2026-10-11_3bffe5ac583442214ba2ed0b0d511d75_icedid_njrat_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-11_3bffe5ac583442214ba2ed0b0d511d75_icedid_njrat_vidar
Size 2.4MB
Sample261012-3yrhpaff42
SHA256 4853fb8feb05afdd47ae70a810898f3fd5caa026372bf4fdb03330dfbe1edae5
MD5 3bffe5ac583442214ba2ed0b0d511d75
SHA1 4eb6182457808cf84e5d3870d769c3e1cf9f264c
SHA512 03f725cc63737cb073d1ea4b65b8f52534a25cd9d82169525a32c3431aae4f6f1efc045ae343dc506446f891c182507843066cf532728bcfc9f5a8b34a1cfb2b
SSDEEP 24576:YXS+xbQouAIfxvnUF2mHSgAhFxeQaTtOhdsQMCkBQc177pfQa6GnZp:YC+x8ouAIfKF24OhmfQY7SFs
TLSH
T18BB51E0267FC0408F5F36B789A7A88519A37BC660F34E59F01585D5E0F73A828DB6B72
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-11_3bffe5ac583442214ba2ed0b0d511d75_icedid_njrat_vidar

File Explorer

2026-10-11_3bffe5ac583442214ba2ed0b0d511d75_icedid_njrat_vidar

.exe 2.4MB

2026-10-11_3bffe5ac583442214ba2ed0b0d511d75_icedid_njrat_vidar

IMPHASH 49aaa307415968b34d3fd1a72dee6c71
SHA256 4853fb8feb05afdd47ae70a810898f3fd5caa026372bf4fdb03330dfbe1edae5
MD5 3bffe5ac583442214ba2ed0b0d511d75
SHA1 4eb6182457808cf84e5d3870d769c3e1cf9f264c
SHA512 03f725cc63737cb073d1ea4b65b8f52534a25cd9d82169525a32c3431aae4f6f1efc045ae343dc506446f891c182507843066cf532728bcfc9f5a8b34a1cfb2b
SSDEEP 24576:YXS+xbQouAIfxvnUF2mHSgAhFxeQaTtOhdsQMCkBQc177pfQa6GnZp:YC+x8ouAIfKF24OhmfQY7SFs
TLSH
T18BB51E0267FC0408F5F36B789A7A88519A37BC660F34E59F01585D5E0F73A828DB6B72
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

350608

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

f:\Agent\_work\2\s\exe\x64\Public_Release\Sysmon64.pdb

tdh

TdhGetEventInformation TdhGetEventMapInformation

userenv

ExpandEnvironmentStringsForUserW

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeExW GetFileVersionInfoExW

netapi32

NetServerEnum NetApiBufferFree

ws2_32

htons getnameinfo ntohs gethostbyname WSAStartup inet_ntoa gethostname

mpr

WNetCancelConnection2W WNetAddConnection2W

wtsapi32

WTSQueryUserToken WTSEnumerateSessionsW WTSQuerySessionInformationW WTSFreeMemory

ole32

CoCreateInstance CoUninitialize CoInitializeEx IIDFromString StringFromGUID2 CoSetProxyBlanket CoInitializeSecurity

kernel32

LockResource DeleteFileW Process32FirstW GetSystemInfo LoadResource FindResourceW GetComputerNameW CreateProcessW GetSystemTimeAsFileTime GetTickCount ConnectNamedPipe GetExitCodeProcess DeviceIoControl ProcessIdToSessionId ExitProcess GetCurrentProcessId CopyFileW SetConsoleCtrlHandler GetFileSizeEx WaitForMultipleObjects SetThreadPriority UnmapViewOfFile CreateEventW GetCurrentThread GetOverlappedResult CreateFileMappingW MapViewOfFile QueryDosDeviceW GetFullPathNameW WriteFile OpenProcess GetLogicalDriveStringsW Module32FirstW K32EnumProcesses GetWindowsDirectoryW SystemTimeToFileTime GetTempFileNameW GetSystemTime K32GetMappedFileNameW QueryPerformanceFrequency ResetEvent DeleteCriticalSection SetEvent WaitForSingleObject FindFirstFileW FindNextFileW FindClose InitializeCriticalSectionAndSpinCount RaiseException DecodePointer TerminateProcess DuplicateHandle SetFileAttributesW GlobalSize FreeConsole GlobalLock GlobalUnlock GetModuleHandleExW SetStdHandle InterlockedFlushSList InterlockedPushEntrySList RtlPcToFileHeader RtlUnwindEx OutputDebugStringW GetCPInfo GetLocaleInfoW LCMapStringW CompareStringW EncodePointer TlsFree TlsSetValue TlsGetValue TlsAlloc SwitchToThread GetStringTypeW WideCharToMultiByte InitializeSListHead GetCurrentThreadId GetStartupInfoW IsDebuggerPresent IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry Process32NextW Sleep CreateToolhelp32Snapshot GetVersion GetSystemDirectoryW GetFileAttributesW QueryPerformanceCounter GetTempPathW RtlUnwind RemoveDirectoryW lstrlenW GetCurrentProcess GetConsoleScreenBufferInfo SizeofResource CreateDirectoryW CloseHandle InitializeCriticalSection ExpandEnvironmentStringsW GetLastError FormatMessageW LeaveCriticalSection EnterCriticalSection GetDateFormatW FreeLibrary GetTimeFormatW FileTimeToSystemTime MultiByteToWideChar GetModuleHandleW LocalFree GetProcAddress LocalAlloc GetStdHandle GetCommandLineW LoadLibraryExW GetVersionExW SetLastError GetFileType GetModuleFileNameW GetConsoleMode GetNumberOfConsoleInputEvents PeekConsoleInputA ReadConsoleInputA SetConsoleMode ExitThread ResumeThread FreeLibraryAndExitThread GetModuleFileNameA GetCommandLineA GetACP HeapFree HeapAlloc IsValidLocale GetUserDefaultLCID EnumSystemLocalesW FlushFileBuffers GetConsoleCP ReadFile HeapReAlloc FindFirstFileExA FindFirstFileExW FindNextFileA IsValidCodePage GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableA SetEnvironmentVariableW GetProcessHeap OutputDebugStringA GetTimeZoneInformation HeapSize RtlCaptureContext WaitForSingleObjectEx CreateFileW SetFilePointerEx WriteConsoleW ReadConsoleW SetEndOfFile CreateThread

