2026-08-19_740f5e1efd6b0d452affb8ebf7370abd_icedid_njrat_vidar

General

Target
2026-08-19_740f5e1efd6b0d452affb8ebf7370abd_icedid_njrat_vidar
Size 2.2MB
Sample260820-ajftescj9w
SHA256 2332a5e15ee9802122e552226e691c664853983731f94947e57c4762845d275e
MD5 740f5e1efd6b0d452affb8ebf7370abd
SHA1 42d381407e3ecc33227b2041d0a43bdeaa18bae9
SHA512 d53b3168c25296f435167eeec2e19825be7c22c6d1990908bd361bb25db900a788e9db36f7ebacda5c4c56f6045016ac3ff05d99a1145a85583e71fc648db461
SSDEEP 12288:LgzfLAUYi1LRU3k9KJbR4w1mIHBz/9PPhKKX2E1:kjAe5RU0KZRBJH1pq
TLSH
T152A5CF74FA4416F8E6B7A23CC6455BA5E27774211F32D38B03D803AA2F63B50696FB11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-19_740f5e1efd6b0d452affb8ebf7370abd_icedid_njrat_vidar

File Explorer

2026-08-19_740f5e1efd6b0d452affb8ebf7370abd_icedid_njrat_vidar

.exe 2.2MB

2026-08-19_740f5e1efd6b0d452affb8ebf7370abd_icedid_njrat_vidar

IMPHASH aeecf9b284e8f3d1004c5119e9b09c03
SHA256 2332a5e15ee9802122e552226e691c664853983731f94947e57c4762845d275e
MD5 740f5e1efd6b0d452affb8ebf7370abd
SHA1 42d381407e3ecc33227b2041d0a43bdeaa18bae9
SHA512 d53b3168c25296f435167eeec2e19825be7c22c6d1990908bd361bb25db900a788e9db36f7ebacda5c4c56f6045016ac3ff05d99a1145a85583e71fc648db461
SSDEEP 12288:LgzfLAUYi1LRU3k9KJbR4w1mIHBz/9PPhKKX2E1:kjAe5RU0KZRBJH1pq
TLSH
T152A5CF74FA4416F8E6B7A23CC6455BA5E27774211F32D38B03D803AA2F63B50696FB11
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

16792

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

CreateDirectoryA HeapAlloc GetProcessHeap Sleep GetLocalTime CloseHandle HeapFree GetCurrentProcessId OpenProcess GetWindowsDirectoryW ReadProcessMemory GetModuleFileNameW LoadLibraryA MultiByteToWideChar WriteConsoleW QueryPerformanceCounter GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent GetModuleHandleW RtlUnwindEx InterlockedPushEntrySList InterlockedFlushSList GetLastError SetLastError EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary GetProcAddress LoadLibraryExW EncodePointer RaiseException RtlPcToFileHeader GetStdHandle WriteFile GetCurrentProcess ExitProcess TerminateProcess GetModuleHandleExW GetCommandLineA GetCommandLineW GetCurrentThread OutputDebugStringW FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle GetFileType GetStringTypeW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW SetConsoleCtrlHandler HeapSize HeapReAlloc FlushFileBuffers GetConsoleOutputCP GetConsoleMode GetFileSizeEx SetFilePointerEx ReadFile ReadConsoleW CreateFileW RtlUnwind

Name

.text

Size

312KB

Virtual Size

311KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

68KB

Virtual Size

68KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

1.8MB

Virtual Size

1.8MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

18KB

Virtual Size

17KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.gehcont

Size

512B

Virtual Size

24B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-19_740f5e1efd6b0d452affb8ebf7370abd_icedid_njrat_vidar

kernel32

generic