2026-11-03_415dfb1bffa1ab295806c9b7251f8f97_icedid_njrat_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-11-03_415dfb1bffa1ab295806c9b7251f8f97_icedid_njrat_vidar
Size 2.6MB
Sample261104-2kre4avyb1
SHA256 b1627562a854e3c3f25e468fb8cbc819a24b5b48639313c520e37c80f46b0eef
MD5 415dfb1bffa1ab295806c9b7251f8f97
SHA1 02b5ef6e91e8c6bea82612c7fd2492899031f7d3
SHA512 5f565315aea2f557b50561acc4b135e0d0e5ad3e18c0db110004ad3dc862e57d231fd8c7bf496b5694fe1f6e5485a127942a383839b826812809536c956cfe93
SSDEEP 49152:++G4hvjeBuLA+7srK0Y4qKQICPq3t8Dv4Tmv:U2LuGAprTY41QIP+DL
TLSH
T133C5DF66779881E5D17B923D89864B8DDAB174064B309BCF069C47AE1F23BE41D3FB20
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-11-03_415dfb1bffa1ab295806c9b7251f8f97_icedid_njrat_vidar

File Explorer

2026-11-03_415dfb1bffa1ab295806c9b7251f8f97_icedid_njrat_vidar

.exe 2.6MB

2026-11-03_415dfb1bffa1ab295806c9b7251f8f97_icedid_njrat_vidar

IMPHASH f1b594ddfecd71fb96d48c63d9dacbab
SHA256 b1627562a854e3c3f25e468fb8cbc819a24b5b48639313c520e37c80f46b0eef
MD5 415dfb1bffa1ab295806c9b7251f8f97
SHA1 02b5ef6e91e8c6bea82612c7fd2492899031f7d3
SHA512 5f565315aea2f557b50561acc4b135e0d0e5ad3e18c0db110004ad3dc862e57d231fd8c7bf496b5694fe1f6e5485a127942a383839b826812809536c956cfe93
SSDEEP 49152:++G4hvjeBuLA+7srK0Y4qKQICPq3t8Dv4Tmv:U2LuGAprTY41QIP+DL
TLSH
T133C5DF66779881E5D17B923D89864B8DDAB174064B309BCF069C47AE1F23BE41D3FB20
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x64 arch:x64

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

19906

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\projects\rcedit\Default\rcedit.pdb

kernel32

DecodePointer FreeResource LockResource FreeLibrary HeapDestroy HeapAlloc HeapReAlloc HeapFree HeapSize GetProcessHeap RaiseException GetLastError InitializeCriticalSectionAndSpinCount DeleteCriticalSection LoadResource SizeofResource GetFileSize ReadFile SetFilePointer CloseHandle LoadLibraryExW FindResourceW FindResourceExW EnumResourceNamesW EnumResourceLanguagesW BeginUpdateResourceW UpdateResourceW EndUpdateResourceW CreateFileW WideCharToMultiByte MultiByteToWideChar GetStringTypeW FormatMessageW EnterCriticalSection LeaveCriticalSection EncodePointer SetLastError CreateEventW SwitchToThread TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemTimeAsFileTime GetTickCount GetModuleHandleW GetProcAddress CompareStringW LCMapStringW GetLocaleInfoW GetCPInfo SetEvent ResetEvent WaitForSingleObjectEx RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId InitializeSListHead OutputDebugStringW SetEndOfFile ReadConsoleW GetCurrentDirectoryW RtlPcToFileHeader RtlUnwindEx InterlockedPushEntrySList InterlockedFlushSList GetFullPathNameW GetFullPathNameA GetStdHandle GetFileType GetModuleFileNameA GetModuleFileNameW GetModuleHandleExW WriteConsoleW ExitProcess WriteFile GetCommandLineA GetCommandLineW GetACP GetDateFormatW GetTimeFormatW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetCurrentThread GetDriveTypeW FlushFileBuffers GetConsoleCP GetConsoleMode SetFilePointerEx OutputDebugStringA CreateThread SetConsoleCtrlHandler GetTimeZoneInformation FindClose FindFirstFileExA FindFirstFileExW FindNextFileA FindNextFileW IsValidCodePage GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableA SetEnvironmentVariableW SetStdHandle SetCurrentDirectoryW RtlUnwind

user32

UnregisterClassW

Name

.text

Size

975KB

Virtual Size

974KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

246KB

Virtual Size

246KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

11KB

Virtual Size

21KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

43KB

Virtual Size

42KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

1024B

Virtual Size

777B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.00cfg

Size

512B

Virtual Size

283B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

UPX1

Size

1.3MB

Virtual Size

1.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-11-03_415dfb1bffa1ab295806c9b7251f8f97_icedid_njrat_vidar

kernel32

user32

generic