2026-11-09_89df59330d4acd032b89f2dad22cb14c_elex_icedid_njrat_vidar

General

Target
2026-11-09_89df59330d4acd032b89f2dad22cb14c_elex_icedid_njrat_vidar
Size 2.0MB
Sample261110-qq1eeaff82
SHA256 7b6d4dfc114525bfdea016ed074dfcc08186277e1f1cf05f4e08d32189665226
MD5 89df59330d4acd032b89f2dad22cb14c
SHA1 d6544cd51db859249b118dc4a832100ec30b585f
SHA512 5b843e9484104004975ba6b52e09e81a43f84d6cfd9c6ea135c741b1e0578340bafd28963f5271e672b698e83c413d2b310250735ee79cf4827c8257e07ca2c5
SSDEEP 24576:3eTU8OdeTU8Ot6keZtWQjxmDtaLg/DRZhf0deU/N9M+ugdM4WC6wK3Mu2Eo59FFv:3eOdeOt6kenWwmDta4S29VfWB
TLSH
T19CA54B1DEF944EEDDD720230C9A5A37D617ABC615A30E64F224C7A0DDE32F909936B12
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

aspackv2

Custom signature

Detects executables packed with ASPack 1 IoCs

resource	yara_rule
sample	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 1 IoCs

Detects executables packed with ASPack v2.12-2.42

resource	yara_rule
sample	aspack_v212_v242

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-11-09_89df59330d4acd032b89f2dad22cb14c_elex_icedid_njrat_vidar

SHA256 7b6d4dfc114525bfdea016ed074dfcc08186277e1f1cf05f4e08d32189665226
MD5 89df59330d4acd032b89f2dad22cb14c
SHA1 d6544cd51db859249b118dc4a832100ec30b585f
SHA512 5b843e9484104004975ba6b52e09e81a43f84d6cfd9c6ea135c741b1e0578340bafd28963f5271e672b698e83c413d2b310250735ee79cf4827c8257e07ca2c5
SSDEEP 24576:3eTU8OdeTU8Ot6keZtWQjxmDtaLg/DRZhf0deU/N9M+ugdM4WC6wK3Mu2Eo59FFv:3eOdeOt6kenWwmDta4S29VfWB
TLSH
T19CA54B1DEF944EEDDD720230C9A5A37D617ABC615A30E64F224C7A0DDE32F909936B12
MD5 SHA1 SHA512 SSDEEP TLSH

Detects executables packed with ASPack
ASPack v2.12-2.42

Detects executables packed with ASPack v2.12-2.42

aspackv2
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

36865

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths