2026-08-04_14b44e1fdcd23319cea79fd02a21f4f9_icedid_njrat_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-04_14b44e1fdcd23319cea79fd02a21f4f9_icedid_njrat_vidar
Size 1.4MB
Sample260804-t5dqqsdg28
SHA256 fafa3afd671ee6a52310c15c9ec3c8c6b9ed049334176a00ab6dd69e5aafe610
MD5 14b44e1fdcd23319cea79fd02a21f4f9
SHA1 951b4a75e0797c8cd918fef1ec8ca2ca138a4c1e
SHA512 385d6ecb8f841cda149bc3c6c92edb92753cec8f4ebea60e0e77f82f481ab679ff0448c22942a52643621eb03bbc829adbf13aee7a64202e39eef5e4e5e9d2ab
SSDEEP 24576:PvVaWV4OeBWTpWJ3pURCIGkhhRmlh8t0D+7y8G2G9yL0cMoThTR9PyuLzpQo:PNaWVMApWtpURCIhm+brLC2hTR9quLB
TLSH
T160659D55AFABC5EAC16BA23FC5060942E5FEF6010713A3CB47540A753F536A34E3A392
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-04_14b44e1fdcd23319cea79fd02a21f4f9_icedid_njrat_vidar

File Explorer

2026-08-04_14b44e1fdcd23319cea79fd02a21f4f9_icedid_njrat_vidar

.exe 1.4MB

2026-08-04_14b44e1fdcd23319cea79fd02a21f4f9_icedid_njrat_vidar

IMPHASH 6ff736ec8ccd26f85124d86f72504d91
SHA256 fafa3afd671ee6a52310c15c9ec3c8c6b9ed049334176a00ab6dd69e5aafe610
MD5 14b44e1fdcd23319cea79fd02a21f4f9
SHA1 951b4a75e0797c8cd918fef1ec8ca2ca138a4c1e
SHA512 385d6ecb8f841cda149bc3c6c92edb92753cec8f4ebea60e0e77f82f481ab679ff0448c22942a52643621eb03bbc829adbf13aee7a64202e39eef5e4e5e9d2ab
SSDEEP 24576:PvVaWV4OeBWTpWJ3pURCIGkhhRmlh8t0D+7y8G2G9yL0cMoThTR9PyuLzpQo:PNaWVMApWtpURCIhm+brLC2hTR9quLB
TLSH
T160659D55AFABC5EAC16BA23FC5060942E5FEF6010713A3CB47540A753F536A34E3A392
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

150112

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\dvs\p4\build\sw\gcomp\dev\src\NvContainer\_out\x86_64\release\container\NvContainer.pdb

shlwapi

PathIsRelativeW

kernel32

VerSetConditionMask CompareFileTime CreateFileW GetFileAttributesW GetFullPathNameW OutputDebugStringW SetLastError CreateProcessA CreateProcessW GetSystemDirectoryW FreeLibrary GetModuleFileNameW GetProcAddress LoadLibraryExW lstrcmpA VerifyVersionInfoW FileTimeToSystemTime ExpandEnvironmentStringsW DeleteFileW FindClose FindFirstFileW FindNextFileW OutputDebugStringA Sleep GetCurrentThreadId ProcessIdToSessionId GetSystemTime GetSystemTimeAsFileTime CreateTimerQueueTimer DeleteTimerQueueTimer GetModuleHandleExW MoveFileW MultiByteToWideChar WideCharToMultiByte RemoveVectoredContinueHandler Process32FirstW Process32NextW FindCloseChangeNotification FindFirstChangeNotificationW FindNextChangeNotification GetCurrentDirectoryW GetErrorMode SetErrorMode GetCommandLineW RaiseException GetSystemInfo VirtualProtect VirtualQuery LoadLibraryExA GetConsoleCP HeapReAlloc HeapSize ReadConsoleW ReadFile GetStringTypeW SetStdHandle GetProcessHeap SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetCPInfo GetOEMCP GetACP IsValidCodePage FindFirstFileExW SetFilePointerEx FlushFileBuffers GetFileSizeEx AddVectoredContinueHandler RemoveVectoredExceptionHandler AddVectoredExceptionHandler SetUnhandledExceptionFilter RtlCaptureStackBackTrace GetModuleHandleW WaitForMultipleObjects OpenEventW LocalFree LocalAlloc OpenProcess CreateThread GetCurrentProcessId CreateEventW WaitForSingleObject SetEvent GetLastError CloseHandle GetCurrentProcess GetProcessTimes SetDefaultDllDirectories SetEndOfFile CreateToolhelp32Snapshot RtlUnwind EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionAndSpinCount DeleteCriticalSection ResetEvent WaitForSingleObjectEx RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW QueryPerformanceCounter InitializeSListHead RtlUnwindEx RtlPcToFileHeader InterlockedPushEntrySList InterlockedFlushSList EncodePointer TlsAlloc TlsGetValue TlsSetValue TlsFree ExitProcess GetStdHandle GetFileType WriteConsoleW WriteFile HeapAlloc HeapFree GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetCurrentThread SetConsoleCtrlHandler GetConsoleMode

user32

PostThreadMessageW PeekMessageW GetMessageW ShutdownBlockReasonDestroy ShutdownBlockReasonCreate SetWindowLongPtrW GetWindowLongPtrW LoadStringW CreateWindowExW UnregisterClassW RegisterClassW DefWindowProcW PostMessageW DispatchMessageW TranslateMessage DestroyWindow

shell32

CommandLineToArgvW

advapi32

RegSetKeyValueW RegOpenKeyExW GetUserNameW BuildExplicitAccessWithNameW SetSecurityInfo GetSecurityInfo SetEntriesInAclW StartServiceCtrlDispatcherW SetServiceStatus RegisterServiceCtrlHandlerExW QueryServiceConfigW OpenServiceW OpenSCManagerW CloseServiceHandle ChangeServiceConfigW RegGetValueW RegSetValueExW RegDeleteValueW RegCreateKeyExW RegCloseKey LookupAccountSidW CreateWellKnownSid OpenProcessToken

Name

.text

Size

556KB

Virtual Size

556KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

120KB

Virtual Size

119KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

8KB

Virtual Size

24KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

31KB

Virtual Size

31KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.didat

Size

512B

Virtual Size

48B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_RDATA

Size

512B

Virtual Size

148B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

134KB

Virtual Size

134KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

568KB

Virtual Size

572KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-04_14b44e1fdcd23319cea79fd02a21f4f9_icedid_njrat_vidar

shlwapi

kernel32

user32

shell32

advapi32

generic