2026-08-10_9c47ed863c82c5e067b257c33369428c_icedid_njrat_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-10_9c47ed863c82c5e067b257c33369428c_icedid_njrat_vidar
Size 1.9MB
Sample260810-lymfaser8w
SHA256 1247430efaa27eb4db1040f1cad7853fb08709545f4cc5aa4729c68853ada514
MD5 9c47ed863c82c5e067b257c33369428c
SHA1 9b9d8d297d7e9c038fa3148d28b2c1aacd408e7d
SHA512 f762c493bd218163bbaf62b11e9137724e0b6c319e662701c2f72f521e6772f79879d7aab5c67f3fd5c7c0806f1fc04ed73bf755df2d67c5326888e6bbbb4e6d
SSDEEP 24576:t1KZrZKWYPfFL7q2n/K9Ri85qHVE2vsYbY5iIHLsaRMcYkVBcg25W5jn:+roW697q2nCHufvXbMLH1PcgD5jn
TLSH
T102950606FBF940E8E4B7D2759973612AA972BC558B309BCF0241A61E4F337D09D39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

2026-08-10_9c47ed863c82c5e067b257c33369428c_icedid_njrat_vidar

.exe 1.9MB

2026-08-10_9c47ed863c82c5e067b257c33369428c_icedid_njrat_vidar

IMPHASH 9fd5cd647f258da47645361f8b6f1d89
SHA256 1247430efaa27eb4db1040f1cad7853fb08709545f4cc5aa4729c68853ada514
MD5 9c47ed863c82c5e067b257c33369428c
SHA1 9b9d8d297d7e9c038fa3148d28b2c1aacd408e7d
SHA512 f762c493bd218163bbaf62b11e9137724e0b6c319e662701c2f72f521e6772f79879d7aab5c67f3fd5c7c0806f1fc04ed73bf755df2d67c5326888e6bbbb4e6d
SSDEEP 24576:t1KZrZKWYPfFL7q2n/K9Ri85qHVE2vsYbY5iIHLsaRMcYkVBcg25W5jn:+roW697q2nCHufvXbMLH1PcgD5jn
TLSH
T102950606FBF940E8E4B7D2759973612AA972BC558B309BCF0241A61E4F337D09D39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Digest

2e:7e:c4:5b:24:8c:98:61:88:a2:47:df:e8:85:3f:f8:1d:8f:2c:68:9e:ec:52:cc:1a:8e:fe:59:f2:10:0f:51

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=0108-01-003186,CN=Canon Inc.,O=Canon Inc.,L=Ota-Ku,ST=Tokyo,C=JP,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024a50

Chains

Mar 27, 2026

SERIALNUMBER=0108-01-003186,CN=Canon Inc.,O=Canon Inc.,L=Ota-Ku,ST=Tokyo,C=JP,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024a50

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

SERIALNUMBER=0108-01-003186,CN=Canon Inc.,O=Canon Inc.,L=Ota-Ku,ST=Tokyo,C=JP,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024a50

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

SERIALNUMBER=0108-01-003186,CN=Canon Inc.,O=Canon Inc.,L=Ota-Ku,ST=Tokyo,C=JP,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024a50

Serial Number

01:2e:31:1d:0f:e1:58:42:73:1a:e7:34:d7:aa:49:c1

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Sep 17, 2025 - Sep 16, 2026

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

775716

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\temp\Jenkins_tmp\WorkSpace\EP_SGMF\Project\EP_SGMF_mf61a\Build_SGMF\DEVINST\SgIstDrv\IstDrv___x64\Release_x64\ScanSetup.pdb

setupapi

CMP_WaitNoPendingInstallEvents CM_Reenumerate_DevNode CM_Locate_DevNodeW SetupDiClassGuidsFromNameW SetupDiGetDeviceRegistryPropertyW SetupDiOpenDevRegKey SetupDiCallClassInstaller SetupDiGetClassDevsW SetupDiGetDriverInfoDetailW SetupDiEnumDriverInfoW SetupDiBuildDriverInfoList SetupDiDestroyDeviceInfoList SetupDiEnumDeviceInfo SetupDiGetDeviceInstanceIdW

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

devconfig

ord7 ord6 ord5 ord9 ord2 ord1 ord4

kernel32

GetSystemTimeAsFileTime GetTickCount RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess GetACP OutputDebugStringA GetModuleHandleExW CreateActCtxW ActivateActCtx DeactivateActCtx FindActCtxSectionStringW QueryActCtxW EncodePointer FreeResource GlobalDeleteAtom GlobalAddAtomW GlobalFindAtomW FileTimeToLocalFileTime SystemTimeToTzSpecificLocalTime FileTimeToSystemTime SuspendThread ResumeThread GetCurrentThread lstrcmpA FlushFileBuffers GetFileSize GetFullPathNameW GetVolumeInformationW LockFile SetEndOfFile SetFilePointer QueryPerformanceCounter WriteFile DuplicateHandle TlsAlloc TlsGetValue TlsSetValue TlsFree GlobalReAlloc GlobalHandle LocalAlloc LocalReAlloc GlobalFlags GetSystemDefaultUILanguage GetFileAttributesExW GetFileSizeEx SetErrorMode GetUserDefaultLCID WaitForSingleObjectEx InitializeSListHead IsDebuggerPresent IsProcessorFeaturePresent GetLocaleInfoW ReadConsoleW GetConsoleMode GetFileType GetStdHandle HeapQueryInformation FreeLibraryAndExitThread ExitThread ExitProcess MoveFileExW GetCommandLineW GetCommandLineA RtlUnwindEx RtlPcToFileHeader GetCPInfo LCMapStringW SwitchToThread GetStringTypeW GetUserDefaultUILanguage LoadLibraryA GetTempPathA GetSystemInfo InitializeCriticalSectionEx HeapSize HeapReAlloc RaiseException DecodePointer GetCurrentThreadId InitializeCriticalSectionAndSpinCount lstrcpynA WaitForMultipleObjects CreateEventW ResetEvent SetEvent ReadFile CreateMutexW ReleaseMutex CreateDirectoryExW GetExitCodeThread CreateThread GetExitCodeProcess SearchPathW SetCurrentDirectoryW GetLocalTime OutputDebugStringW GetUserPreferredUILanguages GetPrivateProfileIntW FormatMessageW GlobalUnlock LoadLibraryExW GetVersionExW GetDiskFreeSpaceW CreateProcessW WaitForSingleObject MulDiv GetCurrentProcess Sleep RemoveDirectoryW FindNextFileW FindFirstFileW FindClose CreateDirectoryW ExpandEnvironmentStringsW LocalFree OpenMutexW DeleteCriticalSection LeaveCriticalSection EnterCriticalSection InitializeCriticalSection WideCharToMultiByte MultiByteToWideChar CompareStringW CopyFileW GetPrivateProfileSectionNamesW GetPrivateProfileSectionW WritePrivateProfileStringW GetPrivateProfileStringW lstrlenW lstrcatW lstrcpyW lstrcpynW lstrcmpiW lstrcmpW GlobalFree GlobalLock GlobalAlloc FindResourceW SizeofResource LockResource LoadResource GetModuleHandleW FreeLibrary GetWindowsDirectoryW GetSystemDirectoryA CreateProcessA GetProcessHeap HeapFree GetCurrentProcessId HeapAlloc SetLastError GetLastError GetTempPathW SetFileAttributesW GetTempFileNameW GetFileTime DeleteFileW CreateFileW LoadLibraryW GetProcAddress GetModuleHandleA GetSystemDirectoryW OpenProcess GetStartupInfoW CloseHandle FreeEnvironmentStringsW GetEnvironmentStringsW GetModuleFileNameW GetFileAttributesW GetDriveTypeW GetCurrentDirectoryW IsValidLocale EnumSystemLocalesW GetTimeZoneInformation FindFirstFileExW IsValidCodePage GetOEMCP SetEnvironmentVariableW SetStdHandle SetFilePointerEx GetConsoleCP WriteConsoleW UnlockFile

user32

RealChildWindowFromPoint GetSysColorBrush DestroyMenu CharUpperW SetCursor PostQuitMessage GetCursorPos GetMessageW TabbedTextOutW GrayStringW DrawTextExW GetNextDlgTabItem EndDialog CreateDialogIndirectParamW IsDialogMessageW SetDlgItemTextW GetMonitorInfoW MonitorFromWindow WinHelpW CallNextHookEx UnhookWindowsHookEx SetWindowsHookExW GetWindow GetTopWindow GetClassNameW GetClassLongPtrW SetWindowLongPtrW GetWindowLongPtrW SetWindowLongW PtInRect CopyRect MapWindowPoints AdjustWindowRectEx GetWindowTextLengthW RemovePropW GetPropW SetPropW EnableWindow MessageBoxW FindWindowW FindWindowA GetWindowThreadProcessId wsprintfW SendMessageW IsWindow ShowWindow InvalidateRect GetDC RedrawWindow GetSysColor TranslateMessage GetScrollPos ValidateRect GetForegroundWindow SetActiveWindow SetMenu GetMenu GetCapture GetKeyState GetDlgCtrlID IsWindowVisible EndDeferWindowPos DeferWindowPos BeginDeferWindowPos IsChild IsMenu GetClassInfoExW GetClassInfoW RegisterClassW CallWindowProcW GetMessageTime GetMessagePos RegisterWindowMessageW SetMenuItemInfoW IsWindowEnabled GetMenuCheckMarkDimensions SetMenuItemBitmaps CheckMenuItem GetFocus GetWindowLongW DispatchMessageW PeekMessageW ExitWindowsEx GetDlgItem DrawTextW SetWindowTextW GetClientRect GetSystemMetrics SetForegroundWindow ReleaseDC BeginPaint EndPaint GetWindowRect LoadBitmapW PostMessageW GetDesktopWindow LoadIconW DefWindowProcW UnregisterClassW RegisterClassExW CreateWindowExW DestroyWindow IsIconic GetActiveWindow UpdateWindow GetLastActivePopup LoadCursorW SetWindowPos GetWindowTextW ClientToScreen ScreenToClient SetFocus SetTimer GetMenuItemCount GetMenuItemID GetSubMenu OffsetRect SetRectEmpty SendDlgItemMessageA LoadStringW GetParent BringWindowToTop PostThreadMessageW EnableMenuItem GetSystemMenu KillTimer

gdi32

ScaleWindowExtEx ScaleViewportExtEx OffsetViewportOrgEx SetWindowExtEx SetViewportOrgEx SetViewportExtEx ExtTextOutW TextOutW CreateCompatibleBitmap BitBlt SetBrushOrgEx SetStretchBltMode StretchDIBits SelectObject CreateFontIndirectW CreateSolidBrush DeleteObject GetDeviceCaps GetStockObject GetObjectW CreatePalette RealizePalette SetMapMode SetBkMode SelectPalette SaveDC RestoreDC RectVisible PtVisible GetClipBox Escape DeleteDC SetTextColor SetBkColor CreateBitmap GetTextMetricsW GetTextExtentPoint32W CreateCompatibleDC

winspool.drv

AddPrinterDriverW GetPrinterDriverDirectoryW AddPrintProcessorW GetPrintProcessorDirectoryW ClosePrinter AddMonitorW EnumPrintersW EnumPrinterDriversW EnumPrintProcessorsW OpenPrinterW DocumentPropertiesW AddPrinterW EnumPortsW EnumMonitorsW

advapi32

LookupPrivilegeValueW DuplicateTokenEx RegCloseKey RegOpenKeyExW RegQueryValueW RegEnumKeyW RegDeleteValueW RegDeleteKeyW RegCreateKeyW RegQueryInfoKeyW RegEnumValueW RegEnumKeyExW RegCreateKeyExW OpenProcessToken AdjustTokenPrivileges QueryServiceStatus QueryServiceConfigW OpenServiceW OpenSCManagerW CloseServiceHandle RegUnLoadKeyW RegQueryValueExW RegOpenKeyW RegLoadKeyW RegGetValueW RegSetValueExW

