2026-08-23_549e0fded9b1a346830f3199abf0ef60_icedid_njrat_vidar

General

Target
2026-08-23_549e0fded9b1a346830f3199abf0ef60_icedid_njrat_vidar
Size 1.1MB
Sample260824-ntldjsfq4s
SHA256 a00693a1c5823b8c1f3dda2e236cce83428c0ecba108c7d6088cf01039c7a4e2
MD5 549e0fded9b1a346830f3199abf0ef60
SHA1 f600561562e2aa70a201b003008fc7a0362b4884
SHA512 686fb11e6d106f7a038657733912bafff66c6cf4ab07cc1d47453c7c7375573fb9d68ddae30b768bc8cad53a877b2568ee7721fc95761d8d373c7b1a8320c354
SSDEEP 24576:wz+YHKS0zOqDdhn0xPvU4M4KjZquqEIrvCxuB1T4Uj4eGC6W3Lj:wzXHl0q2dVEULR3g51MreOW3Lj
TLSH
T1CD451257737B20EDF0A2C231CE844A25EB7A36751775A6AB1B9443711E3BA805F39F20
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-23_549e0fded9b1a346830f3199abf0ef60_icedid_njrat_vidar

File Explorer

2026-08-23_549e0fded9b1a346830f3199abf0ef60_icedid_njrat_vidar

.exe 1.1MB

2026-08-23_549e0fded9b1a346830f3199abf0ef60_icedid_njrat_vidar

IMPHASH 3449974b35547c558f8a49f2ba63d988
SHA256 a00693a1c5823b8c1f3dda2e236cce83428c0ecba108c7d6088cf01039c7a4e2
MD5 549e0fded9b1a346830f3199abf0ef60
SHA1 f600561562e2aa70a201b003008fc7a0362b4884
SHA512 686fb11e6d106f7a038657733912bafff66c6cf4ab07cc1d47453c7c7375573fb9d68ddae30b768bc8cad53a877b2568ee7721fc95761d8d373c7b1a8320c354
SSDEEP 24576:wz+YHKS0zOqDdhn0xPvU4M4KjZquqEIrvCxuB1T4Uj4eGC6W3Lj:wzXHl0q2dVEULR3g51MreOW3Lj
TLSH
T1CD451257737B20EDF0A2C231CE844A25EB7A36751775A6AB1B9443711E3BA805F39F20
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

2

Major OS version

5

Entry point

46700

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

LoadLibraryW GetModuleFileNameW FreeLibrary LoadLibraryExW LocalFree GetCommandLineW HeapAlloc CreateMutexW OpenMutexW GetEnvironmentStringsW GetCommandLineA GetCPInfo GetOEMCP IsValidCodePage FindNextFileA FindFirstFileExA FindClose CloseHandle GetStringTypeW GetFileType VirtualAlloc GetProcAddress GetModuleHandleW GetProcessHeap Sleep HeapFree FreeEnvironmentStringsW LCMapStringW SetStdHandle HeapSize HeapReAlloc GetConsoleCP GetConsoleMode SetFilePointerEx FlushFileBuffers WriteConsoleW CreateFileW GetACP GetModuleHandleExW ExitProcess WideCharToMultiByte MultiByteToWideChar RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW RtlUnwindEx GetLastError SetLastError EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree RaiseException GetStdHandle WriteFile GetModuleFileNameA

advapi32

StartServiceCtrlDispatcherW CheckTokenMembership SetSecurityDescriptorDacl InitializeSecurityDescriptor FreeSid AllocateAndInitializeSid RegisterServiceCtrlHandlerExW SetServiceStatus

shell32

CommandLineToArgvW

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-23_549e0fded9b1a346830f3199abf0ef60_icedid_njrat_vidar

kernel32

advapi32

shell32

generic