2026-09-25_94faeca750e0474091847aff93459231_icedid_njrat_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-25_94faeca750e0474091847aff93459231_icedid_njrat_vidar
Size 5.3MB
Sample260925-2k5bysyy5j
SHA256 91eb14d51199e7a25019ca32012942905568d87a8862a85041dcb5f14b9e20e3
MD5 94faeca750e0474091847aff93459231
SHA1 5116410cde04e90e0e9058a7c32b954c404743ed
SHA512 bc17a51a5e596800c9e5a96d46d93a9648705badc30411c6b296414c0658c135501df57f49a5a02a54a14579ddfb39b539147f2ec7bfd1104ec57ead272296dd
SSDEEP 49152:NTBFzA0dWNPQbrABOgxbW5tZhUsgtdH5qQRrLKcq60csOG3O7LhNlbaSvxwiKGgS:hpoP5+O7Lhj9qJqhJd9J2R4R0OFV
TLSH
T1C8467C4527EE0198E53BE17A8BB3C50BE67278904F3996EB0092825F0F376E19F75721
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-25_94faeca750e0474091847aff93459231_icedid_njrat_vidar

File Explorer

2026-09-25_94faeca750e0474091847aff93459231_icedid_njrat_vidar

.exe 5.3MB

2026-09-25_94faeca750e0474091847aff93459231_icedid_njrat_vidar

IMPHASH a7ac8be690120bc85d5c85b2edab268c
SHA256 91eb14d51199e7a25019ca32012942905568d87a8862a85041dcb5f14b9e20e3
MD5 94faeca750e0474091847aff93459231
SHA1 5116410cde04e90e0e9058a7c32b954c404743ed
SHA512 bc17a51a5e596800c9e5a96d46d93a9648705badc30411c6b296414c0658c135501df57f49a5a02a54a14579ddfb39b539147f2ec7bfd1104ec57ead272296dd
SSDEEP 49152:NTBFzA0dWNPQbrABOgxbW5tZhUsgtdH5qQRrLKcq60csOG3O7LhNlbaSvxwiKGgS:hpoP5+O7Lhj9qJqhJd9J2R4R0OFV
TLSH
T1C8467C4527EE0198E53BE17A8BB3C50BE67278904F3996EB0092825F0F376E19F75721
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2165424

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\jenkins\workspace\MainRel4_Dell\Consumer\MainRel4_Dell\Products\Release\x64\WavesSysSvc64.pdb

kernel32

SetEvent CreateEventW WideCharToMultiByte CloseHandle HeapAlloc DecodePointer RtlUnwind WaitForSingleObject ResetEvent EnterCriticalSection LeaveCriticalSection InitializeCriticalSection LocalAlloc LoadLibraryW FreeLibrary GetProcessHeap CreateTimerQueueTimer DeleteTimerQueueEx DeleteCriticalSection Sleep GetThreadId DeleteTimerQueueTimer CreateTimerQueue GetProcAddress LocalFree ConnectNamedPipe WaitNamedPipeW CreateIoCompletionPort GetSystemTime VerifyVersionInfoW GetCurrentProcess lstrlenW GetModuleHandleW ReadFile GetModuleHandleExW TerminateProcess GetModuleFileNameW K32GetModuleFileNameExW GetSystemPowerStatus CreateFileW OpenProcess CreateToolhelp32Snapshot ProcessIdToSessionId FormatMessageW Process32NextW Process32FirstW WTSGetActiveConsoleSessionId GetCurrentProcessId CreateProcessW QueryFullProcessImageNameW GetExitCodeProcess CreateThread SetDllDirectoryW WaitForMultipleObjects OpenEventW CreateMutexW GetSystemInfo K32EnumProcesses DeviceIoControl OpenFileMappingW UnmapViewOfFile CreateFileMappingW MapViewOfFile FindResourceW DeleteFileW CopyFileW FindFirstFileW FindNextFileW FindClose WriteFile IsDebuggerPresent SleepEx VerSetConditionMask GetOverlappedResult QueueUserAPC TerminateThread PostQueuedCompletionStatus PeekNamedPipe GetQueuedCompletionStatus CreateNamedPipeW CreateWaitableTimerW SetWaitableTimer GetFirmwareEnvironmentVariableExW CreateEventExW FormatMessageA GetPhysicallyInstalledSystemMemory GetFileTime MoveFileExW SetFileAttributesW GetFileAttributesW GetTempPathW RemoveDirectoryW LoadLibraryExA VirtualQuery LoadResource WriteConsoleW SetEndOfFile SetStdHandle SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP GetACP IsValidCodePage FindFirstFileExW ReadConsoleW GetFileAttributesExW GetConsoleMode GetConsoleOutputCP FlushFileBuffers EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetTimeFormatW GetDateFormatW FlsFree FlsSetValue FlsGetValue FlsAlloc SetFilePointerEx GetFileSizeEx GetTimeZoneInformation GetFileType GetStdHandle ExitProcess ExitThread GetCommandLineW GetCommandLineA RtlUnwindEx WaitForMultipleObjectsEx VirtualFree VirtualProtect VirtualAlloc GetVersionExW UnregisterWaitEx ReleaseSemaphore UnregisterWait RegisterWaitForSingleObject SetThreadAffinityMask GetProcessAffinityMask GetNumaHighestNodeNumber ChangeTimerQueueTimer GetLogicalProcessorInformation GetThreadPriority SetThreadPriority SignalObjectAndWait LoadLibraryExW GetModuleHandleA FreeLibraryAndExitThread GetThreadTimes QueryDepthSList InterlockedFlushSList InterlockedPushEntrySList InterlockedPopEntrySList FindResourceExW RaiseException HeapReAlloc LockResource LoadLibraryA GetCurrentThread OutputDebugStringW GetLastError GetTickCount64 MultiByteToWideChar HeapSize InitializeCriticalSectionEx HeapFree SizeofResource HeapDestroy CreateDirectoryW ReleaseMutex

