2026-06-08_024afaebf7622109af2f9bebb17da747_icedid_njrat

Sharing

Copy URL Twitter E-mail

General

Target
2026-06-08_024afaebf7622109af2f9bebb17da747_icedid_njrat
Size 18.6MB
Sample260608-vcrmkact5x
SHA256 a1f1346005cd978b353f85a710b9d103a33cfc191dc79764fb887eb1f713497d
MD5 024afaebf7622109af2f9bebb17da747
SHA1 2ba70b98b2c49e96726fcc67c28227c4685f6331
SHA512 33efc8ce2ade4b9df49561014ba035e7e4dd9d9987c35490dfdae9c92db47aadcbbf4a341d31115878cb94f55f525b72fa23bf529f6b588a38b42844fd96e767
SSDEEP 393216:nE5A4axjvwjEGmwo+IhYV9wfAW0u9U1dmuadTT8:iu0EGmwoYV9mAW+18uq8
TLSH
T10B1701C7BE4101ACD59ED0784FAFAE5986227C641B34E1FF528672B62A3657C0F39702
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-06-08_024afaebf7622109af2f9bebb17da747_icedid_njrat

File Explorer

2026-06-08_024afaebf7622109af2f9bebb17da747_icedid_njrat

.exe 18.6MB

2026-06-08_024afaebf7622109af2f9bebb17da747_icedid_njrat

IMPHASH 274f0403f144ff7f33cff898b54b0a61
SHA256 a1f1346005cd978b353f85a710b9d103a33cfc191dc79764fb887eb1f713497d
MD5 024afaebf7622109af2f9bebb17da747
SHA1 2ba70b98b2c49e96726fcc67c28227c4685f6331
SHA512 33efc8ce2ade4b9df49561014ba035e7e4dd9d9987c35490dfdae9c92db47aadcbbf4a341d31115878cb94f55f525b72fa23bf529f6b588a38b42844fd96e767
SSDEEP 393216:nE5A4axjvwjEGmwo+IhYV9wfAW0u9U1dmuadTT8:iu0EGmwoYV9mAW+18uq8
TLSH
T10B1701C7BE4101ACD59ED0784FAFAE5986227C641B34E1FF528672B62A3657C0F39702
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

17931936

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\gl\builds\cfx-fivem-0\.build-cache\bin\lapsus\release\dbg\loader.pdb

d3d11

D3D11CreateDevice D3D11CreateDeviceAndSwapChain

d3dcompiler_47

D3DCompile

iphlpapi

GetAdaptersAddresses

shell32

SHGetFolderPathW ShellExecuteW

winmm

mciSendStringA

ole32

CreateStreamOnHGlobal CoInitializeEx CoCreateInstance CoInitialize CoUninitialize

oleaut32

VariantClear SysFreeString SysAllocString VariantInit

ntdll

RtlLookupFunctionEntry RtlVirtualUnwind RtlUnwindEx RtlUnwind VerSetConditionMask RtlPcToFileHeader RtlCaptureContext

