2026-07-20_d4de7078b180cd370d4f4f71b74b21e3_icedid_njrat_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-20_d4de7078b180cd370d4f4f71b74b21e3_icedid_njrat_vidar
Size 1.5MB
Sample260720-jbee3acx7w
SHA256 4a8479f7ef657043ff2f9af36729f074e75d5c256ac8823c0cd9f89674e4875e
MD5 d4de7078b180cd370d4f4f71b74b21e3
SHA1 01ad7e49c3e0976b70f16fcab2cb28615a854ba1
SHA512 688bd141cec7dc5b119f1ebd6b6fa28f5cfd9dbdf92abbccb6b38a2715aff8a11e5a5fa2286a3964d45d533b32162f3f539b4861892e673fdebbc8db2acb9591
SSDEEP 24576:OTMlC+VukHvWx6T0zViHj+ZtW0I3ti8Zh:OTM1fVTBHYMZ
TLSH
T1FB75021A36944CFDFCA79079C8629A41E5777C120360CACF07A045AB5E737E1AE3EB61
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-20_d4de7078b180cd370d4f4f71b74b21e3_icedid_njrat_vidar

File Explorer

2026-07-20_d4de7078b180cd370d4f4f71b74b21e3_icedid_njrat_vidar

.exe 1.5MB

2026-07-20_d4de7078b180cd370d4f4f71b74b21e3_icedid_njrat_vidar

IMPHASH b7d22317b57b9bdd5997bbe913c86538
SHA256 4a8479f7ef657043ff2f9af36729f074e75d5c256ac8823c0cd9f89674e4875e
MD5 d4de7078b180cd370d4f4f71b74b21e3
SHA1 01ad7e49c3e0976b70f16fcab2cb28615a854ba1
SHA512 688bd141cec7dc5b119f1ebd6b6fa28f5cfd9dbdf92abbccb6b38a2715aff8a11e5a5fa2286a3964d45d533b32162f3f539b4861892e673fdebbc8db2acb9591
SSDEEP 24576:OTMlC+VukHvWx6T0zViHj+ZtW0I3ti8Zh:OTM1fVTBHYMZ
TLSH
T1FB75021A36944CFDFCA79079C8629A41E5777C120360CACF07A045AB5E737E1AE3EB61
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

56256

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\0113\windows\tools\HiSuiteService\x64\release64\HonorSuiteService.pdb

shlwapi

PathFileExistsW PathFileExistsA PathAppendA

userenv

DestroyEnvironmentBlock CreateEnvironmentBlock

setupapi

SetupDiGetClassDevsA SetupDiDestroyDeviceInfoList CM_Get_Parent SetupDiGetDeviceRegistryPropertyA SetupDiEnumDeviceInfo SetupDiGetDeviceInstanceIdA

kernel32

GetCurrentProcess SetLastError CreateProcessA LoadLibraryA Sleep CreateToolhelp32Snapshot Process32First Process32Next OpenProcess VerSetConditionMask VerifyVersionInfoA GetFileAttributesW SetFileAttributesW DeleteFileW FindNextFileW FindClose CreateDirectoryA GetLogicalDriveStringsA GetDriveTypeA lstrcmpiA OutputDebugStringA GetCommandLineA GetCommandLineW LocalFree FindFirstFileA CreateSemaphoreA GetProcessHeap GetFileSize GetFileAttributesA SetFileAttributesA DeleteFileA TerminateProcess GetCurrentProcessId LocalAlloc SetConsoleCtrlHandler GetCurrentThreadId CreateEventA CreateThread SetEvent GetTickCount WaitForMultipleObjects ResetEvent GetLocalTime GetTempPathA GetPrivateProfileStringA IsDebuggerPresent OutputDebugStringW EnterCriticalSection LeaveCriticalSection GetACP IsValidCodePage FindFirstFileExW GetConsoleMode GetConsoleCP FlushFileBuffers GetCPInfo GetFileType HeapSize HeapReAlloc HeapFree HeapAlloc FreeLibrary GetModuleFileNameA WaitForSingleObject CreateFileA CloseHandle DeleteCriticalSection InitializeCriticalSectionAndSpinCount GetProcAddress GetLastError RaiseException WideCharToMultiByte MultiByteToWideChar GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle GetStringTypeW GetFileSizeEx SetFilePointerEx CreateFileW ReadFile ReadConsoleW SetEndOfFile WriteConsoleW LCMapStringW CompareStringW WriteFile GetStdHandle GetModuleFileNameW GetModuleHandleExW ExitProcess GetTimeZoneInformation VirtualQuery VirtualProtect VirtualAlloc CreateEventW GetModuleHandleW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent GetStartupInfoW QueryPerformanceCounter GetSystemTimeAsFileTime InitializeSListHead RtlUnwindEx RtlPcToFileHeader EncodePointer TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW GetSystemInfo

user32

CharNextA GetMessageA DispatchMessageA UnregisterDeviceNotification RegisterDeviceNotificationA PostThreadMessageA

advapi32

OpenProcessToken RegCreateKeyExA GetUserNameA RegCreateKeyA RegSetValueExA RegCloseKey RegQueryValueExA RegOpenKeyExA QueryServiceStatus UnlockServiceDatabase ChangeServiceConfigA QueryServiceLockStatusA LockServiceDatabase StartServiceCtrlDispatcherA RegisterServiceCtrlHandlerExA SetServiceStatus CloseServiceHandle DeleteService ControlService StartServiceA ChangeServiceConfig2A CreateServiceA QueryServiceConfigA OpenServiceA OpenSCManagerA CreateProcessAsUserA GetTokenInformation ConvertStringSecurityDescriptorToSecurityDescriptorA

ole32

CoInitialize CoCreateInstance

shell32

SHGetPathFromIDListA SHGetSpecialFolderLocation SHGetFolderPathA CommandLineToArgvW

oleaut32

VariantClear SysAllocString SysFreeString SysAllocStringLen

Name

.text

Size

147KB

Virtual Size

146KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

63KB

Virtual Size

62KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

8KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

1.3MB

Virtual Size

1.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-20_d4de7078b180cd370d4f4f71b74b21e3_icedid_njrat_vidar

shlwapi

userenv

setupapi

kernel32

user32

advapi32

ole32

shell32

oleaut32

generic