2026-07-09_95303736708189fd230331a67622cbbe_icedid_njrat

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-09_95303736708189fd230331a67622cbbe_icedid_njrat
Size 3.0MB
Sample260709-cf75lsbw8n
SHA256 7292ab200b969a10a8264f85134d3baa5f5dee3287f0b7f4dbb49b8ff56e7fe1
MD5 95303736708189fd230331a67622cbbe
SHA1 887431dbaf3ecc34c5ef3e328d182700cfd6a84b
SHA512 db3b64ba4290289c69e241f54f3e0c21c9d77a1fccbcf21a626d5e0ccca142885cc6f5b49ce03d7ff8bc524569b842f2cf4e1e89c7310aa4e439d063d490d715
SSDEEP 24576:/ZHk2mkA+YffZD91qoGQDmqKCYedXpsj/H5Vivi3mdCuKV:xE2ufZZ1qo6qhd27iv1dhK
TLSH
T148E5D817E7B651D5D0BAC03DD563622AFD7134A6833897EBA2C18E461B60BE4EE3D340
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects executables Discord URL observed in first stage droppers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_DiscordURL

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-09_95303736708189fd230331a67622cbbe_icedid_njrat

File Explorer

2026-07-09_95303736708189fd230331a67622cbbe_icedid_njrat

.exe 3.0MB

2026-07-09_95303736708189fd230331a67622cbbe_icedid_njrat

IMPHASH c7463f7f0d9ef554000efabc9f42295e
SHA256 7292ab200b969a10a8264f85134d3baa5f5dee3287f0b7f4dbb49b8ff56e7fe1
MD5 95303736708189fd230331a67622cbbe
SHA1 887431dbaf3ecc34c5ef3e328d182700cfd6a84b
SHA512 db3b64ba4290289c69e241f54f3e0c21c9d77a1fccbcf21a626d5e0ccca142885cc6f5b49ce03d7ff8bc524569b842f2cf4e1e89c7310aa4e439d063d490d715
SSDEEP 24576:/ZHk2mkA+YffZD91qoGQDmqKCYedXpsj/H5Vivi3mdCuKV:xE2ufZZ1qo6qhd27iv1dhK
TLSH
T148E5D817E7B651D5D0BAC03DD563622AFD7134A6833897EBA2C18E461B60BE4EE3D340
MD5 SHA1 SHA512 SSDEEP TLSH

Detects executables Discord URL observed in first stage droppers
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1162638

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\USER\source\repos\WindowsProject1\x64\Debug\WindowsProject1.pdb

kernel32

Sleep CreateProcessW GetModuleFileNameA SetEndOfFile CreateFileW SetStdHandle SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW WaitForSingleObject GetCommandLineA GetTimeZoneInformation GetOEMCP GetACP IsValidCodePage GetExitCodeProcess ReadConsoleW SetFilePointerEx GetFileSizeEx ReadFile GetCommandLineW CloseHandle FormatMessageA WideCharToMultiByte LocalFree GetLocaleInfoEx SetCurrentDirectoryW GetCurrentDirectoryW CreateDirectoryW FindClose FindFirstFileW FindFirstFileExW FindNextFileW GetDiskFreeSpaceExW GetFileAttributesW GetFileAttributesExW GetFileInformationByHandle GetFinalPathNameByHandleW GetFullPathNameW SetFileAttributesW SetFileInformationByHandle SetFileTime GetTempPathW CreateFile2 AreFileApisANSI GetLastError DeviceIoControl GetModuleHandleW GetProcAddress CreateDirectoryExW CopyFile2 MoveFileExW CreateHardLinkW GetFileInformationByHandleEx CreateSymbolicLinkW MultiByteToWideChar EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer LCMapStringEx GetStringTypeW CompareStringEx GetCPInfo GetCurrentThreadId IsDebuggerPresent RaiseException QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime InitializeSListHead SetUnhandledExceptionFilter GetStartupInfoW HeapAlloc HeapFree GetProcessHeap VirtualQuery FreeLibrary RtlPcToFileHeader RtlLookupFunctionEntry RtlUnwindEx InterlockedPushEntrySList InterlockedFlushSList GetModuleFileNameW LoadLibraryExW SetLastError FlsAlloc FlsGetValue FlsSetValue FlsFree HeapSize HeapValidate GetSystemInfo GetCurrentProcess TerminateProcess GetModuleHandleExW IsProcessorFeaturePresent GetStdHandle WriteFile ExitProcess RtlCaptureContext RtlVirtualUnwind UnhandledExceptionFilter HeapReAlloc GetCurrentThread HeapQueryInformation GetFileType OutputDebugStringW WriteConsoleW SetConsoleCtrlHandler IsThreadAFiber VirtualProtect GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW FlushFileBuffers GetConsoleOutputCP GetConsoleMode RtlUnwind

user32

MessageBoxW SystemParametersInfoW

shell32

ShellExecuteW SHGetKnownFolderPath

ole32

CoTaskMemFree

bcrypt

BCryptFinishHash BCryptCloseAlgorithmProvider BCryptCreateHash BCryptHashData BCryptGetProperty BCryptDestroyHash BCryptOpenAlgorithmProvider

comctl32

ord345

Name

.textbss

Size

Virtual Size

1.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.text

Size

2.3MB

Virtual Size

2.3MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

409KB

Virtual Size

409KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

11KB

Virtual Size

19KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

109KB

Virtual Size

109KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

7KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.msvcjmc

Size

1024B

Virtual Size

983B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.00cfg

Size

512B

Virtual Size

373B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

1024B

Virtual Size

563B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

167KB

Virtual Size

167KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

16KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-09_95303736708189fd230331a67622cbbe_icedid_njrat

kernel32

user32

shell32

ole32

bcrypt

comctl32

generic