2026-07-14_0b3c617b93861ed95611d5df6c020fce_icedid_njrat

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-14_0b3c617b93861ed95611d5df6c020fce_icedid_njrat
Size 3.8MB
Sample260714-e7mn4aet6r
SHA256 8589a7e63fbcb32760140431b18d27d520138f2cda4bac7de7bce6421c8ef078
MD5 0b3c617b93861ed95611d5df6c020fce
SHA1 9bc5031437fc94055a4c91bb3f9765fa008c0d9f
SHA512 fa7f6df7f7d0c6d1fd7d9b35ce18beb167d9747f4aa4582596990738060e2b5fc39f8d6cda2a2e7d3244151041e621a97e33c84473f365a49160083515b76561
SSDEEP 49152:ku8pzHk5IUB14yRRPONpWUr2hW281IvAtSApRf2uY/npuid:kHpk8X2hb81IvAS
TLSH
T13D06AF1A73A921C8E177A13D96D79B0BD6713C0417A093DF02D0669C2B77EE90ABFB11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects executables containing anti-forensic artifacts of deleting USN change journal. Observed in r 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_USNDeleteJournal

Detects executables containing commands for clearing Windows Event Logs 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_ClearWinLogs

Detects executables referencing many IR and analysis tools 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_References_SecTools

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-14_0b3c617b93861ed95611d5df6c020fce_icedid_njrat

File Explorer

2026-07-14_0b3c617b93861ed95611d5df6c020fce_icedid_njrat

.exe 3.8MB

2026-07-14_0b3c617b93861ed95611d5df6c020fce_icedid_njrat

IMPHASH b2f72943be28591ff16282dd4149966b
SHA256 8589a7e63fbcb32760140431b18d27d520138f2cda4bac7de7bce6421c8ef078
MD5 0b3c617b93861ed95611d5df6c020fce
SHA1 9bc5031437fc94055a4c91bb3f9765fa008c0d9f
SHA512 fa7f6df7f7d0c6d1fd7d9b35ce18beb167d9747f4aa4582596990738060e2b5fc39f8d6cda2a2e7d3244151041e621a97e33c84473f365a49160083515b76561
SSDEEP 49152:ku8pzHk5IUB14yRRPONpWUr2hW281IvAtSApRf2uY/npuid:kHpk8X2hb81IvAS
TLSH
T13D06AF1A73A921C8E177A13D96D79B0BD6713C0417A093DF02D0669C2B77EE90ABFB11
MD5 SHA1 SHA512 SSDEEP TLSH

Detects executables containing anti-forensic artifacts of deleting USN change journal. Observed in r
Detects executables containing commands for clearing Windows Event Logs
Detects executables referencing many IR and analysis tools
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

40916

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\Vrvez\Downloads\FAN1TY_rebuild\FAN1TY\out\build\x64-Release\FAN1TY.pdb

dwmapi

DwmSetWindowAttribute

shell32

ShellExecuteW SHGetFolderPathW Shell_NotifyIconA

opengl32

glViewport wglCreateContext wglDeleteContext wglGetProcAddress wglMakeCurrent wglShareLists glBindTexture glBlendFunc glColorPointer glDisable glDisableClientState glDrawElements glEnable glEnableClientState glGetIntegerv glGetTexEnviv glLoadIdentity glMatrixMode glOrtho glPolygonMode glPopAttrib glPopMatrix glPushAttrib glPushMatrix glScissor glShadeModel glTexCoordPointer glTexEnvi glVertexPointer

winmm

timeGetDevCaps joyGetDevCapsW joyGetPosEx timeEndPeriod timeBeginPeriod

gdi32

CreateBitmap DeleteObject CreateDIBSection CreateRoundRectRgn GetDeviceCaps ChoosePixelFormat SwapBuffers SetPixelFormat GetPixelFormat DescribePixelFormat

