2026-07-27_7a86fcfe1f0ebe92c529027a198b0268_icedid_njrat_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-27_7a86fcfe1f0ebe92c529027a198b0268_icedid_njrat_vidar
Size 1.3MB
Sample260727-j78nsayfle
SHA256 638e101bc478a1d553d8b1f6752ee09ba487ac8013a5bc8ee0002b714349c0a4
MD5 7a86fcfe1f0ebe92c529027a198b0268
SHA1 b5c927f960baf6712d902353e87dc5ee7b9961f6
SHA512 7de375c4bfdcebd8d2f5fad5d02888d8d2a17109de867355087b1212cf61d1d46670b34ff801d287f3b47a4ce69d4a1a790bd949a5c3c3155a74cbb7b36fea3b
SSDEEP 24576:CcophGb0Vpafp2yj9o0fzNm2kxUlYtEjedEeQ16ywqmpv:Ccpb0Vpafpv+0fzYuYtO2E8ywqev
TLSH
T13D65DF467BE411E8D43BD27DC60B5662FA72744817316BDF03A486AD6F236E24B3E320
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-27_7a86fcfe1f0ebe92c529027a198b0268_icedid_njrat_vidar

File Explorer

2026-07-27_7a86fcfe1f0ebe92c529027a198b0268_icedid_njrat_vidar

.exe 1.3MB

2026-07-27_7a86fcfe1f0ebe92c529027a198b0268_icedid_njrat_vidar

IMPHASH 21bd59e5b99a2bee7b079a953a593be3
SHA256 638e101bc478a1d553d8b1f6752ee09ba487ac8013a5bc8ee0002b714349c0a4
MD5 7a86fcfe1f0ebe92c529027a198b0268
SHA1 b5c927f960baf6712d902353e87dc5ee7b9961f6
SHA512 7de375c4bfdcebd8d2f5fad5d02888d8d2a17109de867355087b1212cf61d1d46670b34ff801d287f3b47a4ce69d4a1a790bd949a5c3c3155a74cbb7b36fea3b
SSDEEP 24576:CcophGb0Vpafp2yj9o0fzNm2kxUlYtEjedEeQ16ywqmpv:Ccpb0Vpafpv+0fzYuYtO2E8ywqev
TLSH
T13D65DF467BE411E8D43BD27DC60B5662FA72744817316BDF03A486AD6F236E24B3E320
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

260780

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

c:\constructicon\builds\gfx\three\21.40\drivers\2d\dal\eeu\build\client\wNow64a\B_rel\atieclxx.pdb

user32

EnumDisplaySettingsA GetThreadDesktop GetAsyncKeyState RegisterHotKey SetThreadDesktop SendInput CloseDesktop ChangeDisplaySettingsExA OpenInputDesktop SystemParametersInfoA SetSysColors GetSysColor RedrawWindow PostThreadMessageA UnregisterDeviceNotification RegisterDeviceNotificationA RegisterClassExA LoadIconA LoadStringA RegisterRawInputDevices GetRawInputData GetMonitorInfoW MonitorFromWindow FindWindowExW GetWindowLongPtrA GetClientRect GetWindowTextW UnhookWinEvent SetWinEventHook GetWindowThreadProcessId IsWindowVisible MessageBoxW MessageBoxA DisplayConfigGetDeviceInfo QueryDisplayConfig GetDisplayConfigBufferSizes EnumDisplayDevicesA EnumWindows GetPropA wsprintfW RegisterWindowMessageA ChangeWindowMessageFilter GetClassNameA FindWindowA GetForegroundWindow UpdateWindow KillTimer SetTimer ShowWindow DestroyWindow CreateWindowExA RegisterClassA PostQuitMessage DefWindowProcA PostMessageA UnregisterPowerSettingNotification RegisterPowerSettingNotification SendMessageA UnregisterHotKey DispatchMessageA GetMessageA

gdi32

D3DKMTPollDisplayChildren D3DKMTQueryAdapterInfo DeleteDC CreateDCA SetDeviceGammaRamp

advapi32

InitializeSecurityDescriptor RegCloseKey RegCreateKeyExA RegOpenKeyExA RegQueryValueExA RegSetValueExA RegGetValueW RegGetValueA RegSetValueExW RegDeleteValueA RegOpenCurrentUser SetSecurityDescriptorDacl ImpersonateLoggedOnUser RegQueryInfoKeyA RegEnumValueA RegEnumKeyExA RegDeleteKeyA DuplicateTokenEx CreateProcessAsUserW ConvertStringSecurityDescriptorToSecurityDescriptorA CreateProcessAsUserA OpenProcessToken RegDeleteTreeA RevertToSelf

userenv

DestroyEnvironmentBlock CreateEnvironmentBlock LoadUserProfileA UnloadUserProfile

wtsapi32

WTSQuerySessionInformationA WTSQuerySessionInformationW WTSRegisterSessionNotification WTSQueryUserToken WTSEnumerateProcessesA WTSFreeMemory WTSEnumerateSessionsA

powrprof

PowerGetActiveScheme PowerSetActiveScheme PowerWritePossibleValue PowerWritePossibleFriendlyName PowerReadSettingAttributes PowerWriteACDefaultIndex PowerWriteDCDefaultIndex PowerWriteSettingAttributes PowerRemovePowerSetting PowerCreateSetting PowerCreatePossibleSetting PowerEnumerate PowerWriteACValueIndex PowerWriteDCValueIndex PowerSettingAccessCheck PowerReadACValueIndex PowerReadDCValueIndex PowerWriteFriendlyName

