2026-08-04_8b72333e9dcac8d0d87c41baeff11a53_icedid_njrat_vidar

General

Target
2026-08-04_8b72333e9dcac8d0d87c41baeff11a53_icedid_njrat_vidar
Size 1.7MB
Sample260804-2lc9vsfk5s
SHA256 d7ac4fd65d3efee67551f9dc8b4ea9ecc2d7e06086883f5c46c41831d17803bb
MD5 8b72333e9dcac8d0d87c41baeff11a53
SHA1 e4823f0350a39d701dde8f41572537968a176022
SHA512 d125e06b3ce6d0c0a0011dbefddbbec97efd6d1a21a6d283a69df4c6f4c3641264340f2db24013e33c8fbc0a93600cf6bc26e089d8ca94a05507bcd13541cd0d
SSDEEP 24576:GXAHyxv2uEsqjnhMgeiCl7G0nehbGZpbD:GXAHyoHDmg27RnWGj
TLSH
T14985F15A72D80CF9D9668539C697D13AF6B3BC122A20CB1F1761C65E1F37220AD2DB21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-04_8b72333e9dcac8d0d87c41baeff11a53_icedid_njrat_vidar

File Explorer

2026-08-04_8b72333e9dcac8d0d87c41baeff11a53_icedid_njrat_vidar

.exe 1.7MB

2026-08-04_8b72333e9dcac8d0d87c41baeff11a53_icedid_njrat_vidar

IMPHASH 0c2ee6307b8d02eb510a44eda1175509
SHA256 d7ac4fd65d3efee67551f9dc8b4ea9ecc2d7e06086883f5c46c41831d17803bb
MD5 8b72333e9dcac8d0d87c41baeff11a53
SHA1 e4823f0350a39d701dde8f41572537968a176022
SHA512 d125e06b3ce6d0c0a0011dbefddbbec97efd6d1a21a6d283a69df4c6f4c3641264340f2db24013e33c8fbc0a93600cf6bc26e089d8ca94a05507bcd13541cd0d
SSDEEP 24576:GXAHyxv2uEsqjnhMgeiCl7G0nehbGZpbD:GXAHyoHDmg27RnWGj
TLSH
T14985F15A72D80CF9D9668539C697D13AF6B3BC122A20CB1F1761C65E1F37220AD2DB21
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

6

Entry point

90432

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP IMAGE_FILE_NET_RUN_FROM_SWAP

PDB paths

d:\dbs\el\o1\target\x64\ship\delivery\x-none\ose.pdb

advapi32

RegCloseKey RegCreateKeyExW RegEnumKeyExW RegOpenKeyExW SetThreadToken RegEnumValueW RegQueryValueExW RegSetValueExW RegNotifyChangeKeyValue SetServiceStatus StartServiceCtrlDispatcherW DuplicateToken GetUserNameA RegDeleteValueW RegisterServiceCtrlHandlerW CryptGetHashParam CryptCreateHash CryptHashData CryptDestroyHash AllocateAndInitializeSid CheckTokenMembership FreeSid LookupAccountNameW ConvertStringSecurityDescriptorToSecurityDescriptorW CryptAcquireContextW CryptReleaseContext SetFileSecurityW RegDeleteKeyW OpenThreadToken

kernel32

CloseHandle GetLastError SetEvent GetModuleFileNameW GetDriveTypeW GetLogicalDrives lstrcmpW lstrlenW InitializeCriticalSection EnterCriticalSection LeaveCriticalSection DeleteCriticalSection Sleep ExitProcess GetCommandLineW SetErrorMode ResetEvent ReleaseMutex WaitForMultipleObjectsEx CreateMutexW CreateEventW CreateProcessW GetSystemInfo GetTickCount MoveFileExW CreateFileA CreateFileW ReadFile SetFilePointer RaiseException FreeLibrary GetModuleHandleW GetProcAddress LoadLibraryExW DosDateTimeToFileTime MultiByteToWideChar WideCharToMultiByte ReleaseSemaphore WaitForSingleObject WaitForMultipleObjects CreateSemaphoreW CreateThread SetFilePointerEx VirtualAlloc VirtualFree GlobalAlloc GlobalFree GetSystemTimeAsFileTime ExpandEnvironmentStringsW CompareStringW SetEndOfFile SetFileTime WriteFile GetSystemTime SystemTimeToFileTime LocalFree FindClose GetTempPathA CreateDirectoryW GetFileAttributesW GetTempPathW FindFirstFileW GetFileSizeEx QueryPerformanceCounter DeleteFileW SystemTimeToTzSpecificLocalTime GetTimeZoneInformation GetStdHandle lstrlenA FindNextFileW RemoveDirectoryW SetFileAttributesW GetFileAttributesExW GetFileTime CopyFileW CreateHardLinkW FormatMessageA GetComputerNameW GetCurrentThread HeapAlloc HeapReAlloc HeapFree HeapSize GetProcessHeap LoadLibraryExA VirtualQuery VirtualProtect WriteConsoleW FlushFileBuffers GetConsoleMode GetConsoleCP SetStdHandle LCMapStringW FreeEnvironmentStringsW GetEnvironmentStringsW GetCurrentProcessId GetCurrentThreadId InitializeSListHead RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent GetCurrentProcess TerminateProcess RtlUnwindEx RtlPcToFileHeader SetLastError EncodePointer InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree GetModuleFileNameA GetModuleHandleExW GetACP GetStringTypeW GetFileType FindFirstFileExA FindNextFileA IsValidCodePage GetOEMCP GetCPInfo GetCommandLineA

rpcrt4

RpcServerRegisterIfEx RpcImpersonateClient NdrServerCall2 RpcRevertToSelf RpcServerUnregisterIf RpcServerUseProtseqEpW

wintrust

WinVerifyTrust

Name

.text

Size

162KB

Virtual Size

161KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

61KB

Virtual Size

60KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

2KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

8KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.didat

Size

512B

Virtual Size

168B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

1.4MB

Virtual Size

1.4MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-04_8b72333e9dcac8d0d87c41baeff11a53_icedid_njrat_vidar

advapi32

kernel32

rpcrt4

wintrust

generic