kernel32

HeapAlloc HeapFree GetCurrentThread GetCommandLineW GetCommandLineA GetStdHandle ReadFile GetModuleHandleExW FreeLibraryAndExitThread ResumeThread ExitThread LoadLibraryExW TlsFree TlsSetValue TlsGetValue WriteConsoleW FlsAlloc FlsGetValue FlsSetValue FlsFree IsThreadAFiber VirtualProtect GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW CreateFileA CreateFileW DeleteFileW FindClose FindFirstFileW FindNextFileW FlushFileBuffers GetFileAttributesA GetFileSizeEx RemoveDirectoryW SetEndOfFile SetFilePointer WriteFile GetTempPathW CloseHandle QueryPerformanceCounter QueryPerformanceFrequency InitializeCriticalSection DeleteCriticalSection SetEvent ReleaseMutex WaitForSingleObject CreateMutexW CreateEventA CreateEventW Sleep GetCurrentProcessId ExitProcess TerminateProcess CreateThread CreateProcessA OpenProcess GetTickCount64 GetModuleFileNameA GetModuleFileNameW GetModuleHandleA QueryFullProcessImageNameA MultiByteToWideChar WideCharToMultiByte SetConsoleTitleA GetConsoleWindow CreateToolhelp32Snapshot Process32FirstW Process32NextW FreeLibrary GetModuleHandleW GetProcAddress LoadLibraryW LoadLibraryA GetLastError IsValidLocale FormatMessageW OutputDebugStringA GlobalAlloc GlobalUnlock GlobalLock GlobalFree TlsAlloc InitializeCriticalSectionAndSpinCount SetLastError InterlockedFlushSList InterlockedPushEntrySList RtlUnwindEx RaiseException RtlPcToFileHeader InitializeSListHead GetCurrentProcess IsProcessorFeaturePresent GetStartupInfoW SetUnhandledExceptionFilter UnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext GetCPInfo CompareStringEx LCMapStringEx DecodePointer EncodePointer SleepConditionVariableSRW WakeAllConditionVariable WakeConditionVariable CloseThreadpoolWait SetThreadpoolWait CreateThreadpoolWait CloseThreadpoolTimer WaitForThreadpoolTimerCallbacks SetThreadpoolTimer CreateThreadpoolTimer FreeLibraryWhenCallbackReturns GetSystemTimeAsFileTime GetCurrentProcessorNumber FlushProcessWriteBuffers CreateSemaphoreExW CreateEventExW InitOnceExecuteOnce InitializeCriticalSectionEx LeaveCriticalSection EnterCriticalSection GetStringTypeW CreateSymbolicLinkW GetFileInformationByHandleEx CreateHardLinkW MoveFileExW CopyFileW CreateDirectoryExW DeviceIoControl AreFileApisANSI GetOEMCP SetFileTime SetFileInformationByHandle SetFileAttributesW GetFullPathNameW GetFinalPathNameByHandleW GetFileInformationByHandle GetFileAttributesExW GetFileAttributesW GetDiskFreeSpaceExW FindFirstFileExW CreateDirectoryW GetCurrentDirectoryW SetCurrentDirectoryW GetLocaleInfoEx TryAcquireSRWLockExclusive AcquireSRWLockExclusive ReleaseSRWLockExclusive FormatMessageA GetNativeSystemInfo GetExitCodeThread GetCurrentThreadId SwitchToThread WaitForSingleObjectEx HeapSize GetUserDefaultLCID EnumSystemLocalesW GetFileType GetConsoleOutputCP GetConsoleMode SetFilePointerEx ReadConsoleW HeapReAlloc SetConsoleCtrlHandler SetStdHandle OutputDebugStringW GetProcessHeap SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetTimeZoneInformation IsValidCodePage GetACP LocalFree RtlUnwind

user32

RegisterDeviceNotificationW SendMessageW PeekMessageW DispatchMessageW TrackMouseEvent CreateIconIndirect DestroyCursor LoadCursorW ReleaseDC GetDC EnumDisplaySettingsW LoadIconA CallNextHookEx UnhookWindowsHookEx SetWindowsHookExA GetWindowThreadProcessId EnumWindows GetClassLongPtrA SetWindowLongPtrA GetWindowLongPtrA ScreenToClient GetWindowTextLengthA CallWindowProcW SetWindowTextA SetWindowRgn SetForegroundWindow GetForegroundWindow MsgWaitForMultipleObjects MapVirtualKeyA SendInput GetAsyncKeyState IsWindowVisible SetWindowDisplayAffinity ShowWindow IsWindow CallWindowProcA PeekMessageA DispatchMessageA TranslateMessage wsprintfW RegisterClassW GetKeyNameTextW GetSystemMetrics SetCursorPos GetCursorPos ClientToScreen UnregisterClassW CreateWindowExW DestroyWindow FlashWindowEx SetWindowPos GetKeyState MapVirtualKeyW GetCapture ReleaseCapture GetMenu SetWindowTextW GetClientRect GetWindowRect AdjustWindowRect AdjustWindowRectEx SetCursor MapWindowPoints ClipCursor GetWindowLongPtrW SetWindowLongPtrW CreateIcon DestroyIcon ChangeDisplaySettingsW GetRawInputData RegisterRawInputDevices CreateWindowExA OpenClipboard CloseClipboard SetClipboardData GetClipboardData DefWindowProcW EmptyClipboard GetWindowTextA IsClipboardFormatAvailable SetCapture

advapi32

RegCloseKey RegCreateKeyExW RegSetValueExA RegSetValueExW RegGetValueA RegQueryValueExW RegOpenKeyExW RegCreateKeyExA

winhttp

WinHttpOpenRequest WinHttpConnect WinHttpCloseHandle WinHttpOpen WinHttpSendRequest

imm32

ImmGetContext ImmReleaseContext ImmSetCompositionWindow ImmSetCandidateWindow

Name

.text

Size

3.0MB

Virtual Size

3.0MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

567KB

Virtual Size

566KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

17KB

Virtual Size

87KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

131KB

Virtual Size

130KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

15KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.00cfg

Size

512B

Virtual Size

373B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

1024B

Virtual Size

563B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

70KB

Virtual Size

69KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

16KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-14_0b3c617b93861ed95611d5df6c020fce_icedid_njrat

dwmapi

shell32

opengl32

winmm

gdi32

kernel32

user32

advapi32

winhttp

imm32

generic