2026-09-07_fa128002a693afd944937d4555e14ef7_icedid_njrat_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-07_fa128002a693afd944937d4555e14ef7_icedid_njrat_vidar
Size 1.3MB
Sample260908-axf2caan5w
SHA256 ae25bef22fc2dba029261844397e8bc2116843a2d4fd1f8d71cc2bfe67479975
MD5 fa128002a693afd944937d4555e14ef7
SHA1 503ce87f523375dffed60f6d3c822f7183fc60f4
SHA512 ecf6597f9fafea77b14aa933333202c29d368815f69639e5176b92d783df6d3d16689d638c9c813ce7d180e4df6c223d9f720e79dd825046894e80f529574961
SSDEEP 24576:iesuhAzO+Qq5NxJtiB2rVyYx5QhYsxbswW4aEdhhEjDyX2kP:iesfOU55tiBcV5QhYsxbqFEj2KT
TLSH
T1F455C05937E501F5E577D23ACAA24696F9B278111B21D6CF03A002BA2F337904E7FB25
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-07_fa128002a693afd944937d4555e14ef7_icedid_njrat_vidar

File Explorer

2026-09-07_fa128002a693afd944937d4555e14ef7_icedid_njrat_vidar

.exe 1.3MB

2026-09-07_fa128002a693afd944937d4555e14ef7_icedid_njrat_vidar

IMPHASH db0dab94225fef23692c8e1575f38f1f
SHA256 ae25bef22fc2dba029261844397e8bc2116843a2d4fd1f8d71cc2bfe67479975
MD5 fa128002a693afd944937d4555e14ef7
SHA1 503ce87f523375dffed60f6d3c822f7183fc60f4
SHA512 ecf6597f9fafea77b14aa933333202c29d368815f69639e5176b92d783df6d3d16689d638c9c813ce7d180e4df6c223d9f720e79dd825046894e80f529574961
SSDEEP 24576:iesuhAzO+Qq5NxJtiB2rVyYx5QhYsxbswW4aEdhhEjDyX2kP:iesfOU55tiBcV5QhYsxbqFEj2KT
TLSH
T1F455C05937E501F5E577D23ACAA24696F9B278111B21D6CF03A002BA2F337904E7FB25
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

150868

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\SVN\BTDevManager_Merge\vs2017_BTDevManager\BTDevManager\bin\x64\Win10 Release\RtkBtManServ.pdb

api-ms-win-core-util-l1-1-0

DecodePointer EncodePointer

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-errorhandling-l1-1-0

SetLastError SetUnhandledExceptionFilter RaiseException UnhandledExceptionFilter GetLastError SetErrorMode

api-ms-win-core-heap-l1-1-0

HeapSize GetProcessHeap HeapReAlloc HeapDestroy HeapAlloc HeapFree

api-ms-win-core-synch-l1-1-0

DeleteCriticalSection OpenEventW InitializeCriticalSectionEx LeaveCriticalSection EnterCriticalSection InitializeCriticalSectionAndSpinCount InitializeCriticalSection SetEvent TryEnterCriticalSection CreateEventW CreateMutexW WaitForSingleObject ReleaseMutex TryAcquireSRWLockExclusive ResetEvent InitializeSRWLock ReleaseSRWLockExclusive AcquireSRWLockExclusive

api-ms-win-core-synch-l1-2-0

InitOnceExecuteOnce Sleep SleepConditionVariableCS WakeAllConditionVariable InitializeConditionVariable

api-ms-win-core-synch-l1-2-1

WaitForMultipleObjects

api-ms-win-core-processthreads-l1-1-0

ExitThread CreateThread TlsSetValue GetCurrentProcessId GetCurrentProcess GetStartupInfoW TlsGetValue TerminateProcess ResumeThread TlsAlloc GetCurrentThreadId GetExitCodeProcess ExitProcess OpenProcessToken SuspendThread GetCurrentThread CreateProcessAsUserW TlsFree

api-ms-win-core-libraryloader-l1-2-0

FreeLibraryAndExitThread GetModuleFileNameW LoadLibraryExW FindResourceExW GetProcAddress LoadResource GetModuleHandleW GetModuleHandleExW SizeofResource LockResource FreeLibrary

