2026-07-30_fee4fa77f6cfdfd28b1261739197e84f_icedid_njrat_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-30_fee4fa77f6cfdfd28b1261739197e84f_icedid_njrat_vidar
Size 2.4MB
Sample260730-xnpy8aea76
SHA256 45e7c5323e4a2e468c98cb2e6f17d5ca1692de3570f7c323d31f232387b27cdb
MD5 fee4fa77f6cfdfd28b1261739197e84f
SHA1 0bc962d23712dc38ec3ab5d642a82314043d38ee
SHA512 12fc331ba66ac76f9e90d89641120273221b21146f56884df825221cbbde4fcc403d6f6689d5f6f663bce76223b33d78cb596baff51fce840835f402b6b7ed48
SSDEEP 24576:vXS+xbQouAIfxvnUF2mHSgAhFxeQaTtOhdsQMCkBQcb3QmfQa6nnZp:vC+x8ouAIfiF24OhmfQyQ1Fn
TLSH
T18DB5310367FC1408F5F36B789A7A88509A37BC660F34E59F01582D5D0B73A829DB6B72
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-30_fee4fa77f6cfdfd28b1261739197e84f_icedid_njrat_vidar

File Explorer

2026-07-30_fee4fa77f6cfdfd28b1261739197e84f_icedid_njrat_vidar

.exe 2.4MB

2026-07-30_fee4fa77f6cfdfd28b1261739197e84f_icedid_njrat_vidar

IMPHASH 49aaa307415968b34d3fd1a72dee6c71
SHA256 45e7c5323e4a2e468c98cb2e6f17d5ca1692de3570f7c323d31f232387b27cdb
MD5 fee4fa77f6cfdfd28b1261739197e84f
SHA1 0bc962d23712dc38ec3ab5d642a82314043d38ee
SHA512 12fc331ba66ac76f9e90d89641120273221b21146f56884df825221cbbde4fcc403d6f6689d5f6f663bce76223b33d78cb596baff51fce840835f402b6b7ed48
SSDEEP 24576:vXS+xbQouAIfxvnUF2mHSgAhFxeQaTtOhdsQMCkBQcb3QmfQa6nnZp:vC+x8ouAIfiF24OhmfQyQ1Fn
TLSH
T18DB5310367FC1408F5F36B789A7A88509A37BC660F34E59F01582D5D0B73A829DB6B72
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

350608

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

f:\Agent\_work\2\s\exe\x64\Public_Release\Sysmon64.pdb

tdh

TdhGetEventInformation TdhGetEventMapInformation

userenv

ExpandEnvironmentStringsForUserW

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeExW GetFileVersionInfoExW

netapi32

NetServerEnum NetApiBufferFree

ws2_32

htons getnameinfo ntohs gethostbyname WSAStartup inet_ntoa gethostname

mpr

WNetCancelConnection2W WNetAddConnection2W

wtsapi32

WTSQueryUserToken WTSEnumerateSessionsW WTSQuerySessionInformationW WTSFreeMemory

ole32

CoCreateInstance CoUninitialize CoInitializeEx IIDFromString StringFromGUID2 CoSetProxyBlanket CoInitializeSecurity

kernel32

LockResource DeleteFileW Process32FirstW GetSystemInfo LoadResource FindResourceW GetComputerNameW CreateProcessW GetSystemTimeAsFileTime GetTickCount ConnectNamedPipe GetExitCodeProcess DeviceIoControl ProcessIdToSessionId ExitProcess GetCurrentProcessId CopyFileW SetConsoleCtrlHandler GetFileSizeEx WaitForMultipleObjects SetThreadPriority UnmapViewOfFile CreateEventW GetCurrentThread GetOverlappedResult CreateFileMappingW MapViewOfFile QueryDosDeviceW GetFullPathNameW WriteFile OpenProcess GetLogicalDriveStringsW Module32FirstW K32EnumProcesses GetWindowsDirectoryW SystemTimeToFileTime GetTempFileNameW GetSystemTime K32GetMappedFileNameW QueryPerformanceFrequency ResetEvent DeleteCriticalSection SetEvent WaitForSingleObject FindFirstFileW FindNextFileW FindClose InitializeCriticalSectionAndSpinCount RaiseException DecodePointer TerminateProcess DuplicateHandle SetFileAttributesW GlobalSize FreeConsole GlobalLock GlobalUnlock GetModuleHandleExW SetStdHandle InterlockedFlushSList InterlockedPushEntrySList RtlPcToFileHeader RtlUnwindEx OutputDebugStringW GetCPInfo GetLocaleInfoW LCMapStringW CompareStringW EncodePointer TlsFree TlsSetValue TlsGetValue TlsAlloc SwitchToThread GetStringTypeW WideCharToMultiByte InitializeSListHead GetCurrentThreadId GetStartupInfoW IsDebuggerPresent IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry Process32NextW Sleep CreateToolhelp32Snapshot GetVersion GetSystemDirectoryW GetFileAttributesW QueryPerformanceCounter GetTempPathW RtlUnwind RemoveDirectoryW lstrlenW GetCurrentProcess GetConsoleScreenBufferInfo SizeofResource CreateDirectoryW CloseHandle InitializeCriticalSection ExpandEnvironmentStringsW GetLastError FormatMessageW LeaveCriticalSection EnterCriticalSection GetDateFormatW FreeLibrary GetTimeFormatW FileTimeToSystemTime MultiByteToWideChar GetModuleHandleW LocalFree GetProcAddress LocalAlloc GetStdHandle GetCommandLineW LoadLibraryExW GetVersionExW SetLastError GetFileType GetModuleFileNameW GetConsoleMode GetNumberOfConsoleInputEvents PeekConsoleInputA ReadConsoleInputA SetConsoleMode ExitThread ResumeThread FreeLibraryAndExitThread GetModuleFileNameA GetCommandLineA GetACP HeapFree HeapAlloc IsValidLocale GetUserDefaultLCID EnumSystemLocalesW FlushFileBuffers GetConsoleCP ReadFile HeapReAlloc FindFirstFileExA FindFirstFileExW FindNextFileA IsValidCodePage GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableA SetEnvironmentVariableW GetProcessHeap OutputDebugStringA GetTimeZoneInformation HeapSize RtlCaptureContext WaitForSingleObjectEx CreateFileW SetFilePointerEx WriteConsoleW ReadConsoleW SetEndOfFile CreateThread

