2026-11-11_4fd2f36fdee82ebe0508740d28273d3d_icedid_njrat_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-11-11_4fd2f36fdee82ebe0508740d28273d3d_icedid_njrat_vidar
Size 1.6MB
Sample261113-pr4msaby8n
SHA256 0946ebf90c9c682b3e4019a0ee63c53035d84076e618a327d59dd151bc5b5e38
MD5 4fd2f36fdee82ebe0508740d28273d3d
SHA1 88142c4e762929185256d541b41557e7413a3afb
SHA512 38e809f1fc7b4c027ec8f93fdae2d611091351efe04758341b5ffe860b1af4fcf483dc60eaad481bd71fbc5b5ce2e0ee4152394c8324e7b35c4a690b923a155d
SSDEEP 24576:WedlUG6t+tHUg2vwrdFMF+4+mIJz5IcuMlQHJxrDiSi:D5JAwZFMwisGcnlQHPxi
TLSH
T15F75DF29B76801F6D077D13889838946E77578160B31DBDB12D8E33A3E379D19E3AB21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-11-11_4fd2f36fdee82ebe0508740d28273d3d_icedid_njrat_vidar

File Explorer

2026-11-11_4fd2f36fdee82ebe0508740d28273d3d_icedid_njrat_vidar

.exe 1.6MB

2026-11-11_4fd2f36fdee82ebe0508740d28273d3d_icedid_njrat_vidar

IMPHASH 4427ecb33587083d600fa1b97a43dcc5
SHA256 0946ebf90c9c682b3e4019a0ee63c53035d84076e618a327d59dd151bc5b5e38
MD5 4fd2f36fdee82ebe0508740d28273d3d
SHA1 88142c4e762929185256d541b41557e7413a3afb
SHA512 38e809f1fc7b4c027ec8f93fdae2d611091351efe04758341b5ffe860b1af4fcf483dc60eaad481bd71fbc5b5ce2e0ee4152394c8324e7b35c4a690b923a155d
SSDEEP 24576:WedlUG6t+tHUg2vwrdFMF+4+mIJz5IcuMlQHJxrDiSi:D5JAwZFMwisGcnlQHPxi
TLSH
T15F75DF29B76801F6D077D13889838946E77578160B31DBDB12D8E33A3E379D19E3AB21
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

154816

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

c:\phantompdfci\jenkins\workspace\TAA-PH-AUTO-COMPILE\Starship\11.0-release\librel\64BitMailAgent.pdb

rpcrt4

RpcStringFreeW UuidToStringW

msi

ord195 ord109

kernel32

MultiByteToWideChar Sleep WideCharToMultiByte RemoveDirectoryW DeleteFileW WaitForSingleObject CloseHandle GetCurrentProcess GetNativeSystemInfo GetProcAddress FreeLibrary IsWow64Process CreateDirectoryW GetTempPathW GetFileAttributesW SetFileAttributesW GetLastError CopyFileW GetTempFileNameW GetModuleHandleExW GetSystemDirectoryW LoadLibraryA LoadLibraryW SetDllDirectoryW GetCommandLineW OpenProcess GetCurrentProcessId CreateProcessW WaitForMultipleObjects CreateMutexW ReleaseMutex UnmapViewOfFile CreateEventW SetEvent CreateFileMappingW MapViewOfFile EnumSystemLocalesW WriteConsoleW HeapSize CreateFileW ReadConsoleW SetStdHandle SetEndOfFile ReadFile SetFilePointerEx GetProcessHeap ExpandEnvironmentStringsW TlsSetValue FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetOEMCP IsValidCodePage FindNextFileA FindFirstFileExA GetUserDefaultLCID IsValidLocale FindClose GetStringTypeW EnterCriticalSection LeaveCriticalSection DeleteCriticalSection SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsFree GetSystemTimeAsFileTime GetModuleHandleW EncodePointer DecodePointer GetCPInfo CompareStringW LCMapStringW GetLocaleInfoW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW QueryPerformanceCounter GetCurrentThreadId InitializeSListHead LocalFree RtlUnwindEx RtlPcToFileHeader RaiseException LoadLibraryExW CreateThread ExitThread FreeLibraryAndExitThread HeapAlloc HeapFree HeapReAlloc ExitProcess GetModuleFileNameA GetStdHandle WriteFile GetACP GetFileType FlushFileBuffers GetConsoleCP GetConsoleMode

user32

PeekMessageW TranslateMessage EnableWindow DispatchMessageW AllowSetForegroundWindow

advapi32

RegOpenKeyExW RegQueryValueExW RegQueryValueExA

shell32

CommandLineToArgvW

ole32

CoCreateGuid

oleaut32

VariantClear

Name

.text

Size

303KB

Virtual Size

302KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

138KB

Virtual Size

137KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

7KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

17KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

1.2MB

Virtual Size

1.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-11-11_4fd2f36fdee82ebe0508740d28273d3d_icedid_njrat_vidar

rpcrt4

msi

kernel32

user32

advapi32

shell32

ole32

oleaut32

generic