2026-08-22_a7cb4baf2ad31edafd2bfdaecbd0dabe_icedid_njrat_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-22_a7cb4baf2ad31edafd2bfdaecbd0dabe_icedid_njrat_vidar
Size 4.6MB
Sample260823-dl7ayascmg
SHA256 5d3fc9c97de84dbe6ab00c2c20541d26b0508f47acab97a3be6acab048f96982
MD5 a7cb4baf2ad31edafd2bfdaecbd0dabe
SHA1 b2df09461c6cd5ac8686f43e86d9451da169946c
SHA512 faa0be4e043af7355996b363b99c30bbe5c08145e4e133bf133619d30ae17d7093bd36480bd7119d5d93219597a135b31474c180016f271e1de208d909d6d067
SSDEEP 49152:1dRba8fD8qinfMSKJXIUQREV1QOTu1U5ai2wzYo5UC9RhuCTFKlaxV5dgbTggFIa:S/IJsiCwsop7cTtUf
TLSH
T146266C656BF880F5E1A7E134897AC9B2F77678020D71EB5F0251CA1F2F33A904D29726
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-22_a7cb4baf2ad31edafd2bfdaecbd0dabe_icedid_njrat_vidar

File Explorer

2026-08-22_a7cb4baf2ad31edafd2bfdaecbd0dabe_icedid_njrat_vidar

.exe 4.6MB

2026-08-22_a7cb4baf2ad31edafd2bfdaecbd0dabe_icedid_njrat_vidar

IMPHASH d3751ab33b3858f3b8b8d3275495baba
SHA256 5d3fc9c97de84dbe6ab00c2c20541d26b0508f47acab97a3be6acab048f96982
MD5 a7cb4baf2ad31edafd2bfdaecbd0dabe
SHA1 b2df09461c6cd5ac8686f43e86d9451da169946c
SHA512 faa0be4e043af7355996b363b99c30bbe5c08145e4e133bf133619d30ae17d7093bd36480bd7119d5d93219597a135b31474c180016f271e1de208d909d6d067
SSDEEP 49152:1dRba8fD8qinfMSKJXIUQREV1QOTu1U5ai2wzYo5UC9RhuCTFKlaxV5dgbTggFIa:S/IJsiCwsop7cTtUf
TLSH
T146266C656BF880F5E1A7E134897AC9B2F77678020D71EB5F0251CA1F2F33A904D29726
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2315552

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

d:\dbs\el\dec\target\x64\ship\click2run\x-none\IntegratedOffice.pdb

gdi32

GetDeviceCaps

oleaut32

SysFreeString VariantInit VariantClear SysAllocString

advapi32

RegCreateKeyExW RegCloseKey EventWriteTransfer EventRegister EventUnregister RegQueryValueExW RegOpenKeyExW RegEnumKeyExW RegQueryInfoKeyW RegEnumValueW RegDeleteTreeW RegDeleteKeyW RegGetValueW RegSetValueExW RegDeleteValueW GetTokenInformation IsValidSid GetSidSubAuthorityCount GetSidSubAuthority RegNotifyChangeKeyValue RevertToSelf EventWrite OpenThreadToken OpenProcessToken GetLengthSid CopySid InitializeAcl AddAccessAllowedAce AllocateAndInitializeSid FreeSid InitializeSecurityDescriptor SetSecurityDescriptorDacl GetSecurityDescriptorDacl ConvertStringSecurityDescriptorToSecurityDescriptorW ConvertSidToStringSidA CheckTokenMembership CreateWellKnownSid EqualSid

