2026-08-11_ab33d5927016b8ae34850cc2af4a4354_icedid_njrat_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-11_ab33d5927016b8ae34850cc2af4a4354_icedid_njrat_vidar
Size 1.4MB
Sample260811-3vsatafj6s
SHA256 bd70b74cf8824fb6285f9c92ad18edb8e0b282f4b4894a4008d62edaa88c8217
MD5 ab33d5927016b8ae34850cc2af4a4354
SHA1 e14473df8bee4a6d31d28dec15424a392dbd6ae8
SHA512 6e00164ff298bcf63c5f0cfb8864986349fe11da01947cd92ca22df68c4dba4c61aeef6fe1aa7c45e068ae22e38a4be76aa0c5eeeb3ecab93a5d99e1d607d9bb
SSDEEP 24576:UhKduElMEHnlr8/3nu+xXHFd9Wj3HghePjYyU:UhlElMy4LzH6QMPj9U
TLSH
T1EC65F116729050E4F77A8374CD51E156A7733C380B90A99FC23476755E322A3AD3BB2E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-11_ab33d5927016b8ae34850cc2af4a4354_icedid_njrat_vidar

File Explorer

2026-08-11_ab33d5927016b8ae34850cc2af4a4354_icedid_njrat_vidar

.exe 1.4MB

2026-08-11_ab33d5927016b8ae34850cc2af4a4354_icedid_njrat_vidar

IMPHASH c0905c5c6252b6dfd3b0465b09442cb8
SHA256 bd70b74cf8824fb6285f9c92ad18edb8e0b282f4b4894a4008d62edaa88c8217
MD5 ab33d5927016b8ae34850cc2af4a4354
SHA1 e14473df8bee4a6d31d28dec15424a392dbd6ae8
SHA512 6e00164ff298bcf63c5f0cfb8864986349fe11da01947cd92ca22df68c4dba4c61aeef6fe1aa7c45e068ae22e38a4be76aa0c5eeeb3ecab93a5d99e1d607d9bb
SSDEEP 24576:UhKduElMEHnlr8/3nu+xXHFd9Wj3HghePjYyU:UhlElMy4LzH6QMPj9U
TLSH
T1EC65F116729050E4F77A8374CD51E156A7733C380B90A99FC23476755E322A3AD3BB2E
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

41812

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\Recent\ATKRelation\Universal\AsLdrSrv\x64\Release\AsLdrSrv64.pdb

api-ms-win-core-synch-l1-1-0

EnterCriticalSection LeaveCriticalSection CreateEventW DeleteCriticalSection WaitForSingleObject CreateMutexW InitializeCriticalSection OpenMutexW ResetEvent OpenEventW InitializeCriticalSectionAndSpinCount SetEvent

api-ms-win-service-core-l1-1-0

RegisterServiceCtrlHandlerExW StartServiceCtrlDispatcherW SetServiceStatus

api-ms-win-core-processthreads-l1-1-0

TlsAlloc CreateProcessAsUserW TlsGetValue TlsSetValue TlsFree ResumeThread CreateProcessW GetCurrentProcess OpenProcessToken CreateThread GetCurrentProcessId TerminateProcess GetCurrentThreadId ExitProcess GetStartupInfoW SuspendThread

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-com-l1-1-0

CoInitializeEx CoCreateInstance CoUninitialize

api-ms-win-core-synch-l1-2-1

WaitForMultipleObjects

api-ms-win-core-io-l1-1-0

DeviceIoControl

api-ms-win-core-file-l1-1-0

ReadFile FindClose CreateFileW FlushFileBuffers SetFilePointerEx GetFileType WriteFile FindFirstFileExW FindNextFileW

api-ms-win-core-registry-l1-1-0

RegEnumKeyExW RegCloseKey RegOpenKeyExW RegQueryValueExW RegSetValueExW

api-ms-win-security-base-l1-1-0

AddAce InitializeAcl AllocateAndInitializeSid InitializeSecurityDescriptor IsValidSecurityDescriptor FreeSid DuplicateTokenEx SetTokenInformation AdjustTokenPrivileges AddAccessAllowedAce GetLengthSid SetSecurityDescriptorDacl

api-ms-win-core-namedpipe-l1-1-0

WaitNamedPipeW DisconnectNamedPipe ConnectNamedPipe CreateNamedPipeW

api-ms-win-core-sysinfo-l1-1-0

GetWindowsDirectoryW GetTickCount64 GetSystemTimeAsFileTime

api-ms-win-core-errorhandling-l1-1-0

RaiseException SetLastError SetUnhandledExceptionFilter UnhandledExceptionFilter GetLastError

