2026-07-31_54c1f3eadcd0e16003f39c45d5e54f18_icedid_njrat_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-31_54c1f3eadcd0e16003f39c45d5e54f18_icedid_njrat_vidar
Size 4.6MB
Sample260731-lf94msdn8x
SHA256 f154e3bd79a8a6af80e689544cd3500b030705e15c7ef9e3d69f5f032323c5c6
MD5 54c1f3eadcd0e16003f39c45d5e54f18
SHA1 90a6a09f187e939964d727d43be94447ca33e15a
SHA512 4cf58f8483027bcc66e5a7a4b86a9cc88005cc17e7bf6c141498a396b6f6ecb74076cddf3d572c201ae612c25e5779744e7ee4cb1b6473095ceae627d06a605a
SSDEEP 49152:9dRba8fD8qinfMSKJXIUQREV1QOTu1U5ai2wzYo5UC9RhuCTFKlaxV5dgbT8QKKE:K/IJsiCwsop7cTAKYpfg
TLSH
T153266C656BF880F5E1A7E138897AC9B2F77678020D71DB5F0251CA1F2F33A904D29726
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-31_54c1f3eadcd0e16003f39c45d5e54f18_icedid_njrat_vidar

File Explorer

2026-07-31_54c1f3eadcd0e16003f39c45d5e54f18_icedid_njrat_vidar

.exe 4.6MB

2026-07-31_54c1f3eadcd0e16003f39c45d5e54f18_icedid_njrat_vidar

IMPHASH d3751ab33b3858f3b8b8d3275495baba
SHA256 f154e3bd79a8a6af80e689544cd3500b030705e15c7ef9e3d69f5f032323c5c6
MD5 54c1f3eadcd0e16003f39c45d5e54f18
SHA1 90a6a09f187e939964d727d43be94447ca33e15a
SHA512 4cf58f8483027bcc66e5a7a4b86a9cc88005cc17e7bf6c141498a396b6f6ecb74076cddf3d572c201ae612c25e5779744e7ee4cb1b6473095ceae627d06a605a
SSDEEP 49152:9dRba8fD8qinfMSKJXIUQREV1QOTu1U5ai2wzYo5UC9RhuCTFKlaxV5dgbT8QKKE:K/IJsiCwsop7cTAKYpfg
TLSH
T153266C656BF880F5E1A7E138897AC9B2F77678020D71DB5F0251CA1F2F33A904D29726
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2315552

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

d:\dbs\el\dec\target\x64\ship\click2run\x-none\IntegratedOffice.pdb

gdi32

GetDeviceCaps

oleaut32

SysFreeString VariantInit VariantClear SysAllocString

advapi32

RegCreateKeyExW RegCloseKey EventWriteTransfer EventRegister EventUnregister RegQueryValueExW RegOpenKeyExW RegEnumKeyExW RegQueryInfoKeyW RegEnumValueW RegDeleteTreeW RegDeleteKeyW RegGetValueW RegSetValueExW RegDeleteValueW GetTokenInformation IsValidSid GetSidSubAuthorityCount GetSidSubAuthority RegNotifyChangeKeyValue RevertToSelf EventWrite OpenThreadToken OpenProcessToken GetLengthSid CopySid InitializeAcl AddAccessAllowedAce AllocateAndInitializeSid FreeSid InitializeSecurityDescriptor SetSecurityDescriptorDacl GetSecurityDescriptorDacl ConvertStringSecurityDescriptorToSecurityDescriptorW ConvertSidToStringSidA CheckTokenMembership CreateWellKnownSid EqualSid

