2026-10-22_5ce6d306a55d0c0ae729fa6829a96b1a_icedid_njrat_vidar

General

Target
2026-10-22_5ce6d306a55d0c0ae729fa6829a96b1a_icedid_njrat_vidar
Size 2.4MB
Sample261024-n2ynvabv9m
SHA256 1b170313ad966b39a73ee5f64a467475846aa3df5cae6fda7ae224012adf84bc
MD5 5ce6d306a55d0c0ae729fa6829a96b1a
SHA1 75fa1395d1dfefc7075ec25a7078dfc250d53381
SHA512 23e4521bb266493fdacd20a8c5d58e1972e49b0c1dca5bfc01a40ee337bafb29db0d178d748ac0d60633e64999df30344e3c03b62fa5cc1c859fe01370da5914
SSDEEP 49152:FLGjKsS+tgauhwbR3P8wT86arSj8RoTCC:aVgaPJzJT
TLSH
T1F8C5124AA3984CF8DA6747388A578432F6F3BD452A15DB0F46A0C35A5F337A1AE3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-22_5ce6d306a55d0c0ae729fa6829a96b1a_icedid_njrat_vidar

File Explorer

2026-10-22_5ce6d306a55d0c0ae729fa6829a96b1a_icedid_njrat_vidar

.exe 2.4MB

2026-10-22_5ce6d306a55d0c0ae729fa6829a96b1a_icedid_njrat_vidar

IMPHASH 1cfb4c74646076668c97fa046213dc5f
SHA256 1b170313ad966b39a73ee5f64a467475846aa3df5cae6fda7ae224012adf84bc
MD5 5ce6d306a55d0c0ae729fa6829a96b1a
SHA1 75fa1395d1dfefc7075ec25a7078dfc250d53381
SHA512 23e4521bb266493fdacd20a8c5d58e1972e49b0c1dca5bfc01a40ee337bafb29db0d178d748ac0d60633e64999df30344e3c03b62fa5cc1c859fe01370da5914
SSDEEP 49152:FLGjKsS+tgauhwbR3P8wT86arSj8RoTCC:aVgaPJzJT
TLSH
T1F8C5124AA3984CF8DA6747388A578432F6F3BD452A15DB0F46A0C35A5F337A1AE3D710
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

6

Entry point

87920

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP IMAGE_FILE_NET_RUN_FROM_SWAP

PDB paths

d:\dbs\el\o6\target\x64\ship\delivery\x-none\ose.pdb

advapi32

RegOpenKeyExW RegEnumKeyExW RegCreateKeyExW RegCloseKey RegQueryValueExW RegEnumValueW SetThreadToken RegSetValueExW StartServiceCtrlDispatcherW SetServiceStatus RegNotifyChangeKeyValue DuplicateToken GetUserNameA RegDeleteValueW RegisterServiceCtrlHandlerW CryptGetHashParam CryptDestroyHash CryptHashData CryptCreateHash LookupAccountNameW ConvertStringSecurityDescriptorToSecurityDescriptorW CheckTokenMembership FreeSid AllocateAndInitializeSid GetTokenInformation OpenProcessToken CryptReleaseContext CryptAcquireContextW SetFileSecurityW RegDeleteKeyW OpenThreadToken

kernel32

GetModuleFileNameW GetLastError SetEvent CloseHandle GetLogicalDrives lstrlenW lstrcmpW GetDriveTypeW EnterCriticalSection LeaveCriticalSection InitializeCriticalSection Sleep DeleteCriticalSection ExitProcess GetCommandLineW SetErrorMode CreateMutexW WaitForMultipleObjectsEx ReleaseMutex CreateEventW GetSystemInfo ResetEvent MoveFileExW CreateProcessW GetTickCount ReadFile SetFilePointer CreateFileW MultiByteToWideChar CreateFileA RaiseException GetProcAddress GetModuleHandleW FreeLibrary WideCharToMultiByte DosDateTimeToFileTime LoadLibraryExW ReleaseSemaphore WaitForMultipleObjects WaitForSingleObject CreateThread CreateSemaphoreW VirtualFree VirtualAlloc GlobalAlloc GlobalFree SetFilePointerEx GetSystemTimeAsFileTime CompareStringW ExpandEnvironmentStringsW WriteFile SetFileTime SetEndOfFile SystemTimeToFileTime GetSystemTime LocalFree FindClose GetTempPathA CreateDirectoryW GetTempPathW GetFileAttributesW FindFirstFileW GetFileSizeEx QueryPerformanceCounter DeleteFileW GetTimeZoneInformation SystemTimeToTzSpecificLocalTime GetStdHandle lstrlenA FindNextFileW RemoveDirectoryW SetFileAttributesW GetCurrentProcess GetFileAttributesExW GetWindowsDirectoryW CopyFileW GetFileTime GetComputerNameW FormatMessageA GetCurrentThread HeapFree HeapSize HeapReAlloc HeapAlloc GetProcessHeap LoadLibraryExA VirtualQuery VirtualProtect WriteConsoleW FlushFileBuffers GetConsoleMode GetConsoleCP SetStdHandle LCMapStringW FreeEnvironmentStringsW GetEnvironmentStringsW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent GetCurrentProcessId GetCurrentThreadId InitializeSListHead IsDebuggerPresent GetStartupInfoW RtlUnwindEx RtlPcToFileHeader SetLastError EncodePointer InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree GetModuleFileNameA GetModuleHandleExW GetACP GetStringTypeW GetFileType FindFirstFileExA FindNextFileA IsValidCodePage GetOEMCP GetCPInfo GetCommandLineA

rpcrt4

RpcServerUseProtseqEpW RpcImpersonateClient NdrServerCall2 RpcRevertToSelf RpcServerUnregisterIf RpcServerRegisterIfEx

wintrust

WinVerifyTrust

Name

.text

Size

159KB

Virtual Size

159KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

60KB

Virtual Size

59KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

2KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

8KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.didat

Size

512B

Virtual Size

168B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

UPX1

Size

2.2MB

Virtual Size

2.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-22_5ce6d306a55d0c0ae729fa6829a96b1a_icedid_njrat_vidar

advapi32

kernel32

rpcrt4

wintrust

generic