api-ms-win-core-heap-l2-1-0

LocalFree LocalAlloc

api-ms-win-ntuser-sysparams-l1-1-0

GetSystemMetrics

api-ms-win-devices-config-l1-1-1

CM_Get_Device_Interface_ListW CM_Get_Device_ID_ListW CM_Get_DevNode_PropertyW CM_Get_Device_Interface_List_SizeW CM_Locate_DevNodeW CM_Get_Device_ID_List_SizeW

api-ms-win-mm-playsound-l1-1-0

PlaySoundW

api-ms-win-power-setting-l1-1-0

PowerSettingRegisterNotification PowerGetActiveScheme PowerSetActiveScheme PowerWriteDCValueIndex PowerWriteACValueIndex PowerSettingUnregisterNotification

api-ms-win-power-base-l1-1-0

GetPwrCapabilities

api-ms-win-security-lsalookup-l2-1-0

LookupPrivilegeValueW

api-ms-win-core-shutdown-l1-1-0

InitiateSystemShutdownExW

powrprof

SetSuspendState

api-ms-win-core-sysinfo-l1-2-0

GetSystemFirmwareTable

hid

HidD_GetPreparsedData HidD_FreePreparsedData HidD_GetHidGuid HidP_GetCaps

api-ms-win-core-heap-l1-1-0

HeapSize HeapAlloc HeapFree GetProcessHeap HeapReAlloc

api-ms-win-core-libraryloader-l1-2-1

LoadLibraryW

api-ms-win-core-libraryloader-l1-2-0

GetModuleFileNameW FreeLibrary GetModuleHandleExW GetProcAddress LoadLibraryExW GetModuleHandleW

userenv

CreateEnvironmentBlock DestroyEnvironmentBlock

api-ms-win-eventing-classicprovider-l1-1-0

GetTraceEnableLevel GetTraceEnableFlags RegisterTraceGuidsW UnregisterTraceGuids GetTraceLoggerHandle TraceMessage

api-ms-win-core-rtlsupport-l1-1-0

RtlPcToFileHeader RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind RtlUnwindEx

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

api-ms-win-core-debug-l1-1-0

IsDebuggerPresent

api-ms-win-core-util-l1-1-0

EncodePointer

api-ms-win-core-processenvironment-l1-1-0

GetCommandLineW FreeEnvironmentStringsW GetCommandLineA SetStdHandle GetEnvironmentStringsW GetStdHandle

api-ms-win-core-string-l1-1-0

MultiByteToWideChar WideCharToMultiByte GetStringTypeW

api-ms-win-core-localization-l1-2-0

GetOEMCP GetCPInfo GetACP IsValidCodePage LCMapStringW

api-ms-win-core-console-l1-1-0

GetConsoleCP GetConsoleMode WriteConsoleW

Name

.text

Size

111KB

Virtual Size

110KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

55KB

Virtual Size

55KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

7KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

25KB

Virtual Size

25KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

1.2MB

Virtual Size

1.9MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-11_ab33d5927016b8ae34850cc2af4a4354_icedid_njrat_vidar

api-ms-win-core-synch-l1-1-0

api-ms-win-service-core-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-com-l1-1-0

api-ms-win-core-synch-l1-2-1

api-ms-win-core-io-l1-1-0

api-ms-win-core-file-l1-1-0

api-ms-win-core-registry-l1-1-0

api-ms-win-security-base-l1-1-0

api-ms-win-core-namedpipe-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-heap-l2-1-0

api-ms-win-ntuser-sysparams-l1-1-0

api-ms-win-devices-config-l1-1-1

api-ms-win-mm-playsound-l1-1-0

api-ms-win-power-setting-l1-1-0

api-ms-win-power-base-l1-1-0

api-ms-win-security-lsalookup-l2-1-0

api-ms-win-core-shutdown-l1-1-0

powrprof

api-ms-win-core-sysinfo-l1-2-0

hid

api-ms-win-core-heap-l1-1-0

api-ms-win-core-libraryloader-l1-2-1

api-ms-win-core-libraryloader-l1-2-0

userenv

api-ms-win-eventing-classicprovider-l1-1-0

api-ms-win-core-rtlsupport-l1-1-0

api-ms-win-core-processthreads-l1-1-1

api-ms-win-core-profile-l1-1-0

api-ms-win-core-interlocked-l1-1-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-util-l1-1-0

api-ms-win-core-processenvironment-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-console-l1-1-0

generic