2026-11-03_750b46715d2ac6bacacf96546276e501_icedid_njrat_vidar

General

Target
2026-11-03_750b46715d2ac6bacacf96546276e501_icedid_njrat_vidar
Size 1.3MB
Sample261104-vbge7sbx2t
SHA256 b02fab24cf8e8227e9ff2f39bbc9201d593449160bc5c7d42a7faa98fd264141
MD5 750b46715d2ac6bacacf96546276e501
SHA1 35018aa8e6d7cbf95ef736db0ff64f29f0282620
SHA512 28ec9eda4c07e820b3064b236689ddd5e351ad5ec92c4474d85a7c518924fba5efd9b4ceeaf9f75077513e1030039d288aced388da78e12157713d565ccaf884
SSDEEP 24576:4jKTIsAjFuvtIfmFthMaT5U8RChaeu9sqjnhMgeiCl7G0nehbGZpbD:4jIMmPh7TTY9YDmg27RnWGj
TLSH
T10055AE2AFEA482F5D4BBD039C492A62AF9B17452473097CB5291462F2F377E09D3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-11-03_750b46715d2ac6bacacf96546276e501_icedid_njrat_vidar

File Explorer

2026-11-03_750b46715d2ac6bacacf96546276e501_icedid_njrat_vidar

.exe 1.3MB

2026-11-03_750b46715d2ac6bacacf96546276e501_icedid_njrat_vidar

IMPHASH fa81b7de7eb4df00b88694f99cad79f2
SHA256 b02fab24cf8e8227e9ff2f39bbc9201d593449160bc5c7d42a7faa98fd264141
MD5 750b46715d2ac6bacacf96546276e501
SHA1 35018aa8e6d7cbf95ef736db0ff64f29f0282620
SHA512 28ec9eda4c07e820b3064b236689ddd5e351ad5ec92c4474d85a7c518924fba5efd9b4ceeaf9f75077513e1030039d288aced388da78e12157713d565ccaf884
SSDEEP 24576:4jKTIsAjFuvtIfmFthMaT5U8RChaeu9sqjnhMgeiCl7G0nehbGZpbD:4jIMmPh7TTY9YDmg27RnWGj
TLSH
T10055AE2AFEA482F5D4BBD039C492A62AF9B17452473097CB5291462F2F377E09D3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

289072

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\workspace\CR-Windows-x64-Client-Builder\CRLogTransport\public\binary\Win\x64\Release\CRLogTransport.pdb

shlwapi

PathFileExistsW PathIsDirectoryW

wininet

InternetConnectW InternetCloseHandle InternetSetOptionW InternetCrackUrlW InternetReadFile HttpSendRequestW InternetOpenW InternetSetStatusCallbackW InternetQueryDataAvailable InternetQueryOptionW HttpOpenRequestW HttpQueryInfoW InternetSetOptionA

kernel32

GetACP MultiByteToWideChar WideCharToMultiByte CompareFileTime FindFirstFileW FindNextFileW FindClose CreateFileW FreeEnvironmentStringsW DeleteFileW CloseHandle GetProcAddress MoveFileExW FreeLibrary GetEnvironmentStringsW GetFileTime GetConsoleCP ReadFile GetModuleFileNameW HeapFree InitializeCriticalSectionEx HeapSize Sleep HeapReAlloc RaiseException HeapAlloc DecodePointer DeleteCriticalSection GetProcessHeap GetSystemTimeAsFileTime FlushFileBuffers GetFileSizeEx GetCommandLineW GetConsoleMode GetDateFormatW GetTimeFormatW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW ReadConsoleW SetStdHandle GetTimeZoneInformation FindFirstFileExW IsValidCodePage GetOEMCP SetEnvironmentVariableW WriteConsoleW GetLastError EnterCriticalSection GetCommandLineA WriteFile GetStdHandle GetModuleHandleExW FormatMessageW GetStringTypeW RtlUnwind LeaveCriticalSection SetLastError InitializeCriticalSectionAndSpinCount CreateEventW SwitchToThread TlsAlloc TlsGetValue TlsSetValue TlsFree GetModuleHandleW EncodePointer CompareStringW LCMapStringW GetLocaleInfoW GetCPInfo RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent SetEvent ResetEvent WaitForSingleObjectEx IsDebuggerPresent GetStartupInfoW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId InitializeSListHead FormatMessageA LocalFree SetEndOfFile SetFilePointerEx AreFileApisANSI OutputDebugStringW RtlUnwindEx RtlPcToFileHeader LoadLibraryExW GetFileType SetConsoleCtrlHandler ExitProcess

shell32

SHCreateDirectoryExW SHGetFolderPathW

Name

.text

Size

504KB

Virtual Size

504KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

190KB

Virtual Size

189KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

8KB

Virtual Size

1.0MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

30KB

Virtual Size

30KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

572KB

Virtual Size

576KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-11-03_750b46715d2ac6bacacf96546276e501_icedid_njrat_vidar

shlwapi

wininet

kernel32

shell32

generic