2026-08-09_02f7f83a0928e2d98172f05758b69772_icedid_njrat_vidar

General

Target
2026-08-09_02f7f83a0928e2d98172f05758b69772_icedid_njrat_vidar
Size 223KB
Sample260809-hw97ssshkb
SHA256 5a7a3a4a87d2ff48c8997a4d3fd4961894b3f63ea29cb8cbcf0a6f77702d09b4
MD5 02f7f83a0928e2d98172f05758b69772
SHA1 4a61422e8b8de47792e4efe4ad33e448bf26c411
SHA512 e4650bc342ab836e43b05ddccee4e4a4afbae169942a1766bee0bd6473dbdb5fa140476ee74151a237f2ddf4556248b14d8bcdeb5f479a96a05ec00a4e5fd719
SSDEEP 3072:ekGYAuWbuMUPkWql9XmQHogVFO4sDEvio4uwaebbd5cQClGXGDCUY6+WSvm:ADXUcvX2SVFOR4JbkulGYT
TLSH
T163249E22ABA969F8D07A817484225B05E777BC310278EF2F526435571F373C29D3AF22
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-09_02f7f83a0928e2d98172f05758b69772_icedid_njrat_vidar

File Explorer

2026-08-09_02f7f83a0928e2d98172f05758b69772_icedid_njrat_vidar

.exe 223KB

2026-08-09_02f7f83a0928e2d98172f05758b69772_icedid_njrat_vidar

IMPHASH 0dd538c1aa2492eddb18e86a6af00a8b
SHA256 5a7a3a4a87d2ff48c8997a4d3fd4961894b3f63ea29cb8cbcf0a6f77702d09b4
MD5 02f7f83a0928e2d98172f05758b69772
SHA1 4a61422e8b8de47792e4efe4ad33e448bf26c411
SHA512 e4650bc342ab836e43b05ddccee4e4a4afbae169942a1766bee0bd6473dbdb5fa140476ee74151a237f2ddf4556248b14d8bcdeb5f479a96a05ec00a4e5fd719
SSDEEP 3072:ekGYAuWbuMUPkWql9XmQHogVFO4sDEvio4uwaebbd5cQClGXGDCUY6+WSvm:ADXUcvX2SVFOR4JbkulGYT
TLSH
T163249E22ABA969F8D07A817484225B05E777BC310278EF2F526435571F373C29D3AF22
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

202752

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

GetFileAttributesW CloseHandle GetLastError WaitForSingleObject GetExitCodeProcess CreateProcessW GetModuleFileNameW LoadResource LockResource SizeofResource FindResourceW LoadLibraryW WriteConsoleW CreateFileW GetConsoleMode GetConsoleOutputCP FlushFileBuffers HeapReAlloc HeapSize SetFilePointerEx RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW GetModuleHandleW RtlUnwindEx RtlPcToFileHeader RaiseException SetLastError EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary GetProcAddress LoadLibraryExW GetStdHandle WriteFile ExitProcess GetModuleHandleExW HeapFree HeapAlloc GetFileType FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle GetStringTypeW LCMapStringW GetProcessHeap

user32

wsprintfW MessageBoxW

shell32

ShellExecuteExW

shlwapi

PathCombineW PathRemoveFileSpecW PathCanonicalizeW

Name

.text

Size

63KB

Virtual Size

62KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

41KB

Virtual Size

41KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

71KB

Virtual Size

70KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

39KB

Virtual Size

90KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-09_02f7f83a0928e2d98172f05758b69772_icedid_njrat_vidar

kernel32

user32

shell32

shlwapi

generic