2026-11-03_739cc75d31d3a2e2f85c2ad002b58534_icedid_njrat_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-11-03_739cc75d31d3a2e2f85c2ad002b58534_icedid_njrat_vidar
Size 1.4MB
Sample261104-vggcdsea49
SHA256 10f9e17ac31b7ec9d1a96fc9458e9149bb49e82e32f3d7aa93c8f19d7dfd5232
MD5 739cc75d31d3a2e2f85c2ad002b58534
SHA1 6dc3bc548ba2d83880a50a36e29400c20be6a2da
SHA512 f54ad42dc51bb866866e2140207e49190736a70348556a14a00b64f47bc20b939da5ca595622fd28224366c34cc2b8729c4b51ea4e80d578dddf26a5989743a6
SSDEEP 12288:HZGSV+EB5PgRyeAtK20ks/87Eygl8BYj4dRG5SG1X+2Jk5efqyCNo:5P+S5I1KK2k0wfl8BYM/eNs27TCe
TLSH
T1DE65F14673F40CF4EA77913689A68501E67378511B34CAEF0360466F9F37AD29D3AB21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-11-03_739cc75d31d3a2e2f85c2ad002b58534_icedid_njrat_vidar

File Explorer

2026-11-03_739cc75d31d3a2e2f85c2ad002b58534_icedid_njrat_vidar

.exe 1.4MB

2026-11-03_739cc75d31d3a2e2f85c2ad002b58534_icedid_njrat_vidar

IMPHASH 8b0dca6e8f218b7a80dd00da128bc644
SHA256 10f9e17ac31b7ec9d1a96fc9458e9149bb49e82e32f3d7aa93c8f19d7dfd5232
MD5 739cc75d31d3a2e2f85c2ad002b58534
SHA1 6dc3bc548ba2d83880a50a36e29400c20be6a2da
SHA512 f54ad42dc51bb866866e2140207e49190736a70348556a14a00b64f47bc20b939da5ca595622fd28224366c34cc2b8729c4b51ea4e80d578dddf26a5989743a6
SSDEEP 12288:HZGSV+EB5PgRyeAtK20ks/87Eygl8BYj4dRG5SG1X+2Jk5efqyCNo:5P+S5I1KK2k0wfl8BYM/eNs27TCe
TLSH
T1DE65F14673F40CF4EA77913689A68501E67378511B34CAEF0360466F9F37AD29D3AB21
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

72628

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

F:\proj_20210312_BackgroundProcess_huawei\RtkAudService_modify\x64\Release\RtkAudioService.pdb

setupapi

SetupDiGetDeviceInterfaceDetailW SetupDiDestroyDeviceInfoList SetupDiGetDeviceRegistryPropertyW CM_Get_Res_Des_Data_Size CM_Get_Next_Res_Des CM_Free_Res_Des_Handle CM_Get_Device_IDW CM_Get_First_Log_Conf CM_Get_Res_Des_Data CM_Get_DevNode_Status SetupDiEnumDeviceInterfaces SetupDiGetClassDevsW SetupDiEnumDeviceInfo SetupDiGetDeviceInstanceIdW CM_Get_Parent

kernel32

HeapFree InitializeCriticalSectionAndSpinCount HeapSize GetLastError HeapReAlloc RaiseException HeapAlloc HeapDestroy DeleteCriticalSection GetProcessHeap SizeofResource DeviceIoControl WaitForSingleObject CreateFileW OpenProcess CreateToolhelp32Snapshot GetExitCodeThread ProcessIdToSessionId Process32NextW LockResource Process32FirstW CloseHandle FindResourceExW LoadResource FindResourceW GetConsoleCP WTSGetActiveConsoleSessionId CreateProcessW GetModuleHandleW MultiByteToWideChar WaitForMultipleObjects CreateEventW SetEvent CreateThread ResetEvent GetSystemDirectoryW Sleep LoadLibraryW FreeLibrary SetWaitableTimer EnterCriticalSection CreateWaitableTimerW LeaveCriticalSection LocalAlloc CancelWaitableTimer LocalFree FlushFileBuffers GetFileType WriteConsoleW SetEndOfFile GetConsoleMode FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW CompareStringW GetProcAddress ReadConsoleW ReadFile SetFilePointerEx GetFileSizeEx GetStringTypeW SetStdHandle GetCommandLineW GetCommandLineA WriteFile GetStdHandle GetModuleFileNameW GetModuleHandleExW ExitProcess LoadLibraryExW TlsFree GetSystemInfo VirtualProtect VirtualQuery LoadLibraryExA GetCurrentThreadId DuplicateHandle GetCurrentProcess IsDebuggerPresent OutputDebugStringW WaitForSingleObjectEx RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent GetStartupInfoW QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime InitializeSListHead WideCharToMultiByte RtlUnwindEx RtlPcToFileHeader SetLastError EncodePointer TlsAlloc TlsGetValue TlsSetValue LCMapStringW

user32

RegisterDeviceNotificationW UnregisterDeviceNotification

advapi32

SetServiceStatus RegisterServiceCtrlHandlerExW RegCreateKeyExW RegSetValueExW StartServiceCtrlDispatcherW RegNotifyChangeKeyValue LookupPrivilegeValueW AdjustTokenPrivileges RegCloseKey SetTokenInformation OpenProcessToken RegOpenKeyExW CreateProcessAsUserW DuplicateTokenEx RegQueryValueExW

shell32

SHGetFolderPathW

ole32

CoUninitialize CoSetProxyBlanket CoTaskMemFree CoCreateInstance CoInitializeSecurity CoInitializeEx StringFromGUID2 PropVariantClear

oleaut32

SysAllocString VariantInit SafeArrayAccessData VariantChangeType VariantClear SafeArrayUnaccessData SysFreeString

Sharing

General

Malware Config

Signatures

File Explorer

2026-11-03_739cc75d31d3a2e2f85c2ad002b58534_icedid_njrat_vidar

setupapi

kernel32

user32

advapi32

shell32

ole32

oleaut32

generic