2026-08-05_211eb789d5f6ad7df097ff82fe108f54_icedid_njrat_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-05_211eb789d5f6ad7df097ff82fe108f54_icedid_njrat_vidar
Size 4.7MB
Sample260805-ds2n2axbrf
SHA256 d8b259bbe804456b71e5680d4f193ebc1440a5a98749ad93c724b894f3aac2f6
MD5 211eb789d5f6ad7df097ff82fe108f54
SHA1 ea9775c2d8ac358253e28b78f7b5073362874a69
SHA512 07f9a7361af75d031345e87099b38bb5f004c5b8c1b1342f5b69b0735aa48365124f862bb451b12d2e8f011e9530a3b2aeae58e23ee8c14b00fd4c0fb9b07009
SSDEEP 49152:GdRba8fD8qinfMSKJXIUQREV1QOTu1U5ai2vzYo5UC9RhuCTFKlaxV5dgbTQY1oT:Z/IJsiCvsop7cTvvQWQ
TLSH
T190366C656BF880F5E1A7E134897AC9B2F77678020D71EB5F0251CA1F2F33A904D29726
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-05_211eb789d5f6ad7df097ff82fe108f54_icedid_njrat_vidar

File Explorer

2026-08-05_211eb789d5f6ad7df097ff82fe108f54_icedid_njrat_vidar

.exe 4.7MB

2026-08-05_211eb789d5f6ad7df097ff82fe108f54_icedid_njrat_vidar

IMPHASH d3751ab33b3858f3b8b8d3275495baba
SHA256 d8b259bbe804456b71e5680d4f193ebc1440a5a98749ad93c724b894f3aac2f6
MD5 211eb789d5f6ad7df097ff82fe108f54
SHA1 ea9775c2d8ac358253e28b78f7b5073362874a69
SHA512 07f9a7361af75d031345e87099b38bb5f004c5b8c1b1342f5b69b0735aa48365124f862bb451b12d2e8f011e9530a3b2aeae58e23ee8c14b00fd4c0fb9b07009
SSDEEP 49152:GdRba8fD8qinfMSKJXIUQREV1QOTu1U5ai2vzYo5UC9RhuCTFKlaxV5dgbTQY1oT:Z/IJsiCvsop7cTvvQWQ
TLSH
T190366C656BF880F5E1A7E134897AC9B2F77678020D71EB5F0251CA1F2F33A904D29726
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2315552

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

d:\dbs\el\dec\target\x64\ship\click2run\x-none\IntegratedOffice.pdb

gdi32

GetDeviceCaps

oleaut32

SysFreeString VariantInit VariantClear SysAllocString

advapi32

RegCreateKeyExW RegCloseKey EventWriteTransfer EventRegister EventUnregister RegQueryValueExW RegOpenKeyExW RegEnumKeyExW RegQueryInfoKeyW RegEnumValueW RegDeleteTreeW RegDeleteKeyW RegGetValueW RegSetValueExW RegDeleteValueW GetTokenInformation IsValidSid GetSidSubAuthorityCount GetSidSubAuthority RegNotifyChangeKeyValue RevertToSelf EventWrite OpenThreadToken OpenProcessToken GetLengthSid CopySid InitializeAcl AddAccessAllowedAce AllocateAndInitializeSid FreeSid InitializeSecurityDescriptor SetSecurityDescriptorDacl GetSecurityDescriptorDacl ConvertStringSecurityDescriptorToSecurityDescriptorW ConvertSidToStringSidA CheckTokenMembership CreateWellKnownSid EqualSid