user32

RegisterClassW GetClassInfoW EndDialog SendMessageW CreateWindowExW DefWindowProcW RegisterPowerSettingNotification DestroyWindow SendMessageTimeoutW IsWindow GetMessageW TranslateMessage DispatchMessageW RegisterWindowMessageW FindWindowExW PostMessageW SetTimer KillTimer UnregisterClassW ChangeWindowMessageFilterEx PostThreadMessageW UnregisterPowerSettingNotification MsgWaitForMultipleObjectsEx PeekMessageW

oleaut32

GetErrorInfo VariantClear VariantInit SetErrorInfo SysStringLen SysFreeString SysAllocStringLen SysAllocString VariantChangeType

ole32

CoInitializeEx CoTaskMemFree CoUninitialize CoInitialize CreateBindCtx CoCreateFreeThreadedMarshaler OleRun

api-ms-win-power-setting-l1-1-0

PowerGetActiveScheme PowerSetActiveScheme PowerWriteACValueIndex PowerWriteDCValueIndex

powrprof

PowerReadACValueIndex PowerReadDCValueIndex PowerReadFriendlyName

wtsapi32

WTSUnRegisterSessionNotification WTSQueryUserToken WTSRegisterSessionNotification

shell32

ShellExecuteExW SHCreateDirectoryExW SHGetKnownFolderPath SHGetSpecialFolderPathW ShellExecuteW

shlwapi

PathFileExistsW SHDeleteKeyW PathRemoveFileSpecW ord219

userenv

CreateEnvironmentBlock DestroyEnvironmentBlock

propsys

InitPropVariantFromStringVector InitPropVariantFromCLSID

netapi32

NetUserEnum NetApiBufferFree

api-ms-win-core-registry-l1-1-0

RegCloseKey RegGetKeySecurity RegEnumValueW RegQueryValueExW RegQueryValueExA RegOpenKeyExA RegNotifyChangeKeyValue RegDeleteValueW RegOpenKeyExW RegSetKeySecurity RegCreateKeyExW RegEnumKeyExW RegSetValueExW

api-ms-win-security-base-l1-1-0

GetAce IsValidSid SetSecurityDescriptorOwner AllocateAndInitializeSid RevertToSelf GetTokenInformation AddAce InitializeAcl CreateWellKnownSid GetSecurityDescriptorDacl InitializeSecurityDescriptor AddAccessAllowedAceEx GetAclInformation GetLengthSid SetSecurityDescriptorDacl AdjustTokenPrivileges ImpersonateLoggedOnUser FreeSid

api-ms-win-security-sddl-l1-1-0

ConvertStringSecurityDescriptorToSecurityDescriptorW ConvertSidToStringSidW ConvertStringSidToSidW

api-ms-win-core-processthreads-l1-1-0

GetStartupInfoW OpenProcessToken TlsFree TlsSetValue TlsGetValue TlsAlloc SwitchToThread GetCurrentThreadId GetExitCodeThread CreateProcessAsUserW SetThreadToken OpenThreadToken

api-ms-win-core-registry-l2-1-0

RegDeleteKeyW

api-ms-win-security-lsalookup-l2-1-0

LookupAccountSidW LookupPrivilegeValueW

api-ms-win-security-cryptoapi-l1-1-0

CryptReleaseContext CryptAcquireContextW CryptDecrypt CryptDeriveKey CryptDestroyHash CryptHashData CryptDestroyKey CryptCreateHash

api-ms-win-core-com-l1-1-0

CoCreateInstance StringFromCLSID CLSIDFromString CoSetProxyBlanket PropVariantClear CLSIDFromProgID CoCreateGuid

