2026-11-01_cae760a65e8d71b44ad8e751b974892c_icedid_njrat_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-11-01_cae760a65e8d71b44ad8e751b974892c_icedid_njrat_vidar
Size 1.2MB
Sample261102-kl5knsee99
SHA256 54b1620bdd4f382d60a5416efa47cd21fca3e3fd00e3d7c8ebeee47b4fb15335
MD5 cae760a65e8d71b44ad8e751b974892c
SHA1 907e2c177bef0220ee9db92b2a263fc74c6c9363
SHA512 5367c5d053f44f1bc9438d15363dbe62ff3bc5973219e5567e4573db970caee739f1b9e43071fd37997cafcb136a97d570a8c957d12de3be9e27c9c5ade19180
SSDEEP 24576:xobfjfiLCwXT5+naHsK+fM2jEaNZBqoeW7V6tGLfHtqls+0:xobbfiLfXT5qksDM2jh3BqS7YtGL/Als
TLSH
T1AD459F0267A902BCE0B7D2399A63CD52EA767C050B715ADF0780693B2E767E1DF35720
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-11-01_cae760a65e8d71b44ad8e751b974892c_icedid_njrat_vidar

File Explorer

2026-11-01_cae760a65e8d71b44ad8e751b974892c_icedid_njrat_vidar

.exe 1.2MB

2026-11-01_cae760a65e8d71b44ad8e751b974892c_icedid_njrat_vidar

IMPHASH 8bf59c46d938efa5b0b48d765cc53b50
SHA256 54b1620bdd4f382d60a5416efa47cd21fca3e3fd00e3d7c8ebeee47b4fb15335
MD5 cae760a65e8d71b44ad8e751b974892c
SHA1 907e2c177bef0220ee9db92b2a263fc74c6c9363
SHA512 5367c5d053f44f1bc9438d15363dbe62ff3bc5973219e5567e4573db970caee739f1b9e43071fd37997cafcb136a97d570a8c957d12de3be9e27c9c5ade19180
SSDEEP 24576:xobfjfiLCwXT5+naHsK+fM2jEaNZBqoeW7V6tGLfHtqls+0:xobbfiLfXT5qksDM2jh3BqS7YtGL/Als
TLSH
T1AD459F0267A902BCE0B7D2399A63CD52EA767C050B715ADF0780693B2E767E1DF35720
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

321068

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Z:\src\v480\Beta13\src\DriverInstaller\Src\IJDriverInstaller\IJDriverInstaller\x64\Release\DELDRV64.pdb

newdev

DiUninstallDevice

advapi32

RegCloseKey LookupPrivilegeValueW CryptReleaseContext CryptGetHashParam CryptDestroyHash CryptHashData CryptCreateHash CryptAcquireContextW RegEnumValueW RegDeleteValueW RegOpenKeyExW RegSetValueExW RegDeleteTreeW RegEnumKeyExW RegCreateKeyExW RegQueryInfoKeyW RegDeleteKeyExW OpenProcessToken UnregisterTraceGuids RegisterTraceGuidsW GetTraceEnableLevel GetTraceEnableFlags GetTraceLoggerHandle TraceMessage OpenServiceW QueryServiceConfigW EnumDependentServicesW OpenSCManagerW CloseServiceHandle QueryServiceStatus AdjustTokenPrivileges

setupapi

SetupCloseInfFile SetupFindNextLine SetupGetStringFieldW SetupOpenInfFileW SetupFindFirstLineW SetupUninstallOEMInfW SetupDiGetDevicePropertyW SetupDiDestroyDeviceInfoList CM_Get_Device_IDW SetupDiEnumDeviceInfo CM_Get_Parent SetupDiGetClassDevsW SetupDiOpenDeviceInfoW SetupGetLineTextW