setupapi

CM_Reenumerate_DevNode CM_Get_Parent CM_Get_DevNode_Status SetupDiSetClassInstallParamsA CM_Get_Child_Ex SetupDiClassGuidsFromNameA SetupDiGetClassDevsExA CM_Get_DevNode_Status_Ex CM_Get_Device_ID_ExA SetupDiGetDeviceRegistryPropertyA SetupDiEnumDeviceInfo SetupDiGetClassDevsA SetupDiOpenDeviceInfoA SetupDiGetHwProfileList SetupDiGetDeviceInstanceIdA SetupGetInfDriverStoreLocationA SetupUninstallOEMInfA SetupDiBuildDriverInfoList SetupDiEnumDriverInfoA SetupDiGetDriverInfoDetailA SetupDiDestroyDriverInfoList SetupDiSetDeviceRegistryPropertyA SetupDiGetDeviceInstallParamsA SetupDiSetDeviceInstallParamsA CM_Get_Device_ID_Size CM_Locate_DevNodeA SetupDiCallClassInstaller SetupDiDestroyDeviceInfoList CM_Get_Device_IDA

dwmapi

DwmIsCompositionEnabled

ole32

CoCreateInstance CoCreateGuid PropVariantClear CoInitializeEx CoInitialize CoUninitialize CoTaskMemFree

difxapi

DriverPackageUninstallA DriverPackageInstallA DriverPackagePreinstallA DriverPackageGetPathA

propsys

InitPropVariantFromDoubleVector

shlwapi

StrStrIA PathStripPathW

newdev

DiInstallDriverA DiInstallDevice DiUninstallDriverA

kernel32

RtlLookupFunctionEntry RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale RtlCaptureContext WinExec TerminateThread OpenMutexA CreateMutexA ReleaseMutex WaitForMultipleObjects OpenEventA CreateEventA SetEndOfFile InitializeSListHead GetTimeFormatW GetDateFormatW GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime GetStartupInfoW IsProcessorFeaturePresent GetModuleHandleW RtlUnwindEx RtlPcToFileHeader RaiseException InterlockedPushEntrySList InterlockedFlushSList EncodePointer EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW GetStdHandle WriteFile GetModuleFileNameW GetCurrentProcess ExitProcess GetModuleHandleExW GetCurrentThread HeapReAlloc HeapSize ReadConsoleW CreateFileW SetFilePointerEx GetFileSizeEx SetConsoleCtrlHandler GetProcessHeap GetStringTypeW SetStdHandle SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW ResetEvent SetEvent GetTickCount VerifyVersionInfoW RemoveDirectoryA VerSetConditionMask GetLocalTime GetModuleHandleA FindNextFileA DeleteFileA CompareFileTime GetWindowsDirectoryA FileTimeToSystemTime lstrcmpA LocalAlloc FileTimeToLocalFileTime SetThreadPriority CreateThread QueryPerformanceCounter K32GetModuleBaseNameA K32EnumProcessModules QueryFullProcessImageNameA GetEnvironmentVariableA ReadFile FindFirstFileA FindClose K32GetProcessImageFileNameA K32EnumProcesses GetSystemDefaultLangID FindResourceExA LockResource LoadResource FreeResource GetSystemDirectoryA SetLastError GetFileTime CreateFileA CreateDirectoryA ExpandEnvironmentStringsA GetProcAddress CopyFileA LoadLibraryA FreeLibrary GetTempPathW SetFileAttributesA GetFileAttributesA GetSystemPowerStatus Process32Next Process32First GetCommandLineW GetCPInfo GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW OutputDebugStringW GetConsoleMode GetConsoleCP HeapFree HeapAlloc GetFileType WideCharToMultiByte WriteConsoleW CreateToolhelp32Snapshot QueryFullProcessImageNameW lstrlenW TerminateProcess LocalFree FlushFileBuffers WTSGetActiveConsoleSessionId EnumSystemLocalesW GetUserDefaultLCID GetCommandLineA GetLastError Sleep CreateProcessA GetModuleFileNameA MoveFileExA CloseHandle MapViewOfFile UnmapViewOfFile AssignProcessToJobObject CreateFileMappingA OpenFileMappingA WaitForSingleObject GetExitCodeProcess OpenProcess IsWow64Process OutputDebugStringA SetInformationJobObject CreateJobObjectA MultiByteToWideChar

shell32

SHGetKnownFolderPath Shell_NotifyIconA

version

VerQueryValueA GetFileVersionInfoSizeA GetFileVersionInfoA

crypt32

CryptQueryObject CertCloseStore CryptMsgGetParam CryptMsgClose CryptDecodeObject CryptDecodeObjectEx

dbgeng

DebugCreate

Name

.text

Size

565KB

Virtual Size

565KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

191KB

Virtual Size

190KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

35KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

33KB

Virtual Size

33KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

13KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

568KB

Virtual Size

572KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

generic

count=152, id=261, version=26213,

count=7, id=259, productName=VS2017 v15.6.6 build 26131, version=26131,

count=38, id=261, productName=VS2017 v15.6.6 build 26131, version=26131,

count=19, id=260, productName=VS2017 v15.6.6 build 26131, version=26131,

count=8, id=259, version=26213,

count=1, id=262, version=26213,

count=15, id=260, version=26213,

count=2, id=263, version=26213,

count=37, id=257, version=26213,

count=334, id=1, productName=Unmarked objects,

count=14, id=261, productName=VS2019 v16.11.1 build 30133, version=30133,

count=40, id=261, productName=VS2017 v15.7.1 build 26428, version=26428,

count=1, id=259, productName=VS2017 v15.7.1 build 26428, version=26428,

count=1, id=256, productName=VS2017 v15.7.1 build 26428, version=26428,

count=1, id=255, productName=VS2017 v15.7.1 build 26428, version=26428,

count=1, id=258, productName=VS2017 v15.7.1 build 26428, version=26428,