General
- Target 2026-07-18_fd23da463831a5df960aaae82fc1c335_agent-tesla_amadey_icedid_njrat_vidar
- Size 36.0MB
- Sample260718-l18rbafw9j
- SHA256 4bdb55414bc2dcf781f2df9c286fb304949b698ed1b497c2dd3669d26a59f914
- MD5 fd23da463831a5df960aaae82fc1c335
- SHA1 1132ba00db94595b080416b77f4ba0dd5efb0639
- SHA512 fb255ca2b47a7f0525bff56d2eab10e1530b5d26d508f47d823e7b0ae5ed2f91fc39406d6e537f569409552518fe57b4d981132e42d60fa8127334c2c601890c
- SSDEEP 393216:f40QMl42yHOc3CEMCmLg7w+4w4ftS8wpFONkYxfkwgY6hD4Kdh2YrfjiaML5ZyI0:fyy4tHl2Mi6m3TS7vffjd6+kum
- TLSH T18E87339A77A44089FD5BD2BBCA52C21BDBB53C090233866F02E19F677E336315A5E701
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
Behavioral task
behavioral1
Sample
2026-07-18_fd23da463831a5df960aaae82fc1c335_agent-tesla_amadey_icedid_njrat_vidar.exe
Resource
win10v2004-20260513-en
Behavioral task
behavioral2
Sample
2026-07-18_fd23da463831a5df960aaae82fc1c335_agent-tesla_amadey_icedid_njrat_vidar.exe
Resource
win11ltsc2024-20260709-en
Malware Config
Targets
-
- Target 2026-07-18_fd23da463831a5df960aaae82fc1c335_agent-tesla_amadey_icedid_njrat_vidar
- Size 36.0MB
- SHA256 4bdb55414bc2dcf781f2df9c286fb304949b698ed1b497c2dd3669d26a59f914
- MD5 fd23da463831a5df960aaae82fc1c335
- SHA1 1132ba00db94595b080416b77f4ba0dd5efb0639
- SHA512 fb255ca2b47a7f0525bff56d2eab10e1530b5d26d508f47d823e7b0ae5ed2f91fc39406d6e537f569409552518fe57b4d981132e42d60fa8127334c2c601890c
- SSDEEP 393216:f40QMl42yHOc3CEMCmLg7w+4w4ftS8wpFONkYxfkwgY6hD4Kdh2YrfjiaML5ZyI0:fyy4tHl2Mi6m3TS7vffjd6+kum
- TLSH T18E87339A77A44089FD5BD2BBCA52C21BDBB53C090233866F02E19F677E336315A5E701
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Modifies Windows Firewall
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
MITRE ATT&CK Enterprise v16
Persistence
Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Privilege Escalation
Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Defense Evasion
Impair Defenses
1Disable or Modify System Firewall
1Modify Registry
1