kernel32

FindFirstFileExW LCMapStringW GetFileType HeapAlloc HeapFree GetStdHandle ExitProcess FreeLibraryAndExitThread ReadFile WriteFile CreateFileW GetLastError CloseHandle GetFileSize FindFirstFileW FindNextFileW FindClose EnterCriticalSection LeaveCriticalSection InitializeCriticalSection GetCurrentThreadId GetLocalTime DeleteCriticalSection GetCurrentProcessId CreateDirectoryW GetLongPathNameW GetModuleHandleExW GetModuleFileNameW GetTempPathW GetFileAttributesW GetWindowsDirectoryW CompareFileTime SetThreadUILanguage GetThreadUILanguage WriteConsoleW FreeLibrary MultiByteToWideChar WideCharToMultiByte GetCurrentProcess LoadLibraryExA GetNativeSystemInfo GetProcAddress VerSetConditionMask VerifyVersionInfoW IsWow64Process CreateMutexW WaitForSingleObject ReleaseMutex OpenMutexW GetSystemInfo GetSystemDirectoryW OpenProcess Sleep GlobalAlloc GlobalFree CreateProcessW lstrcmpiW lstrcmpW LoadLibraryExW WaitForMultipleObjects DeleteFileW CreateEventW SetEvent TerminateThread MoveFileExW CopyFileW K32GetModuleFileNameExW K32GetProcessImageFileNameW K32EnumProcessModulesEx K32EnumProcesses GetExitCodeProcess GetUserDefaultUILanguage FormatMessageW LocalFree SetLastError IsValidCodePage ExitThread CreateThread TlsFree TlsSetValue TlsGetValue TlsAlloc EncodePointer RaiseException RtlPcToFileHeader RtlUnwindEx InitializeSListHead GetSystemTimeAsFileTime QueryPerformanceCounter GetStartupInfoW IsDebuggerPresent GetModuleHandleW WaitForSingleObjectEx ResetEvent InitializeCriticalSectionAndSpinCount IsProcessorFeaturePresent TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext GetACP GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW LoadLibraryW GetProcessHeap SetStdHandle GetStringTypeW GetConsoleMode GetConsoleCP FlushFileBuffers HeapReAlloc HeapSize SetFilePointerEx

user32

GetFocus GetSystemMenu GetWindowLongPtrW ShowWindow SetFocus EnableMenuItem CreateDialogParamW PostMessageW GetWindowRect MoveWindow SetWindowTextW DestroyIcon GetDlgItem BeginPaint EndPaint LoadAcceleratorsW DispatchMessageW IsDialogMessageW TranslateAcceleratorW TranslateMessage PostQuitMessage MessageBoxW PostThreadMessageW wsprintfW SetWindowLongPtrW SendMessageW LoadStringW InvalidateRect ScreenToClient EnableWindow GetParent IsWindowEnabled GetMessageW LoadImageW GetWindowThreadProcessId GetClientRect LoadCursorW RegisterClassExW CreateWindowExW DefWindowProcW GetWindowTextW GetClassNameW DestroyWindow EnumWindows

winspool.drv

EnumJobsW ClosePrinter XcvDataW EnumPrinterDriversW OpenPrinterW EnumPrintersW DeletePrinterConnectionW DeletePrinter SetPrinterW GetPrinterW DeletePrinterDriverExW

shell32

SHGetKnownFolderPath SHFileOperationW

ole32

StringFromGUID2 PropVariantClear CoUninitialize CoCreateInstance CoInitializeEx CLSIDFromString CoTaskMemFree

shlwapi

PathMatchSpecExW PathMatchSpecW

Name

.text

Size

452KB

Virtual Size

451KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

168KB

Virtual Size

168KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

14KB

Virtual Size

14KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

27KB

Virtual Size

27KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

568KB

Virtual Size

572KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-11-01_cae760a65e8d71b44ad8e751b974892c_icedid_njrat_vidar

newdev

advapi32

setupapi

kernel32

user32

winspool.drv

shell32

ole32

shlwapi

generic