2026-07-20_11edb38b255aab84198d3b51311e0e1c_icedid_njrat_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-20_11edb38b255aab84198d3b51311e0e1c_icedid_njrat_vidar
Size 1.2MB
Sample260720-wrdvpact9y
SHA256 88d18865ee13139640c965db5a5aedaec0e8dd619177b740159d0dc07199225b
MD5 11edb38b255aab84198d3b51311e0e1c
SHA1 a837dd3482bc1a6cfe05cf4c01c7c66534d2a8c1
SHA512 3d4f0cbfc3211cd4192d602c47063e2957382ae439bbbf4438d30302d97fe7856935c493f649d11ba0494ae31e08d1446040e9e8b7ff0767fdf0ea8f5e27ff38
SSDEEP 24576:VOlJAH5Vd0BCo/AEEHYIRC4O0eXw5lj1JSAkdCN/j2GLl3iFSE33b9:VOlJ65rxo/AEEHYIRC4ZeXw7j1JSUN/g
TLSH
T11345DF56B7E401F5E57BC175CFA79222FA7274585B205EEF0260498A2F32BE08B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-20_11edb38b255aab84198d3b51311e0e1c_icedid_njrat_vidar

File Explorer

2026-07-20_11edb38b255aab84198d3b51311e0e1c_icedid_njrat_vidar

.exe 1.2MB

2026-07-20_11edb38b255aab84198d3b51311e0e1c_icedid_njrat_vidar

IMPHASH fb7c45a8bc1b6a88a8ba37af06eb0c1f
SHA256 88d18865ee13139640c965db5a5aedaec0e8dd619177b740159d0dc07199225b
MD5 11edb38b255aab84198d3b51311e0e1c
SHA1 a837dd3482bc1a6cfe05cf4c01c7c66534d2a8c1
SHA512 3d4f0cbfc3211cd4192d602c47063e2957382ae439bbbf4438d30302d97fe7856935c493f649d11ba0494ae31e08d1446040e9e8b7ff0767fdf0ea8f5e27ff38
SSDEEP 24576:VOlJAH5Vd0BCo/AEEHYIRC4O0eXw5lj1JSAkdCN/j2GLl3iFSE33b9:VOlJ65rxo/AEEHYIRC4ZeXw7j1JSUN/g
TLSH
T11345DF56B7E401F5E57BC175CFA79222FA7274585B205EEF0260498A2F32BE08B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

360008

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\Recent\ATKRelation\Universal\AsLdrSrv\x64\Release_MyASUS\AsusOptimization.pdb

rpcrt4

NdrServerCallAll RpcServerUseProtseqEpW RpcServerRegisterIf3 NdrClientCall3 NdrServerCall2 RpcServerInqBindings RpcEpRegisterW RpcServerListen RpcServerUnregisterIf RpcServerInqCallAttributesW RpcBindingVectorFree RpcEpUnregister

api-ms-win-core-synch-l1-1-0

InitializeCriticalSection ReleaseMutex InitializeCriticalSectionAndSpinCount CreateMutexW OpenEventW DeleteCriticalSection CreateEventW SetEvent WaitForSingleObject LeaveCriticalSection EnterCriticalSection OpenMutexW InitializeCriticalSectionEx ResetEvent

api-ms-win-service-core-l1-1-0

StartServiceCtrlDispatcherW SetServiceStatus RegisterServiceCtrlHandlerExW

api-ms-win-core-processthreads-l1-1-0

OpenProcessToken TlsAlloc SuspendThread TlsGetValue CreateProcessAsUserW GetExitCodeProcess CreateProcessW CreateThread GetCurrentProcess ExitProcess GetStartupInfoW GetCurrentProcessId TerminateProcess GetCurrentThreadId TlsSetValue ResumeThread TlsFree

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-errorhandling-l1-1-0

SetUnhandledExceptionFilter SetLastError GetLastError UnhandledExceptionFilter RaiseException

api-ms-win-core-com-l1-1-0

IIDFromString CoInitializeEx CoCreateInstance CoTaskMemFree PropVariantClear StringFromGUID2 CLSIDFromString CoUninitialize

api-ms-win-core-synch-l1-2-1

WaitForMultipleObjects

api-ms-win-core-io-l1-1-0

DeviceIoControl

api-ms-win-core-file-l1-1-0

ReadFile SetFilePointerEx CreateFileW GetFileTime FlushFileBuffers FindClose FindFirstFileExW SetEndOfFile CompareFileTime FindNextFileW GetFileType SetFilePointer GetFileSize CreateDirectoryW FindFirstFileW DeleteFileW WriteFile GetFileAttributesExW