user32

ChangeClipboardChain CloseClipboard RegisterClassW TranslateMessage GetClipboardData GetClipboardOwner UnregisterClassW MessageBoxW InflateRect OpenClipboard EndDialog SetWindowTextW DialogBoxIndirectParamW LoadCursorW SetCursor GetDlgItem GetSysColorBrush SetClipboardViewer GetMessageW GetWindowThreadProcessId GetPriorityClipboardFormat DispatchMessageW SendMessageW CreateWindowExW GetClipboardSequenceNumber DefWindowProcW

gdi32

EndDoc GetDeviceCaps SetMapMode StartDocW EndPage StartPage

comdlg32

PrintDlgW

advapi32

LookupAccountNameW RegQueryValueExW RegOpenKeyW RegCreateKeyW RegOpenKeyExW RegCloseKey SetFileSecurityW CryptAcquireContextW CryptGenRandom CreateProcessAsUserW ConvertStringSecurityDescriptorToSecurityDescriptorW DuplicateTokenEx CryptReleaseContext GetSecurityDescriptorLength DeregisterEventSource GetSidSubAuthorityCount GetSidSubAuthority CopySid GetLengthSid RegisterEventSourceW ReportEventW RegNotifyChangeKeyValue RegisterServiceCtrlHandlerExW SetSecurityDescriptorDacl RegDeleteKeyW SetServiceStatus ChangeServiceConfig2W SetEntriesInAclW RegCreateKeyExW InitializeSecurityDescriptor StartServiceCtrlDispatcherW QueryServiceConfigW RegDeleteValueW LookupAccountSidW ConvertSidToStringSidW LookupPrivilegeValueW AdjustTokenPrivileges RevertToSelf CreateServiceW QueryServiceStatus EqualSid CloseServiceHandle OpenSCManagerW AllocateAndInitializeSid DeleteService ControlService ImpersonateLoggedOnUser LogonUserW OpenProcessToken FreeSid StartServiceW RegConnectRegistryW OpenServiceW GetTokenInformation StartTraceW ProcessTrace CloseTrace ControlTraceW OpenTraceW EnableTraceEx2 RegSetValueExW

oleaut32

VarBstrCmp SafeArrayGetElement VariantChangeType VariantClear VariantInit SysAllocStringByteLen SysStringLen SysAllocStringLen SafeArrayUnaccessData SafeArrayDestroy SafeArrayGetLBound SafeArrayGetUBound GetErrorInfo SetErrorInfo SysStringByteLen SafeArrayAccessData CreateErrorInfo SysAllocString SysFreeString

crypt32

CryptFindOIDInfo CertGetCertificateChain CertDuplicateCertificateContext CertGetNameStringW CryptDecodeObject

secur32

LsaGetLogonSessionData LsaFreeReturnBuffer

rpcrt4

RpcServerUseProtseqEpW NdrClientCall2 RpcServerRegisterIfEx RpcStringFreeW I_RpcBindingInqLocalClientPID RpcBindingFromStringBindingW RpcStringBindingComposeW RpcServerUnregisterIf NdrServerCall2

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-11_3bffe5ac583442214ba2ed0b0d511d75_icedid_njrat_vidar

tdh

userenv

version

netapi32

ws2_32

mpr

wtsapi32

ole32

kernel32

user32

gdi32

comdlg32

advapi32

oleaut32

crypt32

secur32

rpcrt4

generic