user32

ChangeClipboardChain CloseClipboard RegisterClassW TranslateMessage GetClipboardData GetClipboardOwner UnregisterClassW MessageBoxW InflateRect OpenClipboard EndDialog SetWindowTextW DialogBoxIndirectParamW LoadCursorW SetCursor GetDlgItem GetSysColorBrush SetClipboardViewer GetMessageW GetWindowThreadProcessId GetPriorityClipboardFormat DispatchMessageW SendMessageW CreateWindowExW GetClipboardSequenceNumber DefWindowProcW

gdi32

EndDoc GetDeviceCaps SetMapMode StartDocW EndPage StartPage

comdlg32

PrintDlgW

advapi32

LookupAccountNameW RegQueryValueExW RegOpenKeyW RegCreateKeyW RegOpenKeyExW RegCloseKey SetFileSecurityW CryptAcquireContextW CryptGenRandom CreateProcessAsUserW ConvertStringSecurityDescriptorToSecurityDescriptorW DuplicateTokenEx CryptReleaseContext GetSecurityDescriptorLength DeregisterEventSource GetSidSubAuthorityCount GetSidSubAuthority CopySid GetLengthSid RegisterEventSourceW ReportEventW RegNotifyChangeKeyValue RegisterServiceCtrlHandlerExW SetSecurityDescriptorDacl RegDeleteKeyW SetServiceStatus ChangeServiceConfig2W SetEntriesInAclW RegCreateKeyExW InitializeSecurityDescriptor StartServiceCtrlDispatcherW QueryServiceConfigW RegDeleteValueW LookupAccountSidW ConvertSidToStringSidW LookupPrivilegeValueW AdjustTokenPrivileges RevertToSelf CreateServiceW QueryServiceStatus EqualSid CloseServiceHandle OpenSCManagerW AllocateAndInitializeSid DeleteService ControlService ImpersonateLoggedOnUser LogonUserW OpenProcessToken FreeSid StartServiceW RegConnectRegistryW OpenServiceW GetTokenInformation StartTraceW ProcessTrace CloseTrace ControlTraceW OpenTraceW EnableTraceEx2 RegSetValueExW

oleaut32

VarBstrCmp SafeArrayGetElement VariantChangeType VariantClear VariantInit SysAllocStringByteLen SysStringLen SysAllocStringLen SafeArrayUnaccessData SafeArrayDestroy SafeArrayGetLBound SafeArrayGetUBound GetErrorInfo SetErrorInfo SysStringByteLen SafeArrayAccessData CreateErrorInfo SysAllocString SysFreeString

crypt32

CryptFindOIDInfo CertGetCertificateChain CertDuplicateCertificateContext CertGetNameStringW CryptDecodeObject

secur32

LsaGetLogonSessionData LsaFreeReturnBuffer

rpcrt4

RpcServerUseProtseqEpW NdrClientCall2 RpcServerRegisterIfEx RpcStringFreeW I_RpcBindingInqLocalClientPID RpcBindingFromStringBindingW RpcStringBindingComposeW RpcServerUnregisterIf NdrServerCall2

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-30_fee4fa77f6cfdfd28b1261739197e84f_icedid_njrat_vidar

tdh

userenv

version

netapi32

ws2_32

mpr

wtsapi32

ole32

kernel32

user32

gdi32

comdlg32

advapi32

oleaut32

crypt32

secur32

rpcrt4

generic