api-ms-win-core-sysinfo-l1-1-0

GlobalMemoryStatusEx GetSystemTime GetWindowsDirectoryW GetTickCount64 GetSystemInfo GetVersionExW GetSystemTimeAsFileTime GetSystemDirectoryW

api-ms-win-core-kernel32-legacy-l1-1-0

GetSystemPowerStatus

api-ms-win-core-registry-l1-1-0

RegCreateKeyExW RegSetValueExW RegDeleteValueW RegQueryValueExW RegCloseKey RegEnumKeyExW RegNotifyChangeKeyValue RegOpenKeyExW

api-ms-win-core-privateprofile-l1-1-0

WritePrivateProfileStringW GetPrivateProfileIntW GetPrivateProfileStringW

api-ms-win-core-path-l1-1-0

PathCchRemoveFileSpec

api-ms-win-shell-shdirectory-l1-1-0

ord290

api-ms-win-core-timezone-l1-1-0

FileTimeToSystemTime SystemTimeToFileTime

api-ms-win-devices-config-l1-1-1

CM_Register_Notification CM_Unregister_Notification CM_Get_Device_Interface_ListW CM_Get_Device_Interface_PropertyW CM_Get_DevNode_PropertyW CM_Get_Device_ID_List_SizeW CM_Locate_DevNodeW CM_Get_Device_Interface_List_SizeW CM_Get_Device_ID_ListW CM_Get_Parent

api-ms-win-core-file-l1-2-0

CreateFile2

api-ms-win-core-libraryloader-l1-2-0

FreeResource LoadResource FreeLibrary LoadLibraryExW GetModuleHandleExW GetModuleHandleW GetProcAddress GetModuleFileNameW LoadLibraryExA LockResource

api-ms-win-core-sysinfo-l1-2-1

GetPhysicallyInstalledSystemMemory

api-ms-win-core-heap-l1-1-0

HeapFree HeapSize GetProcessHeap HeapReAlloc HeapAlloc

hid

HidD_GetPreparsedData HidP_GetCaps HidD_SetFeature HidD_GetFeature HidD_FreePreparsedData HidD_GetAttributes HidD_GetHidGuid

api-ms-win-security-base-l1-1-0

AllocateAndInitializeSid AddAccessAllowedAce IsValidSecurityDescriptor AdjustTokenPrivileges SetSecurityDescriptorDacl InitializeSecurityDescriptor FreeSid AddAce InitializeAcl GetLengthSid DuplicateTokenEx SetFileSecurityW SetTokenInformation

propsys

InitPropVariantFromCLSID

api-ms-win-core-namedpipe-l1-1-0

DisconnectNamedPipe WaitNamedPipeW ConnectNamedPipe CreateNamedPipeW

api-ms-win-core-libraryloader-l1-2-1

FindResourceW LoadLibraryW

api-ms-win-oobe-notification-l1-1-0

OOBEComplete RegisterWaitUntilOOBECompleted UnregisterWaitUntilOOBECompleted

api-ms-win-core-heap-l2-1-0

LocalFree LocalAlloc

api-ms-win-ntuser-sysparams-l1-1-0

GetSystemMetrics

powrprof

PowerDeterminePlatformRole PowerReadDCValueIndex SetSuspendState

api-ms-win-core-sysinfo-l1-2-0

GetSystemFirmwareTable GetProductInfo

api-ms-win-power-setting-l1-1-0

PowerWriteDCValueIndex PowerSettingRegisterNotification PowerSetActiveScheme PowerWriteACValueIndex PowerSettingUnregisterNotification PowerGetActiveScheme

