2026-11-06_fcb4d25b67c188174208c88d77d34942_icedid_njrat_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-11-06_fcb4d25b67c188174208c88d77d34942_icedid_njrat_vidar
Size 338KB
Sample261107-wjkchazzbv
SHA256 df350bfecf5ac9e477f1cce2272a936df07da2e4351d5cd364b4c6c74f3f2434
MD5 fcb4d25b67c188174208c88d77d34942
SHA1 d15958f799fe5e31e06fb9f3a5250a44cdfd0362
SHA512 7b0449782fdd0b95d69a1aeebf8bc5c1028949b4572432ea80b13ab065f941a904baecf6932e0bed9803c275e71e978237319feb8a6c71080c6feefdeef670c4
SSDEEP 6144:TRc/G3oKaL9WcgnMIRIwo1igg1NBice1sTAQOehTlO+8RTZWVtSUa:QLgrCB1igsNBfcsc+ZOnZxB
TLSH
T1FB744A4D73B428F9E6B78638C6158112D772B8611B20E7AF16E0C27A9F23791AD3DF11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-11-06_fcb4d25b67c188174208c88d77d34942_icedid_njrat_vidar

File Explorer

2026-11-06_fcb4d25b67c188174208c88d77d34942_icedid_njrat_vidar

.exe 338KB

2026-11-06_fcb4d25b67c188174208c88d77d34942_icedid_njrat_vidar

IMPHASH cc2e379858ad0c315aa4785113a29fb7
SHA256 df350bfecf5ac9e477f1cce2272a936df07da2e4351d5cd364b4c6c74f3f2434
MD5 fcb4d25b67c188174208c88d77d34942
SHA1 d15958f799fe5e31e06fb9f3a5250a44cdfd0362
SHA512 7b0449782fdd0b95d69a1aeebf8bc5c1028949b4572432ea80b13ab065f941a904baecf6932e0bed9803c275e71e978237319feb8a6c71080c6feefdeef670c4
SSDEEP 6144:TRc/G3oKaL9WcgnMIRIwo1igg1NBice1sTAQOehTlO+8RTZWVtSUa:QLgrCB1igsNBfcsc+ZOnZxB
TLSH
T1FB744A4D73B428F9E6B78638C6158112D772B8611B20E7AF16E0C27A9F23791AD3DF11
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

49760

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

rollback.pdb

advapi32

RegOpenKeyExW RegCloseKey RegQueryValueExW RegSetValueExW �� E3�H�D$ H�j� H��`H�E03�A� ��H�\$ UVWH��H��`H�E03�A�

kernel32

GlobalFree GlobalAlloc �H��$� ��Ϲ d$xE��M��H��A� TAUAVAWH�� GetCurrentThreadId � 0� H�\$8E3�H�D$0� �t$HH�ȉ|$@H�+� �: � ��M H�M0H�� H�� u � �D$(�D$ } 8E3�H�D$0� � CreateThread GetLastError GetModuleFileNameW GetFileAttributesW CopyFileW HeapFree GetProcessHeap CreateProcessW CloseHandle CreateDirectoryW LoadLibraryW GetModuleHandleW GetWindowsDirectoryW CreateFileW WriteFile CreateMutexW SetLastError GetProcAddress FreeLibrary WaitForSingleObject GetTickCount GetFullPathNameW SetCurrentDirectoryW

gdi32

SetBrushOrgEx CreateFontIndirectW SetTextAlign GetStockObject DeleteObject CreateCompatibleDC SelectObject GetObjectW SetStretchBltMode SetBkMode StretchBlt DeleteDC SetTextColor GetTextAlign

user32

DrawTextW LoadImageW DefWindowProcW PostQuitMessage DestroyWindow KillTimer UnregisterHotKey EndPaint BeginPaint SetWindowPos InvalidateRect SetTimer GetClientRect DispatchMessageW GetMessageW PostThreadMessageW UpdateWindow RegisterHotKey ShowWindow LoadCursorFromFileW LoadStringW MessageBoxW FindWindowW UnregisterClassW GetSystemMetrics CreateWindowExW RegisterClassW LoadCursorW PeekMessageW WaitMessage SendMessageW

msvcrt

�$� �� $� �k� d$H�|$@H�\$8H�b� �D$(�D$ � D D $0H�� __C_specific_handler wcsrchr ?terminate@@YAXXZ _commode _fmode _wcmdln _initterm __setusermatherr _cexit _exit exit __set_app_type __wgetmainargs _amsg_exit _XcptFilter wcschr wcsstr _vsnwprintf

ntdll

RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind �\$ L��L�+� ��$� �� $xH��u

comctl32

ord17

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW �� D

wdscore

WdsInitialize WdsTerminate WdsCreateBlackboard WdsDestroyBlackboard WdsSetupLogMessageW ConstructPartialMsgVW CurrentIP H��a �H��$�

??0ArgumentNullException@UnBCL@@QEAA@PEBG@Z ??1Object@UnBCL@@UEAA@XZ ??0Object@UnBCL@@QEAA@XZ ?AddStackTrace@Exception@UnBCL@@QEAAXPEBD@Z ??0?$SmartPtr@VString@UnBCL@@@UnBCL@@QEAA@XZ ?ToString@Exception@UnBCL@@UEBAPEAVString@2@XZ ?FromASCII@String@UnBCL@@SAPEAV12@PEBD@Z ?FormatV@String@UnBCL@@SAPEAV12@PEBGPEAD@Z ?Concat@String@UnBCL@@SAPEAV12@PEBG00@Z ??3Object@UnBCL@@SAXPEAX@Z ??2Object@UnBCL@@SAPEAX_K@Z ?CreateDir@Directory@UnBCL@@SAPEAVDirectoryInfo@2@PEBVString@2@@Z ?set_HResult@Exception@UnBCL@@MEAAXJ@Z ?get_HResult@Exception@UnBCL@@UEBAJXZ ?GetBaseException@Exception@UnBCL@@UEBAPEBV12@XZ ?set_Source@Exception@UnBCL@@UEAAXPEBVString@2@@Z ?get_Source@Exception@UnBCL@@UEBAPEBVString@2@XZ ?get_Message@Exception@UnBCL@@UEBAPEBVString@2@XZ ?get_InnerException@Exception@UnBCL@@UEBAPEBV12@XZ program cannot be run in DOS mode. $ mp[�qZ�mp[�mq[ lp[�xZ�mp[��[�mp[�rZ�mp[Rich�mp[ mp[Rich�mp[ ( � ?Combine@Path@UnBCL@@SAPEAVString@2@PEBV32@0@Z ??1?$SmartPtr@VString@UnBCL@@@UnBCL@@UEAA@XZ ??0?$SmartPtr@VString@UnBCL@@@UnBCL@@QEAA@PEAVString@1@@Z ?SetMessage@Exception@UnBCL@@MEAAXPEAVString@2@@Z ?Clone@Object@UnBCL@@UEBAPEAV12@XZ ?Exists@Directory@UnBCL@@SAHPEBVString@2@@Z ??C?$SmartPtr@VString@UnBCL@@@UnBCL@@QEBAPEAVString@1@XZ ?get_CString@String@UnBCL@@QEBAPEBGXZ ?get_P@?$SmartPtr@VString@UnBCL@@@UnBCL@@QEBAPEAVString@2@XZ ??1String@UnBCL@@UEAA@XZ ??0String@UnBCL@@QEAA@PEBG@Z ??4?$SmartPtr@VString@UnBCL@@@UnBCL@@QEAAAEAV01@AEBV01@@Z

Name

.text

Size

49KB

Virtual Size

48KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

33KB

Virtual Size

32KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

1KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.didat

Size

512B

Virtual Size

64B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

29KB

Virtual Size

28KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

512B

Virtual Size

312B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-11-06_fcb4d25b67c188174208c88d77d34942_icedid_njrat_vidar

advapi32

kernel32

gdi32

user32

msvcrt

ntdll

comctl32

version

wdscore

generic