2026-09-25_87508f7a40b19c0382b69423808304a2_icedid_njrat_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-25_87508f7a40b19c0382b69423808304a2_icedid_njrat_vidar
Size 4.7MB
Sample260925-3d3p8a1zas
SHA256 ff3d7c66064928c3933fc6ce9ab7f7d8765701fddb0e0cc06843d6a2fdce774a
MD5 87508f7a40b19c0382b69423808304a2
SHA1 bdd362c79fef88fe95a52e637360e226a2568525
SHA512 4ee011299ef3b77d0f5352da48df76ddcb5c87b71eaa7e9342d1143b6386c711b64263956adcdec592d5662b5ed4c93422acb53c6e33f8c69c29fa7b588e4396
SSDEEP 49152:mdRba8fD8qinfMSKJXIUQREV1QOTu1U5ai2fzYo5UC9RhuCTFKlaxV5dgbT0xhoX:5/IJsiCfsop7cT0xhAO
TLSH
T10C366C656BF880F5E1A7E138897AC9B2F77678020D31DB5F0251CA1F2F33A905D29726
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-25_87508f7a40b19c0382b69423808304a2_icedid_njrat_vidar

File Explorer

2026-09-25_87508f7a40b19c0382b69423808304a2_icedid_njrat_vidar

.exe 4.7MB

2026-09-25_87508f7a40b19c0382b69423808304a2_icedid_njrat_vidar

IMPHASH d3751ab33b3858f3b8b8d3275495baba
SHA256 ff3d7c66064928c3933fc6ce9ab7f7d8765701fddb0e0cc06843d6a2fdce774a
MD5 87508f7a40b19c0382b69423808304a2
SHA1 bdd362c79fef88fe95a52e637360e226a2568525
SHA512 4ee011299ef3b77d0f5352da48df76ddcb5c87b71eaa7e9342d1143b6386c711b64263956adcdec592d5662b5ed4c93422acb53c6e33f8c69c29fa7b588e4396
SSDEEP 49152:mdRba8fD8qinfMSKJXIUQREV1QOTu1U5ai2fzYo5UC9RhuCTFKlaxV5dgbT0xhoX:5/IJsiCfsop7cT0xhAO
TLSH
T10C366C656BF880F5E1A7E138897AC9B2F77678020D31DB5F0251CA1F2F33A905D29726
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2315552

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

d:\dbs\el\dec\target\x64\ship\click2run\x-none\IntegratedOffice.pdb

gdi32

GetDeviceCaps

oleaut32

SysFreeString VariantInit VariantClear SysAllocString

advapi32

RegCreateKeyExW RegCloseKey EventWriteTransfer EventRegister EventUnregister RegQueryValueExW RegOpenKeyExW RegEnumKeyExW RegQueryInfoKeyW RegEnumValueW RegDeleteTreeW RegDeleteKeyW RegGetValueW RegSetValueExW RegDeleteValueW GetTokenInformation IsValidSid GetSidSubAuthorityCount GetSidSubAuthority RegNotifyChangeKeyValue RevertToSelf EventWrite OpenThreadToken OpenProcessToken GetLengthSid CopySid InitializeAcl AddAccessAllowedAce AllocateAndInitializeSid FreeSid InitializeSecurityDescriptor SetSecurityDescriptorDacl GetSecurityDescriptorDacl ConvertStringSecurityDescriptorToSecurityDescriptorW ConvertSidToStringSidA CheckTokenMembership CreateWellKnownSid EqualSid