kernel32

GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetCurrentProcess GetLastError CompareStringEx IsWow64Process MultiByteToWideChar RaiseException InitializeCriticalSectionEx DeleteCriticalSection DecodePointer SetLastError DeactivateActCtx ActivateActCtx LoadLibraryW FindActCtxSectionStringW CreateActCtxW GetModuleFileNameW GetModuleHandleExW QueryActCtxW OutputDebugStringA LocalFree FindClose UnmapViewOfFile CloseHandle CreateFileMappingA MapViewOfFile Sleep GetStringTypeExW GetUserDefaultLCID LCMapStringW FreeLibrary GetSystemTimeAsFileTime GetCurrentThreadId FlsAlloc TlsAlloc FlsFree TlsFree FlsGetValue TlsGetValue FlsSetValue TlsSetValue GetTickCount64 GetProcAddress K32GetProcessMemoryInfo GlobalMemoryStatusEx LeaveCriticalSection EnterCriticalSection LocalAlloc WideCharToMultiByte CreateEventW SetEvent InitializeSRWLock ReleaseSRWLockShared AcquireSRWLockShared ReleaseSRWLockExclusive AcquireSRWLockExclusive GetProcessTimes TerminateProcess GetModuleFileNameA GetShortPathNameA K32GetModuleFileNameExW CreateProcessW GetModuleHandleW LoadLibraryExW FindResourceW SizeofResource LoadResource VerSetConditionMask VerifyVersionInfoW OpenProcess GetCurrentProcessId GetStringTypeW GetVersionExW GetUserDefaultLocaleName IsValidCodePage SystemTimeToFileTime FileTimeToSystemTime GetCPInfoExW GetDiskFreeSpaceExW CreateFileW DeviceIoControl GetComputerNameW WriteConsoleW FormatMessageW GetLogicalProcessorInformation GetNativeSystemInfo GetSystemDirectoryW HeapFree HeapAlloc GetProcessHeap WaitForSingleObject CreateThread WaitForMultipleObjectsEx CreateEventExW WakeConditionVariable WakeAllConditionVariable SleepConditionVariableSRW CloseThreadpoolTimer SetThreadpoolTimer WaitForThreadpoolTimerCallbacks CreateThreadpoolTimer CloseThreadpoolWait SetThreadpoolWait WaitForThreadpoolWaitCallbacks CreateThreadpoolWait CreateThreadpoolWork SubmitThreadpoolWork ReleaseSemaphore WaitForSingleObjectEx QueryDepthSList TryEnterCriticalSection InitializeSListHead InterlockedPushEntrySList InterlockedPopEntrySList RtlCaptureStackBackTrace ReleaseMutex CreateMutexExW OpenMutexW GetTempPathW GetLongPathNameW ResetEvent QueryPerformanceCounter QueryPerformanceFrequency VirtualProtectEx GetSystemInfo GlobalFree GlobalAlloc ReadFile WriteFile GetFileSizeEx SetEndOfFile SetFilePointerEx GetOverlappedResult FlushFileBuffers CancelIoEx GetFileAttributesExW DeleteFileW CreateDirectoryW FindFirstFileExW FindNextFileW GetFileType GetTempFileNameW SetFileInformationByHandle GetFileInformationByHandleEx SignalObjectAndWait GetProcessAffinityMask GetLogicalProcessorInformationEx CreateWaitableTimerW SetWaitableTimerEx CancelWaitableTimer GetTickCount WerRegisterMemoryBlock WerUnregisterMemoryBlock QueryFullProcessImageNameW IsProcessorFeaturePresent CreateIoCompletionPort PostQueuedCompletionStatus GetThreadIOPendingFlag GetCurrentThread GetQueuedCompletionStatus IsDebuggerPresent WaitForMultipleObjects GetStartupInfoW CreateMemoryResourceNotification GetSystemPowerStatus IsSystemResumeAutomatic QueryUnbiasedInterruptTime OutputDebugStringW RtlCaptureContext GetModuleHandleA VirtualFree ExpandEnvironmentStringsW VirtualAlloc OpenEventA CreateEventA OpenMutexA CreateMutexA OpenSemaphoreA CreateSemaphoreA OpenFileMappingA ProcessIdToSessionId GetPriorityClass GetExitCodeProcess GetTimeZoneInformation IsValidLocale LCMapStringEx GetPhysicallyInstalledSystemMemory GetProductInfo SwitchToThread GetACP SetStdHandle HeapReAlloc EnumSystemLocalesW GetTimeFormatW GetDateFormatW ExitProcess GetStdHandle HeapSize GetConsoleCP GetConsoleMode UnregisterWaitEx VirtualProtect FreeLibraryAndExitThread GetThreadTimes UnregisterWait RegisterWaitForSingleObject SetThreadAffinityMask GetNumaHighestNodeNumber ChangeTimerQueueTimer GetThreadPriority SetThreadPriority CreateTimerQueue InterlockedFlushSList RtlUnwindEx SetUnhandledExceptionFilter UnhandledExceptionFilter VirtualQuery LoadLibraryExA GetLocalTime GetOEMCP RtlVirtualUnwind RtlLookupFunctionEntry GetLocaleInfoW CompareStringW GetCPInfo InitializeCriticalSectionAndSpinCount EncodePointer RtlPcToFileHeader DuplicateHandle DeleteTimerQueueTimer CreateTimerQueueTimer GetUserGeoID GetSystemDefaultLCID

ole32

CoRevokeInitializeSpy CLSIDFromString CoTaskMemFree CoCreateInstance CoSetProxyBlanket IIDFromString StringFromGUID2 CoCreateGuid CoInitializeEx CoUninitialize CreateStreamOnHGlobal CoCreateFreeThreadedMarshaler CoRegisterInitializeSpy CoTaskMemAlloc

Name

.text

Size

2.6MB

Virtual Size

2.6MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.1MB

Virtual Size

1.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

107KB

Virtual Size

108KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

122KB

Virtual Size

122KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.didat

Size

1024B

Virtual Size

792B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

83KB

Virtual Size

83KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

604KB

Virtual Size

608KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-22_a7cb4baf2ad31edafd2bfdaecbd0dabe_icedid_njrat_vidar

gdi32

oleaut32

advapi32

kernel32

ole32

generic