2026-07-28_c1f138118d26cd208f26a57cc1fac6ff_icedid_njrat_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-28_c1f138118d26cd208f26a57cc1fac6ff_icedid_njrat_vidar
Size 1.4MB
Sample260728-p1e1saxamd
SHA256 2905656e9af1b854f594c417927e54d5439c3188656df9cf5073fb855f7a3d77
MD5 c1f138118d26cd208f26a57cc1fac6ff
SHA1 9627b61e48062cb213397fb73ead1a308179e9ae
SHA512 b582073406a717f5285d67f0448dc414b55b04eb4ce7515cf2dc98c170cc83dfa51418dc5302860fe033109ad2b3543be578cddcd8e069d7fb848838b6b29aed
SSDEEP 24576:s44icPT3fnyNXW2GMCEEJLebc46vVa4eZwq86QAhhUkXuMDtz6Blg:jv+36skEFebcFvVa4eZw6QAhukeMJz66
TLSH
T1B465C00A775C02F9E177D17DC9425A46EBB1B8065B31A78F13E407AE3F236A14E7A321
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-28_c1f138118d26cd208f26a57cc1fac6ff_icedid_njrat_vidar

File Explorer

2026-07-28_c1f138118d26cd208f26a57cc1fac6ff_icedid_njrat_vidar

.exe 1.4MB

2026-07-28_c1f138118d26cd208f26a57cc1fac6ff_icedid_njrat_vidar

IMPHASH 079fbaef0ee8e2db2cc4f234aefd3cee
SHA256 2905656e9af1b854f594c417927e54d5439c3188656df9cf5073fb855f7a3d77
MD5 c1f138118d26cd208f26a57cc1fac6ff
SHA1 9627b61e48062cb213397fb73ead1a308179e9ae
SHA512 b582073406a717f5285d67f0448dc414b55b04eb4ce7515cf2dc98c170cc83dfa51418dc5302860fe033109ad2b3543be578cddcd8e069d7fb848838b6b29aed
SSDEEP 24576:s44icPT3fnyNXW2GMCEEJLebc46vVa4eZwq86QAhhUkXuMDtz6Blg:jv+36skEFebcFvVa4eZw6QAhukeMJz66
TLSH
T1B465C00A775C02F9E177D17DC9425A46EBB1B8065B31A78F13E407AE3F236A14E7A321
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

264236

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\shirley\HidMonitorSvc.exe\01_DELL\G9_UWP\x64\release\HidMonitorSvc.pdb

setupapi

SetupDiGetDeviceInstanceIdW SetupDiOpenClassRegKey CM_Get_Device_ID_ListA CM_Get_Device_ID_List_SizeA CM_Locate_DevNodeA CM_Locate_DevNodeW CM_Open_DevNode_Key CM_Reenumerate_DevNode CM_Get_Device_Interface_ListA CM_Get_Device_Interface_List_SizeA SetupDiGetDeviceInterfaceDetailW SetupDiDestroyDeviceInfoList SetupDiEnumDeviceInterfaces SetupDiGetClassDevsW

hid

HidD_GetHidGuid HidD_GetAttributes HidD_GetPreparsedData HidD_FreePreparsedData HidP_GetCaps

wtsapi32

WTSQueryUserToken WTSQuerySessionInformationW WTSFreeMemory

shlwapi

StrCmpW PathFileExistsA PathFileExistsW

user32

UnregisterDeviceNotification MessageBoxW RegisterDeviceNotificationW

kernel32

GetUserDefaultLCID IsValidLocale GetLocaleInfoW DecodePointer GetLastError InitializeCriticalSectionEx DeleteCriticalSection SetFilePointerEx GetProcessHeap SetConsoleCtrlHandler CreateFileW CloseHandle EnumSystemLocalesW WideCharToMultiByte Sleep SetEvent ResetEvent FlushFileBuffers WaitForMultipleObjects GetCurrentProcess GetCurrentThread SetThreadPriority ResumeThread CreateProcessA GetFileSizeEx GetConsoleCP SetPriorityClass GetTickCount64 GetSystemDirectoryA GetSystemDirectoryW GetWindowsDirectoryA GetVersionExW FreeLibrary GetModuleFileNameA GetProcAddress LoadLibraryW GetConsoleMode ReadFile WTSGetActiveConsoleSessionId CreateEventW GetTimeZoneInformation FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW OutputDebugStringW SetStdHandle ReadConsoleW WriteConsoleW MultiByteToWideChar LCMapStringW CompareStringW ExpandEnvironmentStringsW lstrlenW SetEndOfFile GetTimeFormatW CreateFileA GetDateFormatW InitOnceExecuteOnce FormatMessageW EnterCriticalSection LeaveCriticalSection LCMapStringEx EncodePointer GetLocaleInfoEx GetStringTypeW CompareStringEx GetCPInfo __C_specific_handler RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent GetModuleHandleW TerminateProcess QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead RtlUnwindEx RtlPcToFileHeader RaiseException InterlockedPushEntrySList InterlockedFlushSList SetLastError FlsAlloc FlsGetValue FlsSetValue FlsFree HeapAlloc HeapFree HeapReAlloc ExitProcess GetModuleHandleExW GetModuleFileNameW GetStdHandle WriteFile GetCommandLineA GetCommandLineW HeapSize GetFileType InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW

advapi32

StartServiceCtrlDispatcherW SetServiceStatus RegisterServiceCtrlHandlerExW QueryServiceStatusEx OpenServiceW OpenSCManagerW DeleteService CloseServiceHandle RegSetValueExW RegQueryValueExW RegQueryInfoKeyW RegNotifyChangeKeyValue RegEnumKeyExW RegEnumKeyW RegDeleteKeyW RegCreateKeyExW SetTokenInformation DuplicateTokenEx OpenProcessToken CreateProcessAsUserW RegEnumValueW RegOpenKeyExW RegCloseKey

userenv

DestroyEnvironmentBlock CreateEnvironmentBlock

Name

.text

Size

624KB

Virtual Size

624KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

165KB

Virtual Size

165KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

8KB

Virtual Size

18KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

34KB

Virtual Size

33KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

568KB

Virtual Size

572KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-28_c1f138118d26cd208f26a57cc1fac6ff_icedid_njrat_vidar

setupapi

hid

wtsapi32

shlwapi

user32

kernel32

advapi32

userenv

generic