2026-07-30_57206a273486e92a934f61644ea25c40_icedid_njrat_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-30_57206a273486e92a934f61644ea25c40_icedid_njrat_vidar
Size 1.6MB
Sample260730-d1lyjsbb35
SHA256 0c6f67307c82af53e51375c49343527c6ee0da5d2fdc92c09ad3f09a75352e6c
MD5 57206a273486e92a934f61644ea25c40
SHA1 3a225fd109d0d5a63d5417ab3cc6dfc3b50b87ea
SHA512 91af585843a42143812ada69a725537c5c5387c7883491770c6fe51121ddfce44a04bc4dfc8db6080081bc568c682a94eb39c5dd3711ab2c20fa30afae0aa298
SSDEEP 24576:bFftX+xrV01dRWsqjnhMgeiCl7G0nehbGZpbD:FGV016Dmg27RnWGj
TLSH
T1EC85D05A735849F5D067817CCA53860AE77278141B61DBCB12A8E3BE2F335D09E3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-30_57206a273486e92a934f61644ea25c40_icedid_njrat_vidar

File Explorer

2026-07-30_57206a273486e92a934f61644ea25c40_icedid_njrat_vidar

.exe 1.6MB

2026-07-30_57206a273486e92a934f61644ea25c40_icedid_njrat_vidar

IMPHASH 5e83fcfb13dc228d86ed68298b46db5e
SHA256 0c6f67307c82af53e51375c49343527c6ee0da5d2fdc92c09ad3f09a75352e6c
MD5 57206a273486e92a934f61644ea25c40
SHA1 3a225fd109d0d5a63d5417ab3cc6dfc3b50b87ea
SHA512 91af585843a42143812ada69a725537c5c5387c7883491770c6fe51121ddfce44a04bc4dfc8db6080081bc568c682a94eb39c5dd3711ab2c20fa30afae0aa298
SSDEEP 24576:bFftX+xrV01dRWsqjnhMgeiCl7G0nehbGZpbD:FGV016Dmg27RnWGj
TLSH
T1EC85D05A735849F5D067817CCA53860AE77278141B61DBCB12A8E3BE2F335D09E3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

118224

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\qb\workspace\21461\source\gfx-driver\dump64\miniport\IntelCpLSPCONSvc\Release\IntelCpHDCPSvc.pdb

cfgmgr32

CM_Get_Device_Interface_List_SizeW CM_Get_Device_Interface_ListW

kernel32

ReadFile WriteFile CloseHandle ReleaseMutex GetCommandLineW HeapAlloc HeapReAlloc HeapFree HeapSize GetProcessHeap EnterCriticalSection LeaveCriticalSection SleepEx GetCurrentProcess GetCurrentThread WriteConsoleW FreeLibrary GetModuleFileNameW GetModuleHandleW GetProcAddress LoadLibraryExW LoadResource SetFilePointerEx SizeofResource FindResourceW GetConsoleMode GetConsoleCP FlushFileBuffers GetStringTypeW SetStdHandle LocalFree lstrcmpiW LCMapStringW FreeEnvironmentStringsW MultiByteToWideChar GetEnvironmentStringsW GetCommandLineA GetCPInfo GetOEMCP GetCurrentThreadId OutputDebugStringA CreateThread CreateSemaphoreExW ReleaseSemaphore SetEvent GetACP IsValidCodePage FindNextFileW FindFirstFileExW FindClose GetFileType GetStdHandle GetModuleHandleExW ExitProcess RtlPcToFileHeader RtlUnwindEx LoadLibraryW CreateTimerQueue UnregisterWaitEx QueryDepthSList InterlockedFlushSList InterlockedPushEntrySList InterlockedPopEntrySList DuplicateHandle GetCurrentProcessId DeleteCriticalSection InitializeCriticalSectionEx GetLastError RaiseException DecodePointer Sleep CreateEventW WaitForSingleObject QueryPerformanceFrequency QueryPerformanceCounter VirtualFree VirtualProtect VirtualAlloc GetVersionExW CreateFileW DeviceIoControl CreateMutexW WaitForMultipleObjects SetThreadAffinityMask GetModuleHandleA FreeLibraryAndExitThread GetThreadTimes EncodePointer UnregisterWait TryEnterCriticalSection SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemTimeAsFileTime GetTickCount WideCharToMultiByte WaitForSingleObjectEx RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW InitializeSListHead OutputDebugStringW SignalObjectAndWait SwitchToThread SetThreadPriority GetThreadPriority GetLogicalProcessorInformation CreateTimerQueueTimer ChangeTimerQueueTimer DeleteTimerQueueTimer GetNumaHighestNodeNumber GetProcessAffinityMask RegisterWaitForSingleObject

advapi32

ControlService OpenThreadToken CopySid ConvertStringSecurityDescriptorToSecurityDescriptorW EventUnregister EventRegister NotifyServiceStatusChangeW StartServiceCtrlDispatcherW EventWrite SetServiceStatus RegisterServiceCtrlHandlerExW QueryServiceConfigW OpenServiceW OpenSCManagerW DeleteService CreateServiceW GetLengthSid CloseServiceHandle ChangeServiceConfigW RegSetValueExW RegSetValueExA RegQueryValueExW RegQueryValueExA RegQueryInfoKeyW RegOpenKeyExW RegOpenKeyW RegEnumKeyExW RegDeleteValueW RegDeleteKeyW RegCreateKeyExW RegCloseKey SetSecurityDescriptorOwner SetSecurityDescriptorGroup MakeAbsoluteSD IsValidSid InitializeSecurityDescriptor GetTokenInformation GetSecurityDescriptorLength OpenProcessToken

user32

CharNextW CharUpperW PostThreadMessageW RegisterDeviceNotificationW DispatchMessageW TranslateMessage GetMessageW MessageBoxW LoadStringW

oleaut32

LoadTypeLi VarUI4FromStr UnRegisterTypeLi SysAllocString SafeArrayDestroy SafeArrayRedim SysFreeString SafeArrayGetUBound SafeArrayGetLBound SafeArrayLock SafeArrayUnlock LoadRegTypeLi VariantClear SafeArrayCreate SafeArrayCopy SafeArrayGetVartype VariantInit RegisterTypeLi SysStringLen

api-ms-win-dx-d3dkmt-l1-1-0

D3DKMTEscape D3DKMTCreateDevice D3DKMTOpenAdapterFromGdiDisplayName D3DKMTOpenAdapterFromDeviceName D3DKMTCloseAdapter D3DKMTDestroyDevice

ole32

CoRegisterClassObject CoInitializeSecurity CoInitializeEx CoUninitialize CoCreateInstance CoRevokeClassObject CoResumeClassObjects CoAddRefServerProcess CoReleaseServerProcess StringFromGUID2 CoTaskMemAlloc CoTaskMemRealloc CoTaskMemFree CoSetProxyBlanket

api-ms-win-ntuser-sysparams-l1-1-0

EnumDisplayDevicesW

Name

.text

Size

308KB

Virtual Size

308KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

127KB

Virtual Size

127KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

11KB

Virtual Size

18KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

21KB

Virtual Size

20KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

1.2MB

Virtual Size

1.8MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-30_57206a273486e92a934f61644ea25c40_icedid_njrat_vidar

cfgmgr32

kernel32

advapi32

user32

oleaut32

api-ms-win-dx-d3dkmt-l1-1-0

ole32

api-ms-win-ntuser-sysparams-l1-1-0

generic