2026-07-22_969164994401ec96d593fc73039a9abb_icedid_njrat_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-22_969164994401ec96d593fc73039a9abb_icedid_njrat_vidar
Size 1.6MB
Sample260722-a2v13aha82
SHA256 8bdac5f143492c76e8ccac5157efca2703b3b0f45c3035ded9b4fb6236e89267
MD5 969164994401ec96d593fc73039a9abb
SHA1 017a6bda8496b9bf7f146573397acce8c2dbdd05
SHA512 96ac1282ec437cf46dcdcb2dbec3fbef10995f2b330c085db4acf68d4987da5399520d5a17a6d28ca588cd6353ce17ac6ba4e8003287a4a2149942adcaed1498
SSDEEP 24576:wzNWkWSpH+7EQFB/xIHcsqjnhMgeiCl7G0nehbGZpbD:riaDoIDmg27RnWGj
TLSH
T13875E156F3E400F9F0779234C9B7C516EA337C9917709A9F2360996A2F736908D3AB21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-22_969164994401ec96d593fc73039a9abb_icedid_njrat_vidar

File Explorer

2026-07-22_969164994401ec96d593fc73039a9abb_icedid_njrat_vidar

.exe 1.6MB

2026-07-22_969164994401ec96d593fc73039a9abb_icedid_njrat_vidar

IMPHASH 2875ae09cdfcab0655c7f7536e466c3d
SHA256 8bdac5f143492c76e8ccac5157efca2703b3b0f45c3035ded9b4fb6236e89267
MD5 969164994401ec96d593fc73039a9abb
SHA1 017a6bda8496b9bf7f146573397acce8c2dbdd05
SHA512 96ac1282ec437cf46dcdcb2dbec3fbef10995f2b330c085db4acf68d4987da5399520d5a17a6d28ca588cd6353ce17ac6ba4e8003287a4a2149942adcaed1498
SSDEEP 24576:wzNWkWSpH+7EQFB/xIHcsqjnhMgeiCl7G0nehbGZpbD:riaDoIDmg27RnWGj
TLSH
T13875E156F3E400F9F0779234C9B7C516EA337C9917709A9F2360996A2F736908D3AB21
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

93572

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\divynslin\Desktop\MY_PCNB\Forte_SVN\FMService_code\FMService_1_w11_all\FMService_1_77_honor_power\x64\Release\FMService64.pdb

rpcrt4

RpcBindingVectorFree RpcServerUseProtseqEpW NdrServerCallAll NdrServerCall2 RpcServerUnregisterIf RpcServerRegisterIf3 RpcServerListen RpcEpUnregister RpcEpRegisterW RpcServerInqBindings NdrClientCall3

kernel32

CreateFileW FindFirstFileW ReadConsoleW LeaveCriticalSection OpenSemaphoreW WaitForSingleObject GlobalAlloc GetSystemDirectoryW WriteFile CreateProcessW DeleteCriticalSection EnterCriticalSection CreateEventW CreateFileMappingW MapViewOfFile InitializeCriticalSection CreateThread Sleep SetFilePointerEx WaitForMultipleObjects GetFileSizeEx WTSGetActiveConsoleSessionId WaitForSingleObjectEx ReleaseMutex ReleaseSemaphore GetConsoleMode GetConsoleOutputCP CloseHandle FlushFileBuffers FindClose SetEvent ReadFile GlobalFree GetCurrentProcessId CreateMutexExW CreateSemaphoreExW SetStdHandle SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP GetACP IsValidCodePage FindNextFileW SetLastError OpenEventW OutputDebugStringW IsDebuggerPresent FindFirstFileExW EnumSystemLocalesW GetLastError GetUserDefaultLCID IsValidLocale FlsFree FlsSetValue FlsGetValue GetProcAddress InitializeCriticalSectionEx FlsAlloc GetFileType HeapSize HeapReAlloc GetModuleHandleW RaiseException DebugBreak DecodePointer GetCommandLineW GetCommandLineA LocalFree GetStdHandle ExitProcess LoadLibraryExW CreateThreadpoolWork RtlUnwind GetModuleFileNameA GetModuleHandleExW FreeLibrary HeapFree GetModuleFileNameW GetProcessHeap HeapAlloc GetCurrentThreadId FormatMessageW WriteConsoleW GetFileSize RtlPcToFileHeader RtlUnwindEx GetCPInfo GetStringTypeW GetLocaleInfoW LCMapStringW CompareStringW FileTimeToSystemTime EncodePointer TlsFree GetDateFormatW TlsSetValue TlsGetValue TlsAlloc SwitchToThread SubmitThreadpoolWork InitializeSListHead GetSystemTimeAsFileTime QueryPerformanceCounter GetStartupInfoW InitializeCriticalSectionAndSpinCount IsProcessorFeaturePresent TerminateProcess GetCurrentProcess MultiByteToWideChar WideCharToMultiByte SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext

ole32

CoUninitialize PropVariantClear CoInitialize CoCreateInstance CoInitializeEx StringFromGUID2

advapi32

DeleteService QueryServiceStatus ControlService OpenServiceW CloseServiceHandle CreateServiceW OpenSCManagerW SetServiceStatus RegisterServiceCtrlHandlerExW StartServiceCtrlDispatcherW AllocateAndInitializeSid SetEntriesInAclW FreeSid ReportEventW RegNotifyChangeKeyValue DeregisterEventSource RegisterEventSourceW RegQueryValueExW RegSetValueExW CreateProcessAsUserW GetTokenInformation DuplicateTokenEx SetSecurityDescriptorDacl InitializeSecurityDescriptor RegCloseKey RegOpenKeyExW

wtsapi32

WTSQueryUserToken

shlwapi

StrStrIW

oleaut32

VariantClear SysFreeString SysAllocString

propsys

InitPropVariantFromCLSID

setupapi

SetupDiGetDeviceInstallParamsW CM_Get_Device_ID_ExW SetupDiDestroyDriverInfoList SetupDiClassGuidsFromNameExW SetupDiEnumDeviceInfo SetupDiGetClassDevsExW SetupDiGetDriverInfoDetailW SetupDiGetDeviceInfoListDetailW SetupDiBuildDriverInfoList SetupDiGetDeviceRegistryPropertyW SetupDiSetDeviceInstallParamsW SetupDiDestroyDeviceInfoList SetupDiGetDriverInstallParamsW SetupDiEnumDriverInfoW

user32

RegisterPowerSettingNotification GetSystemMetrics CharUpperW CharNextW UnregisterPowerSettingNotification

version

VerQueryValueW GetFileVersionInfoW GetFileVersionInfoSizeW

api-ms-win-security-base-l1-2-2

DeriveCapabilitySidsFromName

Name

.text

Size

255KB

Virtual Size

254KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

129KB

Virtual Size

129KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

12KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.gxfg

Size

9KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.gehcont

Size

512B

Virtual Size

32B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

1.2MB

Virtual Size

1.8MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-22_969164994401ec96d593fc73039a9abb_icedid_njrat_vidar

rpcrt4

kernel32

ole32

advapi32

wtsapi32

shlwapi

oleaut32

propsys

setupapi

user32

version

api-ms-win-security-base-l1-2-2

generic