kernel32

GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetCurrentProcess GetLastError CompareStringEx IsWow64Process MultiByteToWideChar RaiseException InitializeCriticalSectionEx DeleteCriticalSection DecodePointer SetLastError DeactivateActCtx ActivateActCtx LoadLibraryW FindActCtxSectionStringW CreateActCtxW GetModuleFileNameW GetModuleHandleExW QueryActCtxW OutputDebugStringA LocalFree FindClose UnmapViewOfFile CloseHandle CreateFileMappingA MapViewOfFile Sleep GetStringTypeExW GetUserDefaultLCID LCMapStringW FreeLibrary GetSystemTimeAsFileTime GetCurrentThreadId FlsAlloc TlsAlloc FlsFree TlsFree FlsGetValue TlsGetValue FlsSetValue TlsSetValue GetTickCount64 GetProcAddress K32GetProcessMemoryInfo GlobalMemoryStatusEx LeaveCriticalSection EnterCriticalSection LocalAlloc WideCharToMultiByte CreateEventW SetEvent InitializeSRWLock ReleaseSRWLockShared AcquireSRWLockShared ReleaseSRWLockExclusive AcquireSRWLockExclusive GetProcessTimes TerminateProcess GetModuleFileNameA GetShortPathNameA K32GetModuleFileNameExW CreateProcessW GetModuleHandleW LoadLibraryExW FindResourceW SizeofResource LoadResource VerSetConditionMask VerifyVersionInfoW OpenProcess GetCurrentProcessId GetStringTypeW GetVersionExW GetUserDefaultLocaleName IsValidCodePage SystemTimeToFileTime FileTimeToSystemTime GetCPInfoExW GetDiskFreeSpaceExW CreateFileW DeviceIoControl GetComputerNameW WriteConsoleW FormatMessageW GetLogicalProcessorInformation GetNativeSystemInfo GetSystemDirectoryW HeapFree HeapAlloc GetProcessHeap WaitForSingleObject CreateThread WaitForMultipleObjectsEx CreateEventExW WakeConditionVariable WakeAllConditionVariable SleepConditionVariableSRW CloseThreadpoolTimer SetThreadpoolTimer WaitForThreadpoolTimerCallbacks CreateThreadpoolTimer CloseThreadpoolWait SetThreadpoolWait WaitForThreadpoolWaitCallbacks CreateThreadpoolWait CreateThreadpoolWork SubmitThreadpoolWork ReleaseSemaphore WaitForSingleObjectEx QueryDepthSList TryEnterCriticalSection InitializeSListHead InterlockedPushEntrySList InterlockedPopEntrySList RtlCaptureStackBackTrace ReleaseMutex CreateMutexExW OpenMutexW GetTempPathW GetLongPathNameW ResetEvent QueryPerformanceCounter QueryPerformanceFrequency VirtualProtectEx GetSystemInfo GlobalFree GlobalAlloc ReadFile WriteFile GetFileSizeEx SetEndOfFile SetFilePointerEx GetOverlappedResult FlushFileBuffers CancelIoEx GetFileAttributesExW DeleteFileW CreateDirectoryW FindFirstFileExW FindNextFileW GetFileType GetTempFileNameW SetFileInformationByHandle GetFileInformationByHandleEx SignalObjectAndWait GetProcessAffinityMask GetLogicalProcessorInformationEx CreateWaitableTimerW SetWaitableTimerEx CancelWaitableTimer GetTickCount WerRegisterMemoryBlock WerUnregisterMemoryBlock QueryFullProcessImageNameW IsProcessorFeaturePresent CreateIoCompletionPort PostQueuedCompletionStatus GetThreadIOPendingFlag GetCurrentThread GetQueuedCompletionStatus IsDebuggerPresent WaitForMultipleObjects GetStartupInfoW CreateMemoryResourceNotification GetSystemPowerStatus IsSystemResumeAutomatic QueryUnbiasedInterruptTime OutputDebugStringW RtlCaptureContext GetModuleHandleA VirtualFree ExpandEnvironmentStringsW VirtualAlloc OpenEventA CreateEventA OpenMutexA CreateMutexA OpenSemaphoreA CreateSemaphoreA OpenFileMappingA ProcessIdToSessionId GetPriorityClass GetExitCodeProcess GetTimeZoneInformation IsValidLocale LCMapStringEx GetPhysicallyInstalledSystemMemory GetProductInfo SwitchToThread GetACP SetStdHandle HeapReAlloc EnumSystemLocalesW GetTimeFormatW GetDateFormatW ExitProcess GetStdHandle HeapSize GetConsoleCP GetConsoleMode UnregisterWaitEx VirtualProtect FreeLibraryAndExitThread GetThreadTimes UnregisterWait RegisterWaitForSingleObject SetThreadAffinityMask GetNumaHighestNodeNumber ChangeTimerQueueTimer GetThreadPriority SetThreadPriority CreateTimerQueue InterlockedFlushSList RtlUnwindEx SetUnhandledExceptionFilter UnhandledExceptionFilter VirtualQuery LoadLibraryExA GetLocalTime GetOEMCP RtlVirtualUnwind RtlLookupFunctionEntry GetLocaleInfoW CompareStringW GetCPInfo InitializeCriticalSectionAndSpinCount EncodePointer RtlPcToFileHeader DuplicateHandle DeleteTimerQueueTimer CreateTimerQueueTimer GetUserGeoID GetSystemDefaultLCID

ole32

CoRevokeInitializeSpy CLSIDFromString CoTaskMemFree CoCreateInstance CoSetProxyBlanket IIDFromString StringFromGUID2 CoCreateGuid CoInitializeEx CoUninitialize CreateStreamOnHGlobal CoCreateFreeThreadedMarshaler CoRegisterInitializeSpy CoTaskMemAlloc

Name

.text

Size

2.6MB

Virtual Size

2.6MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.1MB

Virtual Size

1.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

107KB

Virtual Size

108KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

122KB

Virtual Size

122KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.didat

Size

1024B

Virtual Size

792B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

83KB

Virtual Size

83KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

604KB

Virtual Size

608KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-31_54c1f3eadcd0e16003f39c45d5e54f18_icedid_njrat_vidar

gdi32

oleaut32

advapi32

kernel32

ole32

generic