2026-08-05_af3a088ca2376b572ed971bdafac9d38_icedid_njrat_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-05_af3a088ca2376b572ed971bdafac9d38_icedid_njrat_vidar
Size 1.6MB
Sample260805-j9danasgpf
SHA256 c48dffcffed2c87e8548865bcd3a3fdac3c0943cc0ed1ebe72738935d32b0283
MD5 af3a088ca2376b572ed971bdafac9d38
SHA1 7c46fb45bba41271bd98485abfa709e63a258571
SHA512 dd5769ada00cb00f92c66a925e8e014eec8a8222f078f191ea4acc524cd6c5b42a1177a3cd990eed11bbcf998c89a15e491584f8c599504c48a6565b7307ad18
SSDEEP 24576:+Oa9i6QwtFjJgcnQ/tbw/2Mkjy6Fr7g0o/:1EZFjJxQ/lFTjN4
TLSH
T16485E042779015FAE17BD27CC9524A42EAB278451720E78F07AC97BA1F233A05E7FB11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-05_af3a088ca2376b572ed971bdafac9d38_icedid_njrat_vidar

File Explorer

2026-08-05_af3a088ca2376b572ed971bdafac9d38_icedid_njrat_vidar

.exe 1.6MB

2026-08-05_af3a088ca2376b572ed971bdafac9d38_icedid_njrat_vidar

IMPHASH 798c7d62d04d0e3984e63ea1aab6153a
SHA256 c48dffcffed2c87e8548865bcd3a3fdac3c0943cc0ed1ebe72738935d32b0283
MD5 af3a088ca2376b572ed971bdafac9d38
SHA1 7c46fb45bba41271bd98485abfa709e63a258571
SHA512 dd5769ada00cb00f92c66a925e8e014eec8a8222f078f191ea4acc524cd6c5b42a1177a3cd990eed11bbcf998c89a15e491584f8c599504c48a6565b7307ad18
SSDEEP 24576:+Oa9i6QwtFjJgcnQ/tbw/2Mkjy6Fr7g0o/:1EZFjJxQ/lFTjN4
TLSH
T16485E042779015FAE17BD27CC9524A42EAB278451720E78F07AC97BA1F233A05E7FB11
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

35476

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\WORK\BASE_UTILITY_SVN_ROOT\R0YVU34W\src\tphkload\obj\AMD64\tphkload.pdb

kernel32

QueryFullProcessImageNameW WriteConsoleW GlobalFree GlobalAlloc OpenProcess SetLastError GetLongPathNameW lstrcmpiW LocalSize LocalReAlloc GetSystemFirmwareTable WTSGetActiveConsoleSessionId lstrlenW lstrcmpiA LocalFree LocalAlloc LoadLibraryW GetProcAddress GetModuleHandleW GetModuleFileNameW FreeLibrary IsWow64Process GetVersionExW GetTickCount GetExitCodeThread TerminateThread SetThreadPriority CreateThread GetExitCodeProcess TerminateProcess GetCurrentProcess WaitForMultipleObjects Sleep OpenEventW CreateEventW WaitForSingleObject CreateFileW ReadConsoleW ReadFile GetConsoleMode GetConsoleCP FlushFileBuffers HeapReAlloc HeapSize SetFilePointerEx GetFileSizeEx SetConsoleCtrlHandler GetProcessHeap LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW GetStringTypeW SetStdHandle SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW RtlUnwind WideCharToMultiByte MultiByteToWideChar GetCommandLineW GetCommandLineA GetCPInfo GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW FindClose OutputDebugStringW GetFileType GetCurrentThread HeapAlloc HeapFree SetEvent CreateNamedPipeW DisconnectNamedPipe ConnectNamedPipe GetLastError CloseHandle GetShortPathNameW GetModuleHandleExW ExitProcess WriteFile GetStdHandle RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW RtlUnwindEx InterlockedPushEntrySList InterlockedFlushSList EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW EncodePointer RaiseException RtlPcToFileHeader

advapi32

EqualSid OpenProcessToken AdjustTokenPrivileges DuplicateTokenEx ImpersonateLoggedOnUser RevertToSelf SetTokenInformation LookupPrivilegeValueW StartServiceW QueryServiceStatusEx EnumDependentServicesW ControlService OpenServiceW OpenSCManagerW DeleteService CloseServiceHandle RegNotifyChangeKeyValue GetTokenInformation GetLengthSid FreeSid CreateProcessAsUserW CreateWellKnownSid AllocateAndInitializeSid StartServiceCtrlDispatcherW SetServiceStatus RegisterServiceCtrlHandlerExW RegSetValueExW RegQueryValueExW RegQueryInfoKeyW RegOpenKeyExW RegEnumKeyExW RegCreateKeyExW RegCloseKey

user32

PostThreadMessageW PeekMessageW MsgWaitForMultipleObjects GetMessageW

wtsapi32

WTSEnumerateProcessesW WTSQueryUserToken WTSFreeMemory WTSQuerySessionInformationW WTSEnumerateSessionsW

shlwapi

PathFileExistsW PathCanonicalizeW StrCpyW PathFindFileNameW StrRChrW StrCmpIW PathRemoveFileSpecW PathAppendW

shell32

SHGetFolderPathW

userenv

UnloadUserProfile DestroyEnvironmentBlock LoadUserProfileW CreateEnvironmentBlock

ole32

CoUninitialize CoInitializeSecurity CoInitializeEx

setupapi

SetupDiGetClassDevsW SetupDiGetDeviceInstanceIdW SetupDiEnumDeviceInfo SetupDiDestroyDeviceInfoList CMP_WaitNoPendingInstallEvents CM_Locate_DevNodeW SetupDiGetDeviceRegistryPropertyW SetupDiRemoveDevice

wintrust

WinVerifyTrust

crypt32

CertEnumCertificatesInStore CertFindCertificateInStore CertFreeCertificateContext CertCompareCertificate CryptQueryObject CertCloseStore

psapi

EnumProcesses

msi

ord113

Name

.text

Size

333KB

Virtual Size

333KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

73KB

Virtual Size

72KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

7KB

Virtual Size

14KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

19KB

Virtual Size

19KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

1.2MB

Virtual Size

1.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-05_af3a088ca2376b572ed971bdafac9d38_icedid_njrat_vidar

kernel32

advapi32

user32

wtsapi32

shlwapi

shell32

userenv

ole32

setupapi

wintrust

crypt32

psapi

msi

generic