2026-08-04_8bdb9273e3172e0ebad52292372d3d3b_icedid_njrat_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-04_8bdb9273e3172e0ebad52292372d3d3b_icedid_njrat_vidar
Size 1.6MB
Sample260804-g5lecsshnc
SHA256 1162d5c196ece7c0fa589a73ffde19a4fe3524bad07f5a59b3c4c98fa6e1b068
MD5 8bdb9273e3172e0ebad52292372d3d3b
SHA1 75b91b3721b041af1c42dac901f3ce21f3491397
SHA512 9bc07a4ce00d54a5e6b595dc036c06975dbb60a0a4aecbdc6c0c06b693339b29e55800885b2a8136392f9456d42aca20bf73035245a3129c7ec8d79900b496be
SSDEEP 6144:1QTQyMZig4Qv9235dosjmph9XZ7SW0Ak86ZwsT5ohiEqT8:1QTQ3v8PosOhdZm16u5om
TLSH
T1F575495AF7A404F9E177C1388D728506E672BC590B619BEF33A4434A1F33AD19D3AB21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-04_8bdb9273e3172e0ebad52292372d3d3b_icedid_njrat_vidar

File Explorer

2026-08-04_8bdb9273e3172e0ebad52292372d3d3b_icedid_njrat_vidar

.exe 1.6MB

2026-08-04_8bdb9273e3172e0ebad52292372d3d3b_icedid_njrat_vidar

IMPHASH 9c5b6d4546fd94cf16576c15535340bc
SHA256 1162d5c196ece7c0fa589a73ffde19a4fe3524bad07f5a59b3c4c98fa6e1b068
MD5 8bdb9273e3172e0ebad52292372d3d3b
SHA1 75b91b3721b041af1c42dac901f3ce21f3491397
SHA512 9bc07a4ce00d54a5e6b595dc036c06975dbb60a0a4aecbdc6c0c06b693339b29e55800885b2a8136392f9456d42aca20bf73035245a3129c7ec8d79900b496be
SSDEEP 6144:1QTQyMZig4Qv9235dosjmph9XZ7SW0Ak86ZwsT5ohiEqT8:1QTQ3v8PosOhdZm16u5om
TLSH
T1F575495AF7A404F9E177C1388D728506E672BC590B619BEF33A4434A1F33AD19D3AB21
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1708032

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\qb\workspace\21461\source\gfx-driver\dump64\gfxui\WindowsServiceModule\igfxCUIService\Release\igfxCUIService.pdb

kernel32

GetCurrentThreadId GetTickCount FreeLibrary GetModuleFileNameW GetModuleHandleW GetProcAddress LoadLibraryExW LoadResource GetCommandLineA SizeofResource FindResourceW GetCurrentThread CreateThread GetCurrentProcess Sleep CreateEventW WaitForSingleObject SetEvent lstrcmpiW LeaveCriticalSection EnterCriticalSection GetProcessHeap GetSystemPowerStatus WTSGetActiveConsoleSessionId GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW FindClose EnumSystemLocalesW GetUserDefaultLCID IsValidLocale HeapSize HeapFree HeapReAlloc HeapAlloc CloseHandle ReadFile CreateFileA GetCommandLineW GetEnvironmentStringsW GetConsoleMode GetConsoleCP FlushFileBuffers SetFilePointerEx GetFileSizeEx GetFileType GetModuleHandleExW ExitProcess WriteFile GetStdHandle DeleteFileW RtlPcToFileHeader RtlUnwindEx GetCPInfo GetLocaleInfoW LCMapStringW FreeEnvironmentStringsW SetStdHandle DecodePointer ReadConsoleW GlobalFree GlobalLock GlobalUnlock GlobalAlloc SetLastError TlsFree CreateDirectoryW SetFileAttributesW CreateProcessW CreateFileW GetSystemDirectoryW WriteConsoleW DeleteCriticalSection InitializeCriticalSectionEx lstrlenW TlsSetValue TlsGetValue TlsAlloc GetLastError InitializeCriticalSectionAndSpinCount EncodePointer GetStringTypeW WideCharToMultiByte GetStartupInfoW InitializeSListHead RaiseException GetSystemTimeAsFileTime GetCurrentProcessId QueryPerformanceCounter IsProcessorFeaturePresent TerminateProcess MultiByteToWideChar SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext IsDebuggerPresent OutputDebugStringW SetEndOfFile

user32

GetMessageW TranslateMessage LoadStringW DispatchMessageW MessageBoxW CharNextW CharUpperW PostThreadMessageW UnregisterDeviceNotification RegisterDeviceNotificationW

oleaut32

SysAllocStringLen SysFreeString SysAllocString SysStringLen VarUI4FromStr UnRegisterTypeLi RegisterTypeLi LoadRegTypeLi LoadTypeLi VarBstrCat

api-ms-win-dx-d3dkmt-l1-1-0

D3DKMTOpenAdapterFromDeviceName D3DKMTCloseAdapter D3DKMTEscape

setupapi

SetupDiGetDeviceInterfaceDetailW SetupDiDestroyDeviceInfoList SetupDiGetClassDevsW SetupDiEnumDeviceInterfaces SetupDiOpenDevRegKey SetupDiEnumDeviceInfo

advapi32

DeleteService SetSecurityDescriptorDacl StartServiceW RevertToSelf ImpersonateLoggedOnUser DuplicateTokenEx CreateProcessAsUserW StartServiceCtrlDispatcherW SetServiceStatus RegisterServiceCtrlHandlerExW QueryServiceStatusEx OpenServiceW OpenSCManagerW CreateServiceW ControlService CloseServiceHandle ChangeServiceConfig2W ChangeServiceConfigW RegSetValueExW RegQueryValueExW RegQueryInfoKeyW RegOpenKeyExW RegEnumKeyExW RegDeleteValueW RegDeleteKeyW RegCreateKeyExW RegCloseKey OpenThreadToken ReportEventW RegisterEventSourceW DeregisterEventSource SetSecurityDescriptorOwner SetSecurityDescriptorGroup IsValidSid InitializeSecurityDescriptor GetTokenInformation GetLengthSid CopySid OpenProcessToken

ole32

CoRegisterClassObject CoRevokeClassObject CoUninitialize CoAddRefServerProcess CoReleaseServerProcess CoInitializeSecurity CoResumeClassObjects CoInitializeEx PropVariantClear CoCreateInstance StringFromGUID2 CoTaskMemAlloc CoTaskMemRealloc CoTaskMemFree

version

GetFileVersionInfoExW VerQueryValueW GetFileVersionInfoSizeExW

shlwapi

PathFileExistsW

userenv

CreateEnvironmentBlock DestroyEnvironmentBlock

wtsapi32

WTSQueryUserToken

Name

.text

Size

214KB

Virtual Size

214KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

129KB

Virtual Size

128KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

8KB

Virtual Size

35KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

12KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

8KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

1.2MB

Virtual Size

1.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gfids

Size

2KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-04_8bdb9273e3172e0ebad52292372d3d3b_icedid_njrat_vidar

kernel32

user32

oleaut32

api-ms-win-dx-d3dkmt-l1-1-0

setupapi

advapi32

ole32

version

shlwapi

userenv

wtsapi32

generic