80:0a:26:55:3b:65:ab:dc:6e:84:a6:b3:ea:39

Issuer

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 19, 2021 - May 18, 2036

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

592996

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

libcurlx64

curl_global_cleanup curl_multi_add_handle curl_easy_perform curl_easy_getinfo curl_global_init curl_multi_info_read curl_multi_wait curl_easy_init curl_slist_append curl_multi_cleanup curl_multi_remove_handle curl_multi_init curl_easy_strerror curl_multi_perform curl_easy_setopt curl_easy_cleanup curl_slist_free_all

kernel32

GetFileSize DeleteCriticalSection GetProcessHeap FreeLibrary WideCharToMultiByte lstrcpyW VirtualFree VirtualAlloc GetModuleHandleA LoadLibraryA GetVolumeInformationA OpenProcess GetCommandLineA MultiByteToWideChar CreateFileA FileTimeToSystemTime lstrcpyA FileTimeToLocalFileTime LocalFree GetCurrentProcessId GetLongPathNameA GetProcAddress GetFileTime SizeofResource SetLastError GetCommandLineW GetCurrentProcess GetModuleFileNameW CreateMutexA WaitForSingleObject OpenMutexA LockResource GlobalFree FindResourceExW LoadResource FindResourceW ExitProcess GetModuleHandleW lstrcmpiA lstrcmpiW LoadLibraryExW GetExitCodeThread TerminateThread GetLocalTime WTSGetActiveConsoleSessionId GetStdHandle GetModuleHandleExW QueryPerformanceFrequency RtlPcToFileHeader RtlUnwindEx QueueUserWorkItem GetSystemInfo OpenThread HeapDestroy DecodePointer HeapAlloc CreateThread LoadLibraryW RaiseException CloseHandle HeapReAlloc GetLastError Sleep HeapSize CreateFileW InitializeCriticalSection LeaveCriticalSection InitializeCriticalSectionAndSpinCount EnterCriticalSection HeapFree GetModuleFileNameA SetStdHandle WriteConsoleW SetEndOfFile GetACP GetFileType SetFilePointerEx GetConsoleMode VirtualQuery GetThreadTimes SuspendThread FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP IsValidCodePage FindNextFileW FindFirstFileExW VirtualQueryEx SetThreadContext VirtualFreeEx ReadConsoleW CreateRemoteThread ReadProcessMemory VirtualAllocEx GetThreadContext VirtualProtectEx WriteProcessMemory IsWow64Process CreateNamedPipeW ReadFile Thread32First Thread32Next FindClose EnumSystemLocalesW GetUserDefaultLCID IsValidLocale DeviceIoControl GetCurrentThread DuplicateHandle GetNativeSystemInfo GetConsoleCP FlushFileBuffers CreateEventW TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemTimeAsFileTime GetTickCount EncodePointer LCMapStringW GetLocaleInfoW GetStringTypeW GetCPInfo IsDebuggerPresent OutputDebugStringW SetEvent ResetEvent WaitForSingleObjectEx RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent GetStartupInfoW QueryPerformanceCounter GetCurrentThreadId InitializeSListHead Wow64DisableWow64FsRedirection Wow64RevertWow64FsRedirection ResumeThread CreateToolhelp32Snapshot GetFileAttributesW CreateActCtxW WriteFile GetTempPathW UnmapViewOfFile DeleteFileW GetTempFileNameW CreateFileMappingW ReleaseActCtx MapViewOfFile ActivateActCtx GetEnvironmentVariableW GetSystemDirectoryW DeactivateActCtx GetSystemWow64DirectoryW Module32FirstW GetCurrentDirectoryW GetWindowsDirectoryW

user32

wvsprintfA CharNextW wsprintfW CharLowerW wsprintfA MessageBoxW CharLowerA

advapi32

CreateServiceW CloseServiceHandle OpenSCManagerW SetServiceStatus ChangeServiceConfig2W RegQueryValueExA RegOpenKeyExA LookupPrivilegeValueW AdjustTokenPrivileges OpenProcessToken OpenThreadToken RegCreateKeyW RegOpenKeyW RegEnumValueW DeleteService RegisterServiceCtrlHandlerW ControlService StartServiceW CreateProcessAsUserW StartServiceCtrlDispatcherW OpenServiceW GetSecurityDescriptorSacl SetSecurityDescriptorDacl RegQueryInfoKeyW RegEnumKeyExW SetSecurityDescriptorSacl InitializeSecurityDescriptor RegOpenKeyExW ConvertStringSecurityDescriptorToSecurityDescriptorW RegCloseKey RegDeleteKeyW RegCreateKeyExW RegSetValueExW RegDeleteValueW RegQueryValueExW

shell32

CommandLineToArgvW

ole32

CoCreateInstance OleUninitialize OleInitialize CoInitializeEx CoTaskMemAlloc CoTaskMemFree CoTaskMemRealloc CoUninitialize CoInitialize CLSIDFromProgID

oleaut32

SysStringByteLen VariantClear VariantChangeType VariantCopy SysAllocStringByteLen SysAllocString SysFreeString VariantInit VarUI4FromStr

shlwapi

PathStripPathA PathFileExistsW PathFileExistsA PathAddBackslashA PathAddBackslashW PathRemoveFileSpecW SHDeleteKeyW PathRemoveFileSpecA

psapi

GetModuleFileNameExA

wininet

InternetCrackUrlA InternetCreateUrlA

ws2_32

gethostname inet_addr WSAStartup WSACleanup gethostbyname

version

GetFileVersionInfoSizeW VerQueryValueW GetFileVersionInfoW

wtsapi32

WTSQueryUserToken

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-14_ddd524da6d369666de0826ab02e3a636_icedid_njrat_vidar

libcurlx64

kernel32

user32

advapi32

shell32

ole32

oleaut32

shlwapi

psapi

wininet

ws2_32

version

wtsapi32

generic