2026-08-09_8fc6b44ad61302998121bb1cc5cf60e2_icedid_njrat_remcos_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-09_8fc6b44ad61302998121bb1cc5cf60e2_icedid_njrat_remcos_vidar
Size 3.3MB
Sample260809-rcplesygqc
SHA256 2147f4b3c8900add7faaa7facbebeb44333a0063f3c9b6e5f4776c964d03f4be
MD5 8fc6b44ad61302998121bb1cc5cf60e2
SHA1 95ceb19c1a622519363c30db840ac1cb71e7fce3
SHA512 a2daf6d06ca5fb090407804007ec219b25f72473b7aa4e9e8e84d8502fa1299d2119cc667ab8d9a8a7e24f2702f64f85ff356d6da189c531490492cde5338eb6
SSDEEP 98304:uxps2TacJFqJVOFDiZmLlGgIZ+SuIsrGGMnI:9LcJFFDiZmcgIZHF
TLSH
T1FCF5015BAB6801F5D837D235C5A29A46E3F13C2E2A70838B02E1762F7F379914D79721
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-09_8fc6b44ad61302998121bb1cc5cf60e2_icedid_njrat_remcos_vidar

File Explorer

2026-08-09_8fc6b44ad61302998121bb1cc5cf60e2_icedid_njrat_remcos_vidar

.exe 3.3MB

2026-08-09_8fc6b44ad61302998121bb1cc5cf60e2_icedid_njrat_remcos_vidar

IMPHASH a69316629ae726384e58502b3692d472
SHA256 2147f4b3c8900add7faaa7facbebeb44333a0063f3c9b6e5f4776c964d03f4be
MD5 8fc6b44ad61302998121bb1cc5cf60e2
SHA1 95ceb19c1a622519363c30db840ac1cb71e7fce3
SHA512 a2daf6d06ca5fb090407804007ec219b25f72473b7aa4e9e8e84d8502fa1299d2119cc667ab8d9a8a7e24f2702f64f85ff356d6da189c531490492cde5338eb6
SSDEEP 98304:uxps2TacJFqJVOFDiZmLlGgIZ+SuIsrGGMnI:9LcJFFDiZmcgIZHF
TLSH
T1FCF5015BAB6801F5D837D235C5A29A46E3F13C2E2A70838B02E1762F7F379914D79721
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

428208

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\work\qnInstall\sln\x64\Release\uninstall.pdb

kernel32

GetCurrentProcess GetEnvironmentVariableA CreateFileW WriteFile SetLastError MultiByteToWideChar MulDiv Sleep GetModuleHandleW GetPrivateProfileStringW WaitForSingleObject SetFileAttributesW MoveFileW MoveFileExW FindFirstFileW FindNextFileW FindClose RemoveDirectoryW GetFileAttributesW TerminateThread GetProcAddress CreateProcessW GlobalAlloc GlobalLock GlobalUnlock CreateEventW IsDebuggerPresent OutputDebugStringW EncodePointer InitializeSListHead InterlockedPopEntrySList InterlockedPushEntrySList FlushInstructionCache VirtualAlloc VirtualFree LoadLibraryExA SetEndOfFile WriteConsoleW SetStdHandle SetEnvironmentVariableA FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP IsValidCodePage FindFirstFileExW GetTimeZoneInformation TerminateProcess CreateDirectoryW ReadConsoleW SetFilePointerEx ReadFile FlushFileBuffers GetConsoleMode GetConsoleCP EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetTimeFormatW GetDateFormatW GetFileType GetACP GetStdHandle ExitProcess GetModuleHandleExW FreeLibraryAndExitThread ExitThread CreateThread LoadLibraryExW FreeLibrary RtlPcToFileHeader RtlUnwindEx GetCurrentProcessId QueryPerformanceCounter GetStartupInfoW IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext WaitForSingleObjectEx ResetEvent SetEvent GetLocaleInfoW LCMapStringW CompareStringW OpenProcess GetCurrentThreadId GetDateFormatA GetTimeFormatA GetTickCount LeaveCriticalSection InitializeCriticalSection GetFileAttributesA EnterCriticalSection DeleteFileW CloseHandle GetCPInfo GetSystemTimeAsFileTime TlsFree TlsSetValue TlsGetValue TlsAlloc SwitchToThread GetStringTypeW GetModuleFileNameW WideCharToMultiByte GetVersionExW FindResourceExW FreeResource RtlUnwind LockResource LoadResource SizeofResource FindResourceW GetProcessHeap DeleteCriticalSection HeapDestroy DecodePointer HeapAlloc RaiseException HeapReAlloc GetLastError HeapSize InitializeCriticalSectionAndSpinCount HeapFree