kernel32

GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetCurrentProcess GetLastError CompareStringEx IsWow64Process MultiByteToWideChar RaiseException InitializeCriticalSectionEx DeleteCriticalSection DecodePointer SetLastError DeactivateActCtx ActivateActCtx LoadLibraryW FindActCtxSectionStringW CreateActCtxW GetModuleFileNameW GetModuleHandleExW QueryActCtxW OutputDebugStringA LocalFree FindClose UnmapViewOfFile CloseHandle CreateFileMappingA MapViewOfFile Sleep GetStringTypeExW GetUserDefaultLCID LCMapStringW FreeLibrary GetSystemTimeAsFileTime GetCurrentThreadId FlsAlloc TlsAlloc FlsFree TlsFree FlsGetValue TlsGetValue FlsSetValue TlsSetValue GetTickCount64 GetProcAddress K32GetProcessMemoryInfo GlobalMemoryStatusEx LeaveCriticalSection EnterCriticalSection LocalAlloc WideCharToMultiByte CreateEventW SetEvent InitializeSRWLock ReleaseSRWLockShared AcquireSRWLockShared ReleaseSRWLockExclusive AcquireSRWLockExclusive GetProcessTimes TerminateProcess GetModuleFileNameA GetShortPathNameA K32GetModuleFileNameExW CreateProcessW GetModuleHandleW LoadLibraryExW FindResourceW SizeofResource LoadResource VerSetConditionMask VerifyVersionInfoW OpenProcess GetCurrentProcessId GetStringTypeW GetVersionExW GetUserDefaultLocaleName IsValidCodePage SystemTimeToFileTime FileTimeToSystemTime GetCPInfoExW GetDiskFreeSpaceExW CreateFileW DeviceIoControl GetComputerNameW WriteConsoleW FormatMessageW GetLogicalProcessorInformation GetNativeSystemInfo GetSystemDirectoryW HeapFree HeapAlloc GetProcessHeap WaitForSingleObject CreateThread WaitForMultipleObjectsEx CreateEventExW WakeConditionVariable WakeAllConditionVariable SleepConditionVariableSRW CloseThreadpoolTimer SetThreadpoolTimer WaitForThreadpoolTimerCallbacks CreateThreadpoolTimer CloseThreadpoolWait SetThreadpoolWait WaitForThreadpoolWaitCallbacks CreateThreadpoolWait CreateThreadpoolWork SubmitThreadpoolWork ReleaseSemaphore WaitForSingleObjectEx QueryDepthSList TryEnterCriticalSection InitializeSListHead InterlockedPushEntrySList InterlockedPopEntrySList RtlCaptureStackBackTrace ReleaseMutex CreateMutexExW OpenMutexW GetTempPathW GetLongPathNameW ResetEvent QueryPerformanceCounter QueryPerformanceFrequency VirtualProtectEx GetSystemInfo GlobalFree GlobalAlloc ReadFile WriteFile GetFileSizeEx SetEndOfFile SetFilePointerEx GetOverlappedResult FlushFileBuffers CancelIoEx GetFileAttributesExW DeleteFileW CreateDirectoryW FindFirstFileExW FindNextFileW GetFileType GetTempFileNameW SetFileInformationByHandle GetFileInformationByHandleEx SignalObjectAndWait GetProcessAffinityMask GetLogicalProcessorInformationEx CreateWaitableTimerW SetWaitableTimerEx CancelWaitableTimer GetTickCount WerRegisterMemoryBlock WerUnregisterMemoryBlock QueryFullProcessImageNameW IsProcessorFeaturePresent CreateIoCompletionPort PostQueuedCompletionStatus GetThreadIOPendingFlag GetCurrentThread GetQueuedCompletionStatus IsDebuggerPresent WaitForMultipleObjects GetStartupInfoW CreateMemoryResourceNotification GetSystemPowerStatus IsSystemResumeAutomatic QueryUnbiasedInterruptTime OutputDebugStringW RtlCaptureContext GetModuleHandleA VirtualFree ExpandEnvironmentStringsW VirtualAlloc OpenEventA CreateEventA OpenMutexA CreateMutexA OpenSemaphoreA CreateSemaphoreA OpenFileMappingA ProcessIdToSessionId GetPriorityClass GetExitCodeProcess GetTimeZoneInformation IsValidLocale LCMapStringEx GetPhysicallyInstalledSystemMemory GetProductInfo SwitchToThread GetACP SetStdHandle HeapReAlloc EnumSystemLocalesW GetTimeFormatW GetDateFormatW ExitProcess GetStdHandle HeapSize GetConsoleCP GetConsoleMode UnregisterWaitEx VirtualProtect FreeLibraryAndExitThread GetThreadTimes UnregisterWait RegisterWaitForSingleObject SetThreadAffinityMask GetNumaHighestNodeNumber ChangeTimerQueueTimer GetThreadPriority SetThreadPriority CreateTimerQueue InterlockedFlushSList RtlUnwindEx SetUnhandledExceptionFilter UnhandledExceptionFilter VirtualQuery LoadLibraryExA GetLocalTime GetOEMCP RtlVirtualUnwind RtlLookupFunctionEntry GetLocaleInfoW CompareStringW GetCPInfo InitializeCriticalSectionAndSpinCount EncodePointer RtlPcToFileHeader DuplicateHandle DeleteTimerQueueTimer CreateTimerQueueTimer GetUserGeoID GetSystemDefaultLCID

ole32

CoRevokeInitializeSpy CLSIDFromString CoTaskMemFree CoCreateInstance CoSetProxyBlanket IIDFromString StringFromGUID2 CoCreateGuid CoInitializeEx CoUninitialize CreateStreamOnHGlobal CoCreateFreeThreadedMarshaler CoRegisterInitializeSpy CoTaskMemAlloc

Name

.text

Size

2.6MB

Virtual Size

2.6MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.1MB

Virtual Size

1.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

107KB

Virtual Size

108KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

122KB

Virtual Size

122KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.didat

Size

1024B

Virtual Size

792B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

83KB

Virtual Size

83KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

622KB

Virtual Size

624KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-25_87508f7a40b19c0382b69423808304a2_icedid_njrat_vidar

gdi32

oleaut32

advapi32

kernel32

ole32

generic