api-ms-win-core-libraryloader-l1-2-1

LoadLibraryW FindResourceW

api-ms-win-security-base-l1-1-0

DuplicateTokenEx InitializeSecurityDescriptor AdjustTokenPrivileges SetTokenInformation SetSecurityDescriptorDacl

api-ms-win-core-registry-l1-1-0

RegQueryValueExW RegEnumValueW RegSetValueExW RegQueryInfoKeyW RegDeleteValueW RegCloseKey RegOpenKeyExW RegNotifyChangeKeyValue RegCreateKeyExW

api-ms-win-devices-config-l1-1-1

CM_Locate_DevNodeW CM_Get_Device_Interface_PropertyW CM_Get_Device_Interface_List_SizeW CM_Get_Device_Interface_ListW CM_Get_DevNode_Status CM_Get_Device_ID_ListW CM_Get_Device_IDW CM_Get_Parent CM_Disable_DevNode CM_Enable_DevNode CM_MapCrToWin32Err CM_Unregister_Notification CM_Register_Notification CM_Get_Device_ID_List_SizeW

api-ms-win-core-file-l1-1-0

GetFileType SetFilePointerEx GetFileSize SetEndOfFile ReadFile CreateDirectoryW FindClose WriteFile FindFirstFileExW FindNextFileW DeleteFileW CreateFileW FlushFileBuffers

api-ms-win-core-file-l1-2-0

GetTempPathW

api-ms-win-core-debug-l1-1-0

OutputDebugStringW IsDebuggerPresent

api-ms-win-core-sysinfo-l1-1-0

GetLocalTime GetTickCount64 GetVersionExW GetSystemTimeAsFileTime GetSystemDirectoryW GetSystemInfo

api-ms-win-core-string-obsolete-l1-1-0

lstrlenW lstrcmpiW

api-ms-win-core-version-l1-1-1

GetFileVersionInfoSizeW GetFileVersionInfoW

api-ms-win-core-version-l1-1-0

VerQueryValueW

api-ms-win-service-management-l2-1-0

ChangeServiceConfig2W

api-ms-win-service-management-l1-1-0

DeleteService StartServiceW CloseServiceHandle OpenSCManagerW CreateServiceW OpenServiceW

api-ms-win-service-winsvc-l1-1-0

ControlService QueryServiceStatus

api-ms-win-service-core-l1-1-0

SetServiceStatus RegisterServiceCtrlHandlerExW StartServiceCtrlDispatcherW

ws2_32

WSACleanup WSAStartup

api-ms-win-shell-shdirectory-l1-1-0

ord290

ext-ms-win-shell32-shellfolders-l1-1-0

SHGetFolderPathW

api-ms-win-core-processthreads-l1-1-1

OpenProcess IsProcessorFeaturePresent

api-ms-win-core-kernel32-legacy-l1-1-0

WTSGetActiveConsoleSessionId

userenv

CreateEnvironmentBlock DestroyEnvironmentBlock

api-ms-win-core-toolhelp-l1-1-0

Process32FirstW CreateToolhelp32Snapshot Process32NextW

oleaut32

SysAllocStringLen

api-ms-win-core-heap-l2-1-0

GlobalAlloc LocalAlloc LocalFree GlobalFree

api-ms-win-core-processenvironment-l1-1-0

GetStdHandle ExpandEnvironmentStringsW GetEnvironmentStringsW FreeEnvironmentStringsW GetCommandLineA GetCommandLineW SetStdHandle SetEnvironmentVariableW

api-ms-win-core-memory-l1-1-0

ReadProcessMemory

api-ms-win-security-lsalookup-l2-1-0

LookupPrivilegeValueW

api-ms-win-core-io-l1-1-0

GetOverlappedResult DeviceIoControl

api-ms-win-core-namedpipe-l1-1-0

WaitNamedPipeW

api-ms-win-core-psapi-l1-1-0

K32GetModuleBaseNameW K32EnumProcesses K32EnumProcessModules

api-ms-win-core-heap-obsolete-l1-1-0

GlobalHandle GlobalLock GlobalUnlock

rpcrt4

RpcStringFreeW UuidToStringW

ext-ms-win-networking-wlanapi-l1-1-0

WlanQueryInterface WlanOpenHandle WlanFreeMemory WlanCloseHandle WlanEnumInterfaces