kernel32

GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetCurrentProcess GetLastError CompareStringEx IsWow64Process MultiByteToWideChar RaiseException InitializeCriticalSectionEx DeleteCriticalSection DecodePointer SetLastError DeactivateActCtx ActivateActCtx LoadLibraryW FindActCtxSectionStringW CreateActCtxW GetModuleFileNameW GetModuleHandleExW QueryActCtxW OutputDebugStringA LocalFree FindClose UnmapViewOfFile CloseHandle CreateFileMappingA MapViewOfFile Sleep GetStringTypeExW GetUserDefaultLCID LCMapStringW FreeLibrary GetSystemTimeAsFileTime GetCurrentThreadId FlsAlloc TlsAlloc FlsFree TlsFree FlsGetValue TlsGetValue FlsSetValue TlsSetValue GetTickCount64 GetProcAddress K32GetProcessMemoryInfo GlobalMemoryStatusEx LeaveCriticalSection EnterCriticalSection LocalAlloc WideCharToMultiByte CreateEventW SetEvent InitializeSRWLock ReleaseSRWLockShared AcquireSRWLockShared ReleaseSRWLockExclusive AcquireSRWLockExclusive GetProcessTimes TerminateProcess GetModuleFileNameA GetShortPathNameA K32GetModuleFileNameExW CreateProcessW GetModuleHandleW LoadLibraryExW FindResourceW SizeofResource LoadResource VerSetConditionMask VerifyVersionInfoW OpenProcess GetCurrentProcessId GetStringTypeW GetVersionExW GetUserDefaultLocaleName IsValidCodePage SystemTimeToFileTime FileTimeToSystemTime GetCPInfoExW GetDiskFreeSpaceExW CreateFileW DeviceIoControl GetComputerNameW WriteConsoleW FormatMessageW GetLogicalProcessorInformation GetNativeSystemInfo GetSystemDirectoryW HeapFree HeapAlloc GetProcessHeap WaitForSingleObject CreateThread WaitForMultipleObjectsEx CreateEventExW WakeConditionVariable WakeAllConditionVariable SleepConditionVariableSRW CloseThreadpoolTimer SetThreadpoolTimer WaitForThreadpoolTimerCallbacks CreateThreadpoolTimer CloseThreadpoolWait SetThreadpoolWait WaitForThreadpoolWaitCallbacks CreateThreadpoolWait CreateThreadpoolWork SubmitThreadpoolWork ReleaseSemaphore WaitForSingleObjectEx QueryDepthSList TryEnterCriticalSection InitializeSListHead InterlockedPushEntrySList InterlockedPopEntrySList RtlCaptureStackBackTrace ReleaseMutex CreateMutexExW OpenMutexW GetTempPathW GetLongPathNameW ResetEvent QueryPerformanceCounter QueryPerformanceFrequency VirtualProtectEx GetSystemInfo GlobalFree GlobalAlloc ReadFile WriteFile GetFileSizeEx SetEndOfFile SetFilePointerEx GetOverlappedResult FlushFileBuffers CancelIoEx GetFileAttributesExW DeleteFileW CreateDirectoryW FindFirstFileExW FindNextFileW GetFileType GetTempFileNameW SetFileInformationByHandle GetFileInformationByHandleEx SignalObjectAndWait GetProcessAffinityMask GetLogicalProcessorInformationEx CreateWaitableTimerW SetWaitableTimerEx CancelWaitableTimer GetTickCount WerRegisterMemoryBlock WerUnregisterMemoryBlock QueryFullProcessImageNameW IsProcessorFeaturePresent CreateIoCompletionPort PostQueuedCompletionStatus GetThreadIOPendingFlag GetCurrentThread GetQueuedCompletionStatus IsDebuggerPresent WaitForMultipleObjects GetStartupInfoW CreateMemoryResourceNotification GetSystemPowerStatus IsSystemResumeAutomatic QueryUnbiasedInterruptTime OutputDebugStringW RtlCaptureContext GetModuleHandleA VirtualFree ExpandEnvironmentStringsW VirtualAlloc OpenEventA CreateEventA OpenMutexA CreateMutexA OpenSemaphoreA CreateSemaphoreA OpenFileMappingA ProcessIdToSessionId GetPriorityClass GetExitCodeProcess GetTimeZoneInformation IsValidLocale LCMapStringEx GetPhysicallyInstalledSystemMemory GetProductInfo SwitchToThread GetACP SetStdHandle HeapReAlloc EnumSystemLocalesW GetTimeFormatW GetDateFormatW ExitProcess GetStdHandle HeapSize GetConsoleCP GetConsoleMode UnregisterWaitEx VirtualProtect FreeLibraryAndExitThread GetThreadTimes UnregisterWait RegisterWaitForSingleObject SetThreadAffinityMask GetNumaHighestNodeNumber ChangeTimerQueueTimer GetThreadPriority SetThreadPriority CreateTimerQueue InterlockedFlushSList RtlUnwindEx SetUnhandledExceptionFilter UnhandledExceptionFilter VirtualQuery LoadLibraryExA GetLocalTime GetOEMCP RtlVirtualUnwind RtlLookupFunctionEntry GetLocaleInfoW CompareStringW GetCPInfo InitializeCriticalSectionAndSpinCount EncodePointer RtlPcToFileHeader DuplicateHandle DeleteTimerQueueTimer CreateTimerQueueTimer GetUserGeoID GetSystemDefaultLCID

ole32

CoRevokeInitializeSpy CLSIDFromString CoTaskMemFree CoCreateInstance CoSetProxyBlanket IIDFromString StringFromGUID2 CoCreateGuid CoInitializeEx CoUninitialize CreateStreamOnHGlobal CoCreateFreeThreadedMarshaler CoRegisterInitializeSpy CoTaskMemAlloc

Name

.text

Size

2.6MB

Virtual Size

2.6MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.1MB

Virtual Size

1.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

107KB

Virtual Size

108KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

122KB

Virtual Size

122KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.didat

Size

1024B

Virtual Size

792B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

83KB

Virtual Size

83KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

626KB

Virtual Size

628KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-05_211eb789d5f6ad7df097ff82fe108f54_icedid_njrat_vidar

gdi32

oleaut32

advapi32

kernel32

ole32

generic