2026-10-05_9f0d34e67851fb9f4e868c4a79d49f8c_amadey_icedid_njrat_vidar

General

Target
2026-10-05_9f0d34e67851fb9f4e868c4a79d49f8c_amadey_icedid_njrat_vidar
Size 1.7MB
Sample261006-w151jact51
SHA256 e337182636498c94434213779deb41a4c52958042b66767967cc9775b06a0270
MD5 9f0d34e67851fb9f4e868c4a79d49f8c
SHA1 756c7d2cdee0774e2be45d6aeff8f703b7a7d4d0
SHA512 eeae3103f2369e342b4548d4a3ee0ffd02b20104fce25e95d35c2ee4150245b7322908fb80e78e3c1fdf0cb54ab451707cba08876e6f5ed6dcd25bf1064e9c2e
SSDEEP 24576:VslZOZ1rCn5DrYn5UrYn5kLIZe0p4Ek4niOkl/A04szE87JKTvm:ACC5/Y5oY5k0eW4SkZP4sz9Mb
TLSH
T1FF850869B7B84312E5B3D5B9C8A6E6D5FD32341107308BDF1201F7282E2B6D1D93A729
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-05_9f0d34e67851fb9f4e868c4a79d49f8c_amadey_icedid_njrat_vidar

File Explorer

2026-10-05_9f0d34e67851fb9f4e868c4a79d49f8c_amadey_icedid_njrat_vidar

.exe 1.7MB

2026-10-05_9f0d34e67851fb9f4e868c4a79d49f8c_amadey_icedid_njrat_vidar

IMPHASH 69c8890c645bc52baf5347009201dcb7
SHA256 e337182636498c94434213779deb41a4c52958042b66767967cc9775b06a0270
MD5 9f0d34e67851fb9f4e868c4a79d49f8c
SHA1 756c7d2cdee0774e2be45d6aeff8f703b7a7d4d0
SHA512 eeae3103f2369e342b4548d4a3ee0ffd02b20104fce25e95d35c2ee4150245b7322908fb80e78e3c1fdf0cb54ab451707cba08876e6f5ed6dcd25bf1064e9c2e
SSDEEP 24576:VslZOZ1rCn5DrYn5UrYn5kLIZe0p4Ek4niOkl/A04szE87JKTvm:ACC5/Y5oY5k0eW4SkZP4sz9Mb
TLSH
T1FF850869B7B84312E5B3D5B9C8A6E6D5FD32341107308BDF1201F7282E2B6D1D93A729
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

6

Entry point

83976

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP IMAGE_FILE_NET_RUN_FROM_SWAP

PDB paths

P:\Target\x64\ship\delivery\x-none\ose.pdb

advapi32

RegCloseKey RegCreateKeyExW RegEnumKeyExW RegOpenKeyExW SetThreadToken RegEnumValueW RegQueryValueExW RegSetValueExW RegNotifyChangeKeyValue SetServiceStatus StartServiceCtrlDispatcherW DuplicateToken GetUserNameA RegDeleteValueW RegisterServiceCtrlHandlerW CryptGetHashParam CryptCreateHash CryptHashData CryptDestroyHash AllocateAndInitializeSid CheckTokenMembership FreeSid LookupAccountNameW ConvertStringSecurityDescriptorToSecurityDescriptorW CryptAcquireContextW CryptReleaseContext SetFileSecurityW RegDeleteKeyW OpenThreadToken

kernel32

CloseHandle GetLastError SetEvent GetModuleFileNameW GetDriveTypeW GetLogicalDrives lstrcmpW lstrlenW InitializeCriticalSection EnterCriticalSection LeaveCriticalSection DeleteCriticalSection Sleep ExitProcess GetCommandLineW SetErrorMode ResetEvent ReleaseMutex WaitForMultipleObjectsEx CreateMutexW CreateEventW CreateProcessW GetSystemInfo GetTickCount MoveFileExW CreateFileA CreateFileW ReadFile SetFilePointer RaiseException FreeLibrary GetModuleHandleW GetProcAddress LoadLibraryExW DosDateTimeToFileTime MultiByteToWideChar WideCharToMultiByte ReleaseSemaphore WaitForSingleObject WaitForMultipleObjects CreateSemaphoreW CreateThread SetFilePointerEx VirtualAlloc VirtualFree GlobalAlloc GlobalFree GetSystemTimeAsFileTime ExpandEnvironmentStringsW CompareStringW SetEndOfFile SetFileTime WriteFile GetSystemTime SystemTimeToFileTime LocalFree FindClose GetTempPathA CreateDirectoryW GetFileAttributesW GetTempPathW FindFirstFileW GetFileSizeEx QueryPerformanceCounter DeleteFileW SystemTimeToTzSpecificLocalTime GetTimeZoneInformation GetStdHandle lstrlenA FindNextFileW RemoveDirectoryW SetFileAttributesW GetFileAttributesExW GetFileTime CopyFileW CreateHardLinkW FormatMessageA GetComputerNameW GetCurrentThread HeapAlloc HeapReAlloc HeapFree HeapSize GetProcessHeap GetCurrentProcessId GetCurrentThreadId InitializeSListHead RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent GetCurrentProcess TerminateProcess RtlUnwindEx RtlPcToFileHeader SetLastError EncodePointer InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree GetModuleFileNameA GetModuleHandleExW GetACP GetStringTypeW GetFileType FindFirstFileExA FindNextFileA IsValidCodePage GetOEMCP GetCPInfo GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW LCMapStringW SetStdHandle GetConsoleCP GetConsoleMode FlushFileBuffers WriteConsoleW LoadLibraryExA VirtualQuery VirtualProtect

rpcrt4

RpcServerUseProtseqEpW RpcServerRegisterIfEx RpcServerUnregisterIf NdrServerCall2 RpcImpersonateClient RpcRevertToSelf

wintrust

WinVerifyTrust

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-05_9f0d34e67851fb9f4e868c4a79d49f8c_amadey_icedid_njrat_vidar

advapi32

kernel32

rpcrt4

wintrust

generic