2026-07-03_3f2c62eb848a8a51b91e1b26f54996e8_icedid_njrat_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-03_3f2c62eb848a8a51b91e1b26f54996e8_icedid_njrat_stealc
Size 2.8MB
Sample260703-l77gtsfs21
SHA256 22f19427ba381bee79d8c5fabbddbd0846a9599e25a8faef83eb344c0f797358
MD5 3f2c62eb848a8a51b91e1b26f54996e8
SHA1 583d68d1bcde2347b1651f7270d335ea756263d0
SHA512 249da46ee5460b8038f2dbaf1f488cdf4670fb721d53b91bac3c93e34cd23a37fbf394ba3b2c304af9bc1274378eb1edbb3cd31eb48458c64a4109044996050f
SSDEEP 49152:YvLZ3dAM/bXiqevF2ewOBlQvptO0ApCnGhpU1LdhIf+03:WGFYFHGh0r2
TLSH
T155D5C057A3B800F8C0A7C178CA465517EAB2780507759BDB16D086EA6F23FE25B7E730
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_Binary_References_Browsers

Detects executables Discord URL observed in first stage droppers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_DiscordURL

Detects executables containing SQL queries to confidential data stores. Observed in infostealers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-03_3f2c62eb848a8a51b91e1b26f54996e8_icedid_njrat_stealc

File Explorer

2026-07-03_3f2c62eb848a8a51b91e1b26f54996e8_icedid_njrat_stealc

.exe 2.8MB

2026-07-03_3f2c62eb848a8a51b91e1b26f54996e8_icedid_njrat_stealc

IMPHASH a0832d184cddd871a2e88052b9c77b23
SHA256 22f19427ba381bee79d8c5fabbddbd0846a9599e25a8faef83eb344c0f797358
MD5 3f2c62eb848a8a51b91e1b26f54996e8
SHA1 583d68d1bcde2347b1651f7270d335ea756263d0
SHA512 249da46ee5460b8038f2dbaf1f488cdf4670fb721d53b91bac3c93e34cd23a37fbf394ba3b2c304af9bc1274378eb1edbb3cd31eb48458c64a4109044996050f
SSDEEP 49152:YvLZ3dAM/bXiqevF2ewOBlQvptO0ApCnGhpU1LdhIf+03:WGFYFHGh0r2
TLSH
T155D5C057A3B800F8C0A7C178CA465517EAB2780507759BDB16D086EA6F23FE25B7E730
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers
Detects executables Discord URL observed in first stage droppers
Detects executables containing SQL queries to confidential data stores. Observed in infostealers
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1293212

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

winhttp

WinHttpReceiveResponse WinHttpOpen WinHttpQueryHeaders WinHttpReadData WinHttpOpenRequest WinHttpSetOption WinHttpCloseHandle WinHttpSendRequest WinHttpSetTimeouts WinHttpConnect WinHttpCrackUrl WinHttpQueryDataAvailable

crypt32

CryptUnprotectData CryptStringToBinaryA

bcrypt

BCryptGenerateSymmetricKey BCryptOpenAlgorithmProvider BCryptDecrypt BCryptCloseAlgorithmProvider BCryptSetProperty BCryptDestroyKey

shell32

SHGetFolderPathW CommandLineToArgvW

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

advapi32

GetUserNameW

kernel32

FlsSetValue FlsGetValue FlsAlloc FlsFree SetFilePointerEx GetFileSizeEx WriteConsoleW GetFileType VirtualProtect SetStdHandle SetEnvironmentVariableW GetEnvironmentStringsW GetOEMCP GetACP IsValidCodePage GetTimeZoneInformation ReadConsoleW GetConsoleMode GetConsoleOutputCP GetCommandLineA ExitProcess GetModuleHandleExW FreeLibraryAndExitThread ExitThread CreateThread FreeEnvironmentStringsW ExpandEnvironmentStringsW GetCommandLineW SetConsoleTitleA GetTempPathW Sleep LocalFree WideCharToMultiByte AllocConsole MultiByteToWideChar GetComputerNameW GlobalMemoryStatusEx GetSystemTime GetModuleFileNameW WaitForSingleObject GetLastError CloseHandle CreateProcessW OutputDebugStringA OutputDebugStringW AreFileApisANSI ReadFile TryEnterCriticalSection HeapCreate HeapFree EnterCriticalSection GetFullPathNameW WriteFile GetDiskFreeSpaceW LockFile LeaveCriticalSection InitializeCriticalSection SetFilePointer GetFullPathNameA SetEndOfFile UnlockFileEx CreateMutexW CreateFileW GetFileAttributesW GetCurrentThreadId UnmapViewOfFile HeapValidate HeapSize GetTempPathA FormatMessageW GetDiskFreeSpaceA GetFileAttributesA GetFileAttributesExW FlushViewOfFile CreateFileA LoadLibraryA WaitForSingleObjectEx DeleteFileA DeleteFileW HeapReAlloc RaiseException GetSystemInfo LoadLibraryW HeapAlloc HeapCompact HeapDestroy UnlockFile GetProcAddress LockFileEx GetFileSize DeleteCriticalSection GetCurrentProcessId GetProcessHeap SystemTimeToFileTime FreeLibrary GetSystemTimeAsFileTime FormatMessageA CreateFileMappingW MapViewOfFile QueryPerformanceCounter GetTickCount FlushFileBuffers SetConsoleTextAttribute GetConsoleScreenBufferInfo GetStdHandle SetConsoleOutputCP CreateNamedPipeW PeekNamedPipe ConnectNamedPipe GetModuleHandleW LoadLibraryExW TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount SetLastError EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetLocaleInfoEx CreateDirectoryW FindClose FindFirstFileW FindFirstFileExW FindNextFileW GetFileInformationByHandle SetFileInformationByHandle CopyFileW GetFileInformationByHandleEx GetStringTypeW GetExitCodeThread InitializeCriticalSectionEx EncodePointer DecodePointer LCMapStringEx ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW CompareStringEx GetCPInfo UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW InitializeSListHead

ntdll

RtlVirtualUnwind RtlUnwind RtlLookupFunctionEntry RtlUnwindEx RtlPcToFileHeader RtlCaptureContext

Name

.text

Size

1.4MB

Virtual Size

1.4MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.3MB

Virtual Size

1.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

21KB

Virtual Size

32KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

60KB

Virtual Size

59KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-03_3f2c62eb848a8a51b91e1b26f54996e8_icedid_njrat_stealc

winhttp

crypt32

bcrypt

shell32

version

advapi32

kernel32

ntdll

generic