2026-09-29_32a7757649af36516b3f06b1bd8debf8_icedid_njrat_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-29_32a7757649af36516b3f06b1bd8debf8_icedid_njrat_vidar
Size 301KB
Sample260930-dyv4fadf87
SHA256 b6865aa36317c41b2442473b55444e287395f8cd970d9c0c64c55b0872a7f68c
MD5 32a7757649af36516b3f06b1bd8debf8
SHA1 10aaed64a81ccdc25b0c892c466442d6934ad765
SHA512 85df3196953192fceb967734e6ec0c34d05ab9b3d45e1417553de1806ccce010ccbfb1439543b5a947b73a82519e271d8433f6d7aec841941e0c1d88758deea6
SSDEEP 6144:qE7W5M8yGe34MyVqQBviA4b2XpyohKPjBnDAZELwS:q55e4MyVnWzoBEP
TLSH
T19C646C5577E50CF9FD77C63888628606EA72BC114A31DB6F03A4625A9F333909D3AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

2026-09-29_32a7757649af36516b3f06b1bd8debf8_icedid_njrat_vidar

.exe 301KB

2026-09-29_32a7757649af36516b3f06b1bd8debf8_icedid_njrat_vidar

IMPHASH b06cdfe77c519286d758563e562ec88d
SHA256 b6865aa36317c41b2442473b55444e287395f8cd970d9c0c64c55b0872a7f68c
MD5 32a7757649af36516b3f06b1bd8debf8
SHA1 10aaed64a81ccdc25b0c892c466442d6934ad765
SHA512 85df3196953192fceb967734e6ec0c34d05ab9b3d45e1417553de1806ccce010ccbfb1439543b5a947b73a82519e271d8433f6d7aec841941e0c1d88758deea6
SSDEEP 6144:qE7W5M8yGe34MyVqQBviA4b2XpyohKPjBnDAZELwS:q55e4MyVnWzoBEP
TLSH
T19C646C5577E50CF9FD77C63888628606EA72BC114A31DB6F03A4625A9F333909D3AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Digest

bf:d2:f8:90:e5:49:0a:22:be:93:36:10:6d:ac:4a:56:ce:2d:3d:a9:b1:65:49:f8:0a:4f:f5:a5:d8:c4:56:b5

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Takashi Sawanaka,O=Takashi Sawanaka,L=Chiba,ST=Chiba,C=JP

Chains

Sep 5, 2026

CN=Takashi Sawanaka,O=Takashi Sawanaka,L=Chiba,ST=Chiba,C=JP

CN=Certum Code Signing 2021 CA,O=Asseco Data Systems S.A.,C=PL

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

CN=Takashi Sawanaka,O=Takashi Sawanaka,L=Chiba,ST=Chiba,C=JP

CN=Certum Code Signing 2021 CA,O=Asseco Data Systems S.A.,C=PL

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Subject

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Serial Number

1b:b5:8f:25:2a:df:23:00:49:28:c9:ae:3d:7e:ed:27

Issuer

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

May 31, 2021 - Sep 17, 2029

Subject

CN=Takashi Sawanaka,O=Takashi Sawanaka,L=Chiba,ST=Chiba,C=JP

Serial Number

3c:c2:ac:32:38:8a:f4:7f:d7:30:02:18:8b:ea:b7:be

Issuer

CN=Certum Code Signing 2021 CA,O=Asseco Data Systems S.A.,C=PL

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 18, 2024 - Oct 18, 2027

Subject

CN=Certum Timestamp 2026,O=Asseco Data Systems S.A.,C=PL

Serial Number

28:f0:77:c1:1c:36:bd:fe:5f:74:32:47:70:27:2e:03

Issuer

CN=Certum Timestamping 2021 CA,O=Asseco Data Systems S.A.,C=PL

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 11, 2026 - Feb 27, 2036

Subject

CN=Certum Code Signing 2021 CA,O=Asseco Data Systems S.A.,C=PL

Serial Number

99:a3:80:0a:26:55:3b:65:ab:dc:6e:84:a6:b3:ea:39

Issuer

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

May 19, 2021 - May 18, 2036

Subject

CN=Certum Timestamping 2021 CA,O=Asseco Data Systems S.A.,C=PL

Serial Number

e7:ff:69:c7:3b:35:ce:4b:91:26:d8:74:7c:68:a5:87

Issuer

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 19, 2021 - May 18, 2036

Minor OS version

Major OS version

Entry point

24508

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

E:\dev\winmerge\Externals\winimerge\Build\x64\Release\WinIMerge\WinIMerge.pdb

winimergelib

WinIMerge_DestroyWindow WinIMerge_CreateWindow WinIMerge_CreateToolWindow

kernel32

WideCharToMultiByte lstrcpyW CreateFileW GetProcessHeap SetStdHandle FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW FindClose GetModuleHandleW ReadConsoleW SetEndOfFile EnumSystemLocalesW GetUserDefaultLCID IsValidLocale CloseHandle GetConsoleMode GetConsoleCP FlushFileBuffers HeapAlloc HeapFree GetFileType SetFilePointerEx GetFileSizeEx GetModuleHandleExW ExitProcess CreateDirectoryW HeapSize HeapReAlloc WriteConsoleW GetModuleFileNameW WriteFile GetStdHandle LoadLibraryExW ReadFile GetProcAddress FreeLibrary RaiseException GetLastError EnterCriticalSection LeaveCriticalSection DeleteCriticalSection SetLastError InitializeCriticalSectionAndSpinCount SwitchToThread TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemTimeAsFileTime RtlUnwind EncodePointer DecodePointer MultiByteToWideChar LCMapStringW GetLocaleInfoW GetStringTypeW GetCPInfo RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId InitializeSListHead IsDebuggerPresent GetStartupInfoW RtlUnwindEx RtlPcToFileHeader

user32

GetMessageW DefWindowProcW LoadMenuW PostMessageW CheckMenuRadioItem GetWindowRect GetMenu DestroyWindow MessageBoxW CreateWindowExW SendMessageW SetWindowTextW RegisterClassExW LoadAcceleratorsW TrackPopupMenu GetSubMenu ShowWindow GetAsyncKeyState DispatchMessageW SetTimer IsDialogMessageW MessageBoxA MoveWindow TranslateAcceleratorW TranslateMessage LoadIconW LoadCursorW wsprintfW CheckMenuItem GetClientRect PostQuitMessage PtInRect UpdateWindow InvalidateRect GetCursorPos

comdlg32

GetSaveFileNameW ChooseColorW GetOpenFileNameW

shell32

CommandLineToArgvW

oleaut32

SysFreeString

comctl32

ord17

shlwapi

PathAddExtensionW PathRemoveExtensionW PathFindFileNameW

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-29_32a7757649af36516b3f06b1bd8debf8_icedid_njrat_vidar

winimergelib

kernel32

user32

comdlg32

shell32

oleaut32

comctl32

shlwapi

generic