kernel32

QueryPerformanceCounter SetProcessMitigationPolicy GetCurrentProcessId Process32NextW GetModuleHandleW CreateFileW Process32FirstW QueryPerformanceFrequency CreateThread WideCharToMultiByte InitializeCriticalSection HeapAlloc VirtualAlloc GetTickCount64 GetCurrentProcess CloseHandle Sleep HeapFree MapViewOfFile MultiByteToWideChar lstrcpynW WaitForSingleObject ReadFile GetFileSizeEx lstrcpynA GetTickCount TerminateProcess GetLastError MoveFileExA UpdateProcThreadAttribute QueryFullProcessImageNameA InitializeProcThreadAttributeList DeleteFileA CreateProcessA GetFileAttributesA GetModuleFileNameA DeleteProcThreadAttributeList Module32NextW GetTempPathA GetModuleHandleA GetEnvironmentVariableA GetExitCodeThread GetTempPathW CreateDirectoryA GetTempFileNameA MoveFileA DeleteFileW FreeLibrary Module32FirstW LocalAlloc WriteFile GetCurrentThreadId EnterCriticalSection LeaveCriticalSection GetVolumeInformationW GetSystemFirmwareTable GetSystemInfo GetCurrentThread GetThreadContext GlobalMemoryStatusEx GlobalAlloc GlobalUnlock CreateFileMappingW GlobalFree LoadLibraryA GetLocaleInfoA FlsGetValue FlsAlloc GetStdHandle GetModuleFileNameW GetModuleHandleExW FreeLibraryAndExitThread ExitThread LoadLibraryExW TlsFree TlsSetValue TlsGetValue TlsAlloc CreateToolhelp32Snapshot SetLastError RaiseException GetCPInfo GetStringTypeW LCMapStringEx DeleteCriticalSection InitializeCriticalSectionEx DecodePointer EncodePointer GetLocaleInfoEx GetFileInformationByHandleEx IsValidLocale AreFileApisANSI SetFileInformationByHandle FindNextFileW EnumSystemLocalesW FindFirstFileExW GetUserDefaultLCID GetSystemDirectoryW VirtualProtect ProcessIdToSessionId CreateFileA LoadLibraryW QueryFullProcessImageNameW GetProcessHeap OpenProcess VirtualFree ExitProcess LocalFree GetProcAddress FlsSetValue FlsFree SetStdHandle HeapReAlloc HeapSize WriteConsoleW GetFileType FlushFileBuffers LCMapStringW GetLocaleInfoW InitializeCriticalSectionAndSpinCount GetComputerNameW SetEndOfFile GetConsoleOutputCP GlobalLock GetConsoleMode FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP GetACP IsValidCodePage SetFilePointerEx ReadConsoleW ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW GetSystemTimeAsFileTime InitializeSListHead FormatMessageA TryAcquireSRWLockExclusive FindClose

user32

SetCursorPos AdjustWindowRectEx GetPropA SetPropA GetForegroundWindow IsWindowUnicode GetCapture GetKeyState SetFocus BringWindowToTop IsIconic SetLayeredWindowAttributes IsChild GetMessageExtraInfo TrackMouseEvent GetKeyboardLayout EmptyClipboard GetClipboardData SetClipboardData CloseClipboard OpenClipboard EnumDisplayMonitors EnumDisplayDevicesW SendMessageW BeginPaint ClientToScreen EndPaint LoadCursorW WaitForInputIdle FillRect SetCapture RegisterClassExW SetWindowRgn DispatchMessageW ReleaseDC MessageBoxA ShowWindow GetCursorPos ReleaseCapture SetWindowPos PeekMessageW DefWindowProcW GetDC TranslateMessage UpdateWindow SystemParametersInfoW UnregisterClassW GetWindowRect PostQuitMessage DestroyWindow CreateWindowExW ScreenToClient WindowFromPoint GetWindowLongW SetWindowLongW SetWindowLongPtrW GetMonitorInfoW SetCursor GetClientRect SetForegroundWindow MonitorFromWindow

gdi32

DeleteObject BitBlt CreateCompatibleBitmap CreateCompatibleDC GetDIBits GetDeviceCaps CreateSolidBrush SetBkColor CreateFontW SetTextColor CreateRoundRectRgn SelectObject DeleteDC

advapi32

IsWellKnownSid GetUserNameW GetTokenInformation ConvertSidToStringSidW SetSecurityDescriptorDacl GetLengthSid AddAccessDeniedAce FreeSid SetKernelObjectSecurity InitializeSecurityDescriptor SetSecurityDescriptorSacl AllocateAndInitializeSid OpenProcessToken

comctl32

InitCommonControlsEx

imm32

ImmReleaseContext ImmSetCompositionWindow ImmSetCandidateWindow ImmGetContext

Name

lprotect

Size

17.7MB

Virtual Size

17.7MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.data

Size

829KB

Virtual Size

845KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

51KB

Virtual Size

50KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

10KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

488B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

48KB

Virtual Size

47KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-06-08_024afaebf7622109af2f9bebb17da747_icedid_njrat

d3d11

d3dcompiler_47

iphlpapi

shell32

winmm

ole32

oleaut32

ntdll

kernel32

user32

gdi32

advapi32

comctl32

imm32

generic