api-ms-win-core-toolhelp-l1-1-0

CreateToolhelp32Snapshot Process32NextW Process32FirstW

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent OpenProcess

api-ms-win-core-string-l1-1-0

WideCharToMultiByte GetStringTypeW MultiByteToWideChar

ext-ms-win-networking-wlanapi-l1-1-0

WlanCloseHandle WlanOpenHandle WlanFreeMemory WlanEnumInterfaces

api-ms-win-service-management-l1-1-0

DeleteService StartServiceW OpenServiceW CloseServiceHandle OpenSCManagerW

api-ms-win-power-base-l1-1-0

GetPwrCapabilities

api-ms-win-security-lsalookup-l2-1-0

LookupPrivilegeValueW

api-ms-win-core-shutdown-l1-1-0

InitiateSystemShutdownExW

api-ms-win-shcore-registry-l1-1-0

SHDeleteKeyW

api-ms-win-security-base-l1-2-2

DeriveCapabilitySidsFromName

api-ms-win-security-provider-l1-1-0

SetEntriesInAclW

api-ms-win-service-winsvc-l1-1-0

ControlService

api-ms-win-service-management-l2-1-0

ChangeServiceConfig2W ChangeServiceConfigW QueryServiceStatusEx

userenv

DestroyEnvironmentBlock CreateEnvironmentBlock

ext-ms-win-shell32-shellfolders-l1-1-0

SHGetKnownFolderPath

api-ms-win-core-version-l1-1-0

VerQueryValueW

api-ms-win-core-psapi-l1-1-0

K32GetModuleFileNameExW

api-ms-win-core-firmware-l1-1-0

SetFirmwareEnvironmentVariableExW GetFirmwareEnvironmentVariableW

oleaut32

SysFreeString

api-ms-win-eventing-classicprovider-l1-1-0

GetTraceEnableLevel GetTraceLoggerHandle TraceMessage GetTraceEnableFlags RegisterTraceGuidsW UnregisterTraceGuids

cfgmgr32

CM_Reenumerate_DevNode_Ex

api-ms-win-core-memory-l1-1-0

VirtualQuery VirtualProtect

api-ms-win-core-rtlsupport-l1-1-0

RtlVirtualUnwind RtlPcToFileHeader RtlLookupFunctionEntry RtlCaptureContext RtlUnwindEx

api-ms-win-core-debug-l1-1-0

IsDebuggerPresent

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

api-ms-win-core-fibers-l1-1-0

FlsFree FlsAlloc FlsSetValue FlsGetValue

api-ms-win-core-util-l1-1-0

EncodePointer

api-ms-win-core-processenvironment-l1-1-0

FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA SetStdHandle GetStdHandle GetCommandLineW

api-ms-win-core-localization-l1-2-0

LCMapStringW GetACP GetCPInfo GetOEMCP IsValidCodePage

api-ms-win-core-console-l1-1-0

WriteConsoleW GetConsoleMode GetConsoleCP

Name

.text

Size

451KB

Virtual Size

450KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

136KB

Virtual Size

135KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

22KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

24KB

Virtual Size

23KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

8KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

568KB

Virtual Size

572KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-20_11edb38b255aab84198d3b51311e0e1c_icedid_njrat_vidar

rpcrt4

api-ms-win-core-synch-l1-1-0

api-ms-win-service-core-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-com-l1-1-0

api-ms-win-core-synch-l1-2-1

api-ms-win-core-io-l1-1-0

api-ms-win-core-file-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-kernel32-legacy-l1-1-0

api-ms-win-core-registry-l1-1-0

api-ms-win-core-privateprofile-l1-1-0

api-ms-win-core-path-l1-1-0

api-ms-win-shell-shdirectory-l1-1-0

api-ms-win-core-timezone-l1-1-0

api-ms-win-devices-config-l1-1-1

api-ms-win-core-file-l1-2-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-sysinfo-l1-2-1

api-ms-win-core-heap-l1-1-0

hid

api-ms-win-security-base-l1-1-0

propsys

api-ms-win-core-namedpipe-l1-1-0

api-ms-win-core-libraryloader-l1-2-1

api-ms-win-oobe-notification-l1-1-0

api-ms-win-core-heap-l2-1-0

api-ms-win-ntuser-sysparams-l1-1-0

powrprof

api-ms-win-core-sysinfo-l1-2-0

api-ms-win-power-setting-l1-1-0

api-ms-win-core-toolhelp-l1-1-0

api-ms-win-core-processthreads-l1-1-1

api-ms-win-core-string-l1-1-0

ext-ms-win-networking-wlanapi-l1-1-0

api-ms-win-service-management-l1-1-0

api-ms-win-power-base-l1-1-0

api-ms-win-security-lsalookup-l2-1-0

api-ms-win-core-shutdown-l1-1-0

api-ms-win-shcore-registry-l1-1-0

api-ms-win-security-base-l1-2-2

api-ms-win-security-provider-l1-1-0

api-ms-win-service-winsvc-l1-1-0

api-ms-win-service-management-l2-1-0

userenv

ext-ms-win-shell32-shellfolders-l1-1-0

api-ms-win-core-version-l1-1-0

api-ms-win-core-psapi-l1-1-0

api-ms-win-core-firmware-l1-1-0

oleaut32

api-ms-win-eventing-classicprovider-l1-1-0

cfgmgr32

api-ms-win-core-memory-l1-1-0

api-ms-win-core-rtlsupport-l1-1-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-interlocked-l1-1-0

api-ms-win-core-fibers-l1-1-0

api-ms-win-core-util-l1-1-0

api-ms-win-core-processenvironment-l1-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-console-l1-1-0

generic