shell32

ShellExecuteExW ShellExecuteW

comctl32

ImageList_SetBkColor InitCommonControlsEx ImageList_ReplaceIcon

shlwapi

StrToIntExW PathFindExtensionW PathFindFileNameW PathIsUNCW PathStripToRootW PathAddBackslashW

ole32

CoUninitialize CoCreateInstance CoInitialize CoCreateGuid CoInitializeEx CoTaskMemFree

oleaut32

VariantInit VariantClear VariantChangeType SysStringLen SysAllocString SysFreeString SysAllocStringLen

ws2_32

inet_ntop WSAResetEvent WSACreateEvent WSACloseEvent WSACleanup WSAStartup ntohl inet_pton

oleacc

LresultFromObject CreateStdAccessibleObject

??0CDeviceInf@@QEAA@XZ ??0CDeviceInfSection@@QEAA@AEBV0@@Z ??0CDeviceInfSection@@QEAA@XZ ??0CImageDriverInf@@QEAA@XZ ??0CIniSections@@QEAA@AEBV0@@Z ??0CIniSections@@QEAA@XZ ??0CManufacturers@@QEAA@AEBV0@@Z ??0CManufacturers@@QEAA@XZ ??0CPrinterDriverInf@@QEAA@XZ ??1CDeviceInf@@UEAA@XZ ??1CDeviceInfSection@@UEAA@XZ ??1CImageDriverInf@@UEAA@XZ ??1CIniSections@@UEAA@XZ ??1CManufacturers@@UEAA@XZ ??1CPrinterDriverInf@@UEAA@XZ ??4CDeviceInfSection@@QEAAAEAV0@AEBV0@@Z ??4CIniSections@@QEAAAEAV0@AEBV0@@Z ??4CManufacturers@@QEAAAEAV0@AEBV0@@Z ??_7CDeviceInf@@6B@ ??_7CDeviceInfSection@@6B@ ??_7CImageDriverInf@@6B@ ??_7CIniSections@@6B@ ??_7CManufacturers@@6B@ ??_7CPrinterDriverInf@@6B@ ?AddPrinterDriverW@CPrinterDriverInf@@IEAAHPEB_W000@Z ?AddPrinterW@CPrinterDriverInf@@IEAAHPEB_W0000@Z ?AllocAndGetDependentFiles@CPrinterDriverInf@@IEAAPEA_WPEB_W0000@Z ?AllocAndGetValue@CPrinterDriverInf@@IEAAPEA_WPEB_W00@Z ?AllocAndGetValueEx@CPrinterDriverInf@@IEAAPEA_WPEB_W0000@Z ?CheckPrintUITemp@CPrinterDriverInf@@QEAAHPEB_W0@Z ?Clear@CDeviceInf@@QEAAXXZ ?Clear@CDeviceInfSection@@QEAAXXZ ?Clear@CIniSections@@QEAAXXZ ?Clear@CManufacturers@@QEAAXXZ ?Count@CDeviceInfSection@@QEAAKXZ ?Count@CIniSections@@QEAAKXZ ?DeletePrinterDriverDirectoryFiles@CPrinterDriverInf@@QEAAXXZ ?DoInstall@CDeviceInf@@IEAAHPEB_W00@Z ?DoInstall@CPrinterDriverInf@@IEAAHPEB_W00@Z ?FindTempFile@CPrinterDriverInf@@AEAAHPEB_W0@Z ?GetDeviceId@CDeviceInf@@QEAAPEB_WK@Z ?GetDeviceIdCount@CDeviceInf@@QEAAKXZ ?GetDeviceIdList@CDeviceInf@@IEAAHXZ ?GetDriverDesc@CDeviceInf@@QEAAPEB_WKPEB_W@Z ?GetDriversCount@CDeviceInf@@QEAAKPEB_W@Z ?GetFilesFromCopyFilesSection@CPrinterDriverInf@@IEAAHPEB_W0AEAV?$vector@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@V?