2026-08-05_dbc5ce8d88f10e4995c73fad640a10fb_icedid_njrat_vidar

General

Target
2026-08-05_dbc5ce8d88f10e4995c73fad640a10fb_icedid_njrat_vidar
Size 802KB
Sample260805-mtwzlsej21
SHA256 823175992758d01aa5474730b694c755ac11b71bab45d2e79dea0d0ed71347f2
MD5 dbc5ce8d88f10e4995c73fad640a10fb
SHA1 b196669138cb754688967b3f02a0127824dd3118
SHA512 2f07a6e457f7d19b02ab3c3550efef27a6209b5c439522f4260875ebdb523d6682b783ead53a61c06b1707caef8573ab3f29d4878c36d9c5a1e3334b909c387b
SSDEEP 24576:vFUkIsj6GV0w7t2rR8FfBhRJUEbDk1ulUe:+GVxt2r4PRSEk1ul
TLSH
T10D05F14573A40CF5E6A785398597C236E7B2BC022B61DB1F1760C62B2F37261BD2DB60
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-05_dbc5ce8d88f10e4995c73fad640a10fb_icedid_njrat_vidar

File Explorer

2026-08-05_dbc5ce8d88f10e4995c73fad640a10fb_icedid_njrat_vidar

.exe 802KB

2026-08-05_dbc5ce8d88f10e4995c73fad640a10fb_icedid_njrat_vidar

IMPHASH 04202e97e9e0a8893128c71acb5c04f5
SHA256 823175992758d01aa5474730b694c755ac11b71bab45d2e79dea0d0ed71347f2
MD5 dbc5ce8d88f10e4995c73fad640a10fb
SHA1 b196669138cb754688967b3f02a0127824dd3118
SHA512 2f07a6e457f7d19b02ab3c3550efef27a6209b5c439522f4260875ebdb523d6682b783ead53a61c06b1707caef8573ab3f29d4878c36d9c5a1e3334b909c387b
SSDEEP 24576:vFUkIsj6GV0w7t2rR8FfBhRJUEbDk1ulUe:+GVxt2r4PRSEk1ul
TLSH
T10D05F14573A40CF5E6A785398597C236E7B2BC022B61DB1F1760C62B2F37261BD2DB60
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

6

Entry point

88960

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP IMAGE_FILE_NET_RUN_FROM_SWAP

PDB paths

d:\dbs\el\ar\target\x64\ship\delivery\x-none\ose.pdb

advapi32

RegOpenKeyExW RegEnumKeyExW RegCreateKeyExW RegCloseKey RegQueryValueExW RegEnumValueW SetThreadToken RegSetValueExW StartServiceCtrlDispatcherW SetServiceStatus RegNotifyChangeKeyValue DuplicateToken GetUserNameA RegDeleteValueW RegisterServiceCtrlHandlerW CryptGetHashParam CryptDestroyHash CryptHashData CryptCreateHash LookupAccountNameW ConvertStringSecurityDescriptorToSecurityDescriptorW CheckTokenMembership FreeSid AllocateAndInitializeSid GetTokenInformation OpenProcessToken CryptReleaseContext CryptAcquireContextW SetFileSecurityW RegDeleteKeyW OpenThreadToken

kernel32

GetModuleFileNameW GetLastError SetEvent CloseHandle GetLogicalDrives lstrlenW lstrcmpW GetDriveTypeW EnterCriticalSection LeaveCriticalSection InitializeCriticalSection Sleep DeleteCriticalSection ExitProcess GetCommandLineW SetErrorMode CreateMutexW WaitForMultipleObjectsEx ReleaseMutex CreateEventW GetSystemInfo ResetEvent MoveFileExW CreateProcessW GetModuleHandleW GetTickCount ReadFile SetFilePointer CreateFileW MultiByteToWideChar CreateFileA RaiseException GetProcAddress FreeLibrary WideCharToMultiByte DosDateTimeToFileTime LoadLibraryExW ReleaseSemaphore WaitForMultipleObjects WaitForSingleObject CreateThread CreateSemaphoreW VirtualFree VirtualAlloc GlobalAlloc GlobalFree SetFilePointerEx GetSystemTimeAsFileTime CompareStringW ExpandEnvironmentStringsW WriteFile SetFileTime SetEndOfFile SystemTimeToFileTime GetSystemTime LocalFree FindClose GetTempPathA CreateDirectoryW GetTempPathW GetFileAttributesW FindFirstFileW GetFileSizeEx QueryPerformanceCounter DeleteFileW GetTimeZoneInformation SystemTimeToTzSpecificLocalTime GetStdHandle lstrlenA FindNextFileW RemoveDirectoryW SetFileAttributesW GetCurrentProcess GetFileAttributesExW GetWindowsDirectoryW CopyFileW GetFileTime GetComputerNameW FormatMessageA GetCurrentThread HeapFree HeapSize HeapReAlloc HeapAlloc GetProcessHeap LoadLibraryExA VirtualQuery VirtualProtect WriteConsoleW FlushFileBuffers GetConsoleMode GetConsoleCP SetStdHandle LCMapStringW FreeEnvironmentStringsW GetEnvironmentStringsW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent GetCurrentProcessId GetCurrentThreadId InitializeSListHead IsDebuggerPresent GetStartupInfoW RtlUnwindEx SetLastError EncodePointer InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree RtlPcToFileHeader GetModuleFileNameA GetModuleHandleExW GetACP GetStringTypeW GetFileType FindFirstFileExA FindNextFileA IsValidCodePage GetOEMCP GetCPInfo GetCommandLineA

rpcrt4

RpcServerUseProtseqEpW RpcImpersonateClient NdrServerCall2 RpcRevertToSelf RpcServerUnregisterIf RpcServerRegisterIfEx

wintrust

WinVerifyTrust

Name

.text

Size

161KB

Virtual Size

160KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

58KB

Virtual Size

57KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

2KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

8KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.didat

Size

512B

Virtual Size

168B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

568KB

Virtual Size

572KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-05_dbc5ce8d88f10e4995c73fad640a10fb_icedid_njrat_vidar

advapi32

kernel32

rpcrt4

wintrust

generic