wlanapi

WlanIhvControl

shlwapi

PathRemoveFileSpecW

setupapi

SetupDiEnumDriverInfoW SetupDiGetDeviceInstallParamsW SetupDiDestroyDriverInfoList SetupDiCallClassInstaller SetupDiGetDeviceRegistryPropertyW SetupDiGetDriverInfoDetailW SetupDiSetDeviceInstallParamsW SetupDiSetClassInstallParamsW SetupDiEnumDeviceInterfaces SetupDiOpenDevRegKey SetupDiBuildDriverInfoList SetupDiGetClassDevsExW SetupDiGetClassDevsW SetupDiGetDeviceInterfaceDetailW SetupDiDestroyDeviceInfoList SetupDiEnumDeviceInfo

wtsapi32

WTSQueryUserToken

dbghelp

MiniDumpWriteDump

api-ms-win-core-profile-l1-1-0

QueryPerformanceFrequency QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-2-0

GetSystemTimePreciseAsFileTime

api-ms-win-core-localization-l1-2-0

GetLocaleInfoW LCMapStringW GetCPInfo FormatMessageW IsValidCodePage GetUserDefaultLCID GetOEMCP GetACP EnumSystemLocalesW IsValidLocale

api-ms-win-core-string-l1-1-0

GetStringTypeW WideCharToMultiByte MultiByteToWideChar CompareStringW

api-ms-win-core-rtlsupport-l1-1-0

RtlUnwindEx RtlUnwind RtlPcToFileHeader RtlCaptureContext RtlVirtualUnwind RtlLookupFunctionEntry

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead InterlockedPushEntrySList InterlockedFlushSList

api-ms-win-core-fibers-l1-1-0

FlsFree FlsSetValue FlsAlloc FlsGetValue

api-ms-win-core-datetime-l1-1-0

GetTimeFormatW GetDateFormatW

api-ms-win-core-console-l1-1-0

GetConsoleCP ReadConsoleW SetConsoleCtrlHandler GetConsoleMode WriteConsoleW

Name

.text

Size

533KB

Virtual Size

533KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

160KB

Virtual Size

160KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

18KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

27KB

Virtual Size

27KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

568KB

Virtual Size

572KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-07_fa128002a693afd944937d4555e14ef7_icedid_njrat_vidar

api-ms-win-core-util-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-synch-l1-2-1

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-libraryloader-l1-2-1

api-ms-win-security-base-l1-1-0

api-ms-win-core-registry-l1-1-0

api-ms-win-devices-config-l1-1-1

api-ms-win-core-file-l1-1-0

api-ms-win-core-file-l1-2-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-string-obsolete-l1-1-0

api-ms-win-core-version-l1-1-1

api-ms-win-core-version-l1-1-0

api-ms-win-service-management-l2-1-0

api-ms-win-service-management-l1-1-0

api-ms-win-service-winsvc-l1-1-0

api-ms-win-service-core-l1-1-0

ws2_32

api-ms-win-shell-shdirectory-l1-1-0

ext-ms-win-shell32-shellfolders-l1-1-0

api-ms-win-core-processthreads-l1-1-1

api-ms-win-core-kernel32-legacy-l1-1-0

userenv

api-ms-win-core-toolhelp-l1-1-0

oleaut32

api-ms-win-core-heap-l2-1-0

api-ms-win-core-processenvironment-l1-1-0

api-ms-win-core-memory-l1-1-0

api-ms-win-security-lsalookup-l2-1-0

api-ms-win-core-io-l1-1-0

api-ms-win-core-namedpipe-l1-1-0

api-ms-win-core-psapi-l1-1-0

api-ms-win-core-heap-obsolete-l1-1-0

rpcrt4

ext-ms-win-networking-wlanapi-l1-1-0

wlanapi

shlwapi

setupapi

wtsapi32

dbghelp

api-ms-win-core-profile-l1-1-0

api-ms-win-core-sysinfo-l1-2-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-rtlsupport-l1-1-0

api-ms-win-core-interlocked-l1-1-0

api-ms-win-core-fibers-l1-1-0

api-ms-win-core-datetime-l1-1-0

api-ms-win-core-console-l1-1-0

generic