$allocator@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@2@@std@@@Z ?GetInstallSection@CDeviceInf@@IEAAKPEB_W0KPEAV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@1@Z ?GetInstallSection@CDeviceInf@@IEAAKPEB_WHPEA_WPEAK12PEAV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z ?GetItem@CIniSections@@QEAAPEB_WK@Z ?GetKey@CDeviceInfSection@@QEAAPEB_WK@Z ?GetList@CDeviceInfSection@@QEAAHXZ ?GetList@CIniSections@@QEAAHXZ ?GetList@CManufacturers@@QEAAHH@Z ?GetMfg@CDeviceInf@@QEAAPEB_WK@Z ?GetMfgCount@CDeviceInf@@QEAAKXZ ?GetModelsSeed@CManufacturers@@QEAAPEB_WK@Z ?GetPrinterDriverDir@CPrinterDriverInf@@AEAAXPEA_W@Z ?GetPrinterDriverDirectoryFiles@CPrinterDriverInf@@QEAAXXZ ?GetSuitableDriverName@CDeviceInf@@QEAAKPEB_WHPEA_WPEAK@Z ?GetValue@CDeviceInfSection@@QEAAPEB_WK@Z ?HELPER_AbbreviationInControl@@YAHPEAUHWND__@@00PEB_W@Z ?HELPER_DynamicControlPositioning@@YAHPEAUHWND__@@K@Z ?HELPER_GetDefaultGUIFont@@YAHPEAUtagLOGFONTW@@@Z ?HELPER_HasValidIPAddress@@YAHXZ ?HELPER_IsExistPrinterDriver@@YAHPEB_W0@Z ?HasSuitableDriver@CDeviceInf@@QEAAKPEB_W0@Z ?Init@CDeviceInf@@QEAAHPEB_WHH@Z ?Init@CDeviceInfSection@@QEAAHPEB_WPEAVCInfStringTable@@0@Z ?Init@CImageDriverInf@@QEAAHPEB_WH@Z ?Init@CIniSections@@QEAAHPEB_W@Z ?Init@CManufacturers@@QEAAHPEB_WPEAVCInfStringTable@@0@Z ?Init@CPrinterDriverInf@@QEAAHPEB_WHH@Z ?InstallDriver@CDeviceInf@@QEAAHPEB_W0K@Z ?InstallDriver@CDeviceInf@@QEAAHPEB_WH@Z ?InstallDriver@CPrinterDriverInf@@QEAAHPEB_W0K@Z ?InstallDriver@CPrinterDriverInf@@QEAAHPEB_WH@Z ?InstallPrinter@CPrinterDriverInf@@QEAAHPEB_W0K000@Z ?InstallPrinter@CPrinterDriverInf@@QEAAHPEB_WH000@Z ?InstallPrinterPrintUI@CPrinterDriverInf@@QEAAHPEB_W00000H@Z ?IsComment@CDeviceInfSection@@IEAAHPEB_W@Z ?MySetupCopyOEMInf@CPrinterDriverInf@@QEAAHPEB_W0KKPEA_WKPEAKPEAPEA_W@Z ?SetAltProgress@CDeviceInf@@QEAAXPEAUHWND__@@I@Z ?SetColorProfile@CPrinterDriverInf@@IEAAHPEB_W0@Z ?SetDirectoryId@CDeviceInf@@MEAAHPEAXPEB_W1@Z ?SetDirectoryId@CPrinterDriverInf@@MEAAHPEAXPEB_W1@Z ?SetOwner@CDeviceInf@@QEAAXPEAUHWND__@@@Z

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-10_9c47ed863c82c5e067b257c33369428c_icedid_njrat_vidar

setupapi

version

devconfig

kernel32

user32

gdi32

winspool.drv

advapi32

shell32

comctl32

shlwapi

ole32

oleaut32

ws2_32

oleacc

generic