api-ms-win-security-provider-l1-1-0

GetNamedSecurityInfoW SetNamedSecurityInfoW SetEntriesInAclW

api-ms-win-service-management-l1-1-0

OpenSCManagerW

api-ms-win-service-core-l1-1-0

RegisterServiceCtrlHandlerExW

api-ms-win-core-synch-l1-1-0

TryEnterCriticalSection WaitForSingleObjectEx InitializeCriticalSectionAndSpinCount

api-ms-win-core-profile-l1-1-0

QueryPerformanceFrequency QueryPerformanceCounter

api-ms-win-core-handle-l1-1-0

DuplicateHandle

api-ms-win-core-rtlsupport-l1-1-0

RtlLookupFunctionEntry RtlPcToFileHeader RtlCaptureContext RtlVirtualUnwind

api-ms-win-core-util-l1-1-0

EncodePointer

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent

api-ms-win-core-threadpool-legacy-l1-1-0

QueueUserWorkItem

api-ms-win-core-errorhandling-l1-1-0

SetLastError SetUnhandledExceptionFilter UnhandledExceptionFilter

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime GetTickCount

api-ms-win-core-string-l1-1-0

GetStringTypeW CompareStringW

api-ms-win-core-localization-l1-2-0

GetCPInfo GetLocaleInfoW LCMapStringW

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

rtworkq

RtwqPutWorkItem RtwqCreateAsyncResult

avrt

AvSetMmThreadCharacteristicsW AvRevertMmThreadCharacteristics

advapi32

ControlService QueryServiceStatusEx GetUserNameW OpenServiceW CloseServiceHandle StartServiceCtrlDispatcherW StartServiceW DeleteService ChangeServiceConfig2W SetServiceStatus QueryServiceStatus CreateServiceW

setupapi

SetupDiGetDeviceRegistryPropertyA SetupDiGetClassDevsW SetupDiGetDeviceRegistryPropertyW SetupDiGetDeviceInstanceIdW SetupDiGetDevicePropertyW SetupDiGetDeviceInterfaceDetailW SetupDiEnumDeviceInterfaces SetupDiEnumDeviceInfo SetupDiDestroyDeviceInfoList

ws2_32

WSASetLastError shutdown WSAStartup WSARecv WSAGetLastError WSASend WSACleanup

crypt32

CertFreeCertificateContext

api-ms-win-core-version-l1-1-0

VerQueryValueW

api-ms-win-core-version-l1-1-1

GetFileVersionInfoW

api-ms-win-devices-config-l1-1-1

CM_Get_Parent CM_Get_Device_IDW

api-ms-win-core-string-l2-1-0

CharUpperW

api-ms-win-core-namedpipe-l1-1-0

ImpersonateNamedPipeClient

cfgmgr32

CM_Get_DevNode_Status_Ex

api-ms-win-mm-misc-l1-1-0

mmioCreateChunk mmioClose mmioSeek mmioSetInfo mmioAscend mmioWrite mmioOpenW mmioGetInfo mmioDescend mmioAdvance

version

GetFileVersionInfoSizeW

Name

.text

Size

2.7MB

Virtual Size

2.7MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

RT_CODE

Size

405KB

Virtual Size

405KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.3MB

Virtual Size

1.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

78KB

Virtual Size

116KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

108KB

Virtual Size

108KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.didat

Size

512B

Virtual Size

280B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gxfg

Size

14KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.gehcont

Size

512B

Virtual Size

36B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

123KB

Virtual Size

122KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

584KB

Virtual Size

588KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-25_94faeca750e0474091847aff93459231_icedid_njrat_vidar

kernel32

user32

oleaut32

ole32

api-ms-win-power-setting-l1-1-0

powrprof

wtsapi32

shell32

shlwapi

userenv

propsys

netapi32

api-ms-win-core-registry-l1-1-0

api-ms-win-security-base-l1-1-0

api-ms-win-security-sddl-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-registry-l2-1-0

api-ms-win-security-lsalookup-l2-1-0

api-ms-win-security-cryptoapi-l1-1-0

api-ms-win-core-com-l1-1-0

api-ms-win-security-provider-l1-1-0

api-ms-win-service-management-l1-1-0

api-ms-win-service-core-l1-1-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-rtlsupport-l1-1-0

api-ms-win-core-util-l1-1-0

api-ms-win-core-processthreads-l1-1-1

api-ms-win-core-threadpool-legacy-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-interlocked-l1-1-0

rtworkq

avrt

advapi32

setupapi

ws2_32

crypt32

api-ms-win-core-version-l1-1-0

api-ms-win-core-version-l1-1-1

api-ms-win-devices-config-l1-1-1

api-ms-win-core-string-l2-1-0

api-ms-win-core-namedpipe-l1-1-0

cfgmgr32

api-ms-win-mm-misc-l1-1-0

version

generic