user32

DestroyWindow GetActiveWindow GetDesktopWindow IsWindowEnabled EnableWindow SetWindowPos MapWindowPoints GetClientRect GetParent GetWindowRect GetMonitorInfoW MonitorFromWindow GetWindowLongW GetWindow SetActiveWindow RegisterClassExW GetClassInfoExW LoadCursorW CreateWindowExW PeekMessageW ShowWindow TranslateMessage DispatchMessageW SetWindowLongPtrW GetDC ReleaseDC KillTimer SetTimer SetWindowTextW DefWindowProcW SetWindowLongW LoadIconW PostThreadMessageW GetWindowLongPtrW CallWindowProcW ScreenToClient UpdateLayeredWindow GetKeyState GetFocus SetFocus SetCursor SendMessageW MoveWindow IsWindow UnregisterClassW GetMessageW PostMessageW ClientToScreen OffsetRect NotifyWinEvent PtInRect InvalidateRect ReleaseCapture SetCapture GetDlgItem GetWindowTextLengthW GetWindowTextW

advapi32

OpenProcessToken AdjustTokenPrivileges RegCloseKey RegCreateKeyExW RegSetValueExW RegOpenKeyExW RegDeleteKeyW RegEnumKeyExW RegDeleteValueW LookupPrivilegeValueW

ole32

CoCreateInstance CoUninitialize CoInitializeEx CreateStreamOnHGlobal

shell32

SHChangeNotify ShellExecuteW SHGetFolderPathW SHGetSpecialFolderPathW SHCreateDirectoryExW SHGetSpecialFolderPathA

oleaut32

VariantInit SysAllocString

shlwapi

PathAddBackslashW PathRemoveFileSpecW StrToIntA StrCmpW PathFileExistsW

gdi32

RectInRegion CreateSolidBrush CreateFontW StretchBlt BitBlt SetBkMode SetStretchBltMode GetObjectW CreateRectRgnIndirect GetDeviceCaps DeleteObject DeleteDC SelectClipRgn CreateCompatibleDC CreateDIBSection SetTextColor CombineRgn SelectObject

comctl32

_TrackMouseEvent

gdiplus

GdipFree GdipAlloc GdipCloneImage GdipDisposeImage GdipImageGetFrameDimensionsCount GdiplusStartup GdipCreateFromHDC GdipDeleteGraphics GdipLoadImageFromStream GdipImageGetFrameDimensionsList GdipResetClip GdipSetClipHrgn GdipDrawString GdipSetTextRenderingHint GdipSetSmoothingMode GdipSetStringFormatTrimming GdipSetStringFormatFlags GdipSetStringFormatLineAlign GdipSetStringFormatAlign GdipDeleteStringFormat GdipCreateStringFormat GdipDeleteFont GdipCreateFontFamilyFromName GdipDeleteFontFamily GdipGetGenericFontFamilySansSerif GdipCreateFont GdipDrawRectangleI GdipDeletePen GdipCreatePen1 GdipFillRectangleI GdipDeleteBrush GdipCreateSolidFill GdipSetImageAttributesWrapMode GdipDrawImageRectRectI GdipGetImageGraphicsContext GdipCreateBitmapFromScan0 GdipSetImageAttributesColorMatrix GdipDisposeImageAttributes GdipCreateImageAttributes GdipGetImageHeight GdipGetImageWidth GdipImageSelectActiveFrame GdipGetPropertyItem GdipGetPropertyItemSize GdipImageGetFrameCount

psapi

GetModuleFileNameExW EnumProcesses

oleacc

LresultFromObject

Name

.text

Size

611KB

Virtual Size

610KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

221KB

Virtual Size

220KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

18KB

Virtual Size

25KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

26KB

Virtual Size

26KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1.9MB

Virtual Size

1.9MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

572KB

Virtual Size

576KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-09_8fc6b44ad61302998121bb1cc5cf60e2_icedid_njrat_remcos_vidar

kernel32

user32

advapi32

ole32

shell32

oleaut32

shlwapi

gdi32

comctl32

gdiplus

psapi

oleacc

generic