2026-08-25_fdb3896c14101debd8c3faa1d987b4f6_icedid_njrat_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-25_fdb3896c14101debd8c3faa1d987b4f6_icedid_njrat_vidar
Size 1.4MB
Sample260826-ae6jaabc34
SHA256 71ac416daacbe0a2f4a08e25dba90645d69604b53538e3e7b34296fa4cb42dad
MD5 fdb3896c14101debd8c3faa1d987b4f6
SHA1 8d627b5adae4eb5f0b2c6397eb7a29b51fcd8341
SHA512 c041c7c3133d4993d007bf1d6d7272add4b7aea2eb6a3304758d5283d9c74a16d1f5468b83abac31cc448e3c492cae6798b1d69c3f8d1a7c61911d7b0b3dd239
SSDEEP 24576:4qEWLF/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:GWLFLNiXicJFFRGNzj3
TLSH
T18D65F04BBAA910F1D5BBC038C9922529F4B1386947309BCB5351562F9F33BE4AE3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-25_fdb3896c14101debd8c3faa1d987b4f6_icedid_njrat_vidar

File Explorer

2026-08-25_fdb3896c14101debd8c3faa1d987b4f6_icedid_njrat_vidar

.exe 1.4MB

2026-08-25_fdb3896c14101debd8c3faa1d987b4f6_icedid_njrat_vidar

IMPHASH 3a44a7393fa3ba86bc22b6b1dbd678bb
SHA256 71ac416daacbe0a2f4a08e25dba90645d69604b53538e3e7b34296fa4cb42dad
MD5 fdb3896c14101debd8c3faa1d987b4f6
SHA1 8d627b5adae4eb5f0b2c6397eb7a29b51fcd8341
SHA512 c041c7c3133d4993d007bf1d6d7272add4b7aea2eb6a3304758d5283d9c74a16d1f5468b83abac31cc448e3c492cae6798b1d69c3f8d1a7c61911d7b0b3dd239
SSDEEP 24576:4qEWLF/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:GWLFLNiXicJFFRGNzj3
TLSH
T18D65F04BBAA910F1D5BBC038C9922529F4B1386947309BCB5351562F9F33BE4AE3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

65072

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

H:\AWork\UserInfoCollect\x64\Release\AliyunWrapExe.pdb

kernel32

FlushFileBuffers GetConsoleCP HeapSize HeapReAlloc SetFilePointerEx WriteConsoleW GetConsoleMode GetProcessHeap ReleaseMutex GetSystemTimeAsFileTime WaitForMultipleObjects SetCurrentDirectoryW CreateFileW CloseHandle GetModuleFileNameW GetPrivateProfileStringW WritePrivateProfileStringW DeleteFileW ReadFile WriteFile SetEvent WaitForSingleObject OpenEventW CreateEventW GetLastError CreateMutexW GetCurrentProcess TerminateProcess GetFileAttributesW GetPrivateProfileIntW GetLocalTime GlobalMemoryStatusEx RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId InitializeSListHead IsDebuggerPresent GetStartupInfoW GetModuleHandleW RtlUnwindEx RtlPcToFileHeader RaiseException SetLastError EncodePointer EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary GetProcAddress LoadLibraryExW GetStdHandle MultiByteToWideChar WideCharToMultiByte ExitProcess GetModuleHandleExW GetACP HeapFree HeapAlloc GetFileType GetStringTypeW LCMapStringW FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle

aliyunwrap

?SendLogToCloud@@YA_NAEBV?$vector@U?$pair@PEA_WPEA_W@std@@V?$allocator@U?$pair@PEA_WPEA_W@std@@@2@@std@@@Z

urlmon

URLDownloadToFileW

wininet

DeleteUrlCacheEntryW

iphlpapi

GetAdaptersInfo

rpcrt4

UuidCreate

advapi32

SetSecurityDescriptorDacl RegCloseKey GetSidSubAuthorityCount GetSidSubAuthority IsValidSid GetUserNameW RegOpenKeyW RegQueryValueExW LookupAccountNameW GetSidIdentifierAuthority InitializeSecurityDescriptor

Name

.text

Size

133KB

Virtual Size

133KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

58KB

Virtual Size

58KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

10KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

1.2MB

Virtual Size

1.9MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-25_fdb3896c14101debd8c3faa1d987b4f6_icedid_njrat_vidar

kernel32

aliyunwrap

urlmon

wininet

iphlpapi

rpcrt4

advapi32

generic