2026-09-26_b650cb53ff10580220ed2143b87edd88_icedid_njrat_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-26_b650cb53ff10580220ed2143b87edd88_icedid_njrat_vidar
Size 1.4MB
Sample260926-tpem4aws7p
SHA256 7e8a130ea0d0fb7e0fb375230aea2e94eab279cf0689e542175971230faddf79
MD5 b650cb53ff10580220ed2143b87edd88
SHA1 3115c3c37565d0a4edac7c5a6ec9fe129cef791f
SHA512 678df8f04370879d2e08166e764f7e5c17b3035c50d265b7e89458d98356bf942d15b9ad4b7d75b0d4aa28b64f8a31e5d98ef581197ad182f97ed9a236f7a916
SSDEEP 24576:lvVaWVQOeBWTpWJ3pURCIGkhEUOoTqy8QCYrLLeYKUML:lNaWVEApWtpURCIE/ouy8grLLesK
TLSH
T1B4659C516FABC5EAD16BA23FC5060942E5FEF602071393CB4B540A757F532A34E3A392
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-26_b650cb53ff10580220ed2143b87edd88_icedid_njrat_vidar

File Explorer

2026-09-26_b650cb53ff10580220ed2143b87edd88_icedid_njrat_vidar

.exe 1.4MB

2026-09-26_b650cb53ff10580220ed2143b87edd88_icedid_njrat_vidar

IMPHASH 6ff736ec8ccd26f85124d86f72504d91
SHA256 7e8a130ea0d0fb7e0fb375230aea2e94eab279cf0689e542175971230faddf79
MD5 b650cb53ff10580220ed2143b87edd88
SHA1 3115c3c37565d0a4edac7c5a6ec9fe129cef791f
SHA512 678df8f04370879d2e08166e764f7e5c17b3035c50d265b7e89458d98356bf942d15b9ad4b7d75b0d4aa28b64f8a31e5d98ef581197ad182f97ed9a236f7a916
SSDEEP 24576:lvVaWVQOeBWTpWJ3pURCIGkhEUOoTqy8QCYrLLeYKUML:lNaWVEApWtpURCIE/ouy8grLLesK
TLSH
T1B4659C516FABC5EAD16BA23FC5060942E5FEF602071393CB4B540A757F532A34E3A392
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

150112

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\dvs\p4\build\sw\gcomp\dev\src\NvContainer\_out\x86_64\release\container\NvContainer.pdb

shlwapi

PathIsRelativeW

kernel32

VerSetConditionMask CompareFileTime CreateFileW GetFileAttributesW GetFullPathNameW OutputDebugStringW SetLastError CreateProcessA CreateProcessW GetSystemDirectoryW FreeLibrary GetModuleFileNameW GetProcAddress LoadLibraryExW lstrcmpA VerifyVersionInfoW FileTimeToSystemTime ExpandEnvironmentStringsW DeleteFileW FindClose FindFirstFileW FindNextFileW OutputDebugStringA Sleep GetCurrentThreadId ProcessIdToSessionId GetSystemTime GetSystemTimeAsFileTime CreateTimerQueueTimer DeleteTimerQueueTimer GetModuleHandleExW MoveFileW MultiByteToWideChar WideCharToMultiByte RemoveVectoredContinueHandler Process32FirstW Process32NextW FindCloseChangeNotification FindFirstChangeNotificationW FindNextChangeNotification GetCurrentDirectoryW GetErrorMode SetErrorMode GetCommandLineW RaiseException GetSystemInfo VirtualProtect VirtualQuery LoadLibraryExA GetConsoleCP HeapReAlloc HeapSize ReadConsoleW ReadFile GetStringTypeW SetStdHandle GetProcessHeap SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetCPInfo GetOEMCP GetACP IsValidCodePage FindFirstFileExW SetFilePointerEx FlushFileBuffers GetFileSizeEx AddVectoredContinueHandler RemoveVectoredExceptionHandler AddVectoredExceptionHandler SetUnhandledExceptionFilter RtlCaptureStackBackTrace GetModuleHandleW WaitForMultipleObjects OpenEventW LocalFree LocalAlloc OpenProcess CreateThread GetCurrentProcessId CreateEventW WaitForSingleObject SetEvent GetLastError CloseHandle GetCurrentProcess GetProcessTimes SetDefaultDllDirectories SetEndOfFile CreateToolhelp32Snapshot RtlUnwind EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionAndSpinCount DeleteCriticalSection ResetEvent WaitForSingleObjectEx RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW QueryPerformanceCounter InitializeSListHead RtlUnwindEx RtlPcToFileHeader InterlockedPushEntrySList InterlockedFlushSList EncodePointer TlsAlloc TlsGetValue TlsSetValue TlsFree ExitProcess GetStdHandle GetFileType WriteConsoleW WriteFile HeapAlloc HeapFree GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetCurrentThread SetConsoleCtrlHandler GetConsoleMode

user32

PostThreadMessageW PeekMessageW GetMessageW ShutdownBlockReasonDestroy ShutdownBlockReasonCreate SetWindowLongPtrW GetWindowLongPtrW LoadStringW CreateWindowExW UnregisterClassW RegisterClassW DefWindowProcW PostMessageW DispatchMessageW TranslateMessage DestroyWindow

shell32

CommandLineToArgvW

advapi32

RegSetKeyValueW RegOpenKeyExW GetUserNameW BuildExplicitAccessWithNameW SetSecurityInfo GetSecurityInfo SetEntriesInAclW StartServiceCtrlDispatcherW SetServiceStatus RegisterServiceCtrlHandlerExW QueryServiceConfigW OpenServiceW OpenSCManagerW CloseServiceHandle ChangeServiceConfigW RegGetValueW RegSetValueExW RegDeleteValueW RegCreateKeyExW RegCloseKey LookupAccountSidW CreateWellKnownSid OpenProcessToken

Name

.text

Size

556KB

Virtual Size

556KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

120KB

Virtual Size

119KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

8KB

Virtual Size

24KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

31KB

Virtual Size

31KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.didat

Size

512B

Virtual Size

48B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_RDATA

Size

512B

Virtual Size

148B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

134KB

Virtual Size

134KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

568KB

Virtual Size

572KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-26_b650cb53ff10580220ed2143b87edd88_icedid_njrat_vidar

shlwapi

kernel32

user32

shell32

advapi32

generic