2026-07-14_0342c591e77beadb1fd279b412c89345_icedid_njrat_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-14_0342c591e77beadb1fd279b412c89345_icedid_njrat_stealc
Size 3.7MB
Sample260714-fa1p5aev5m
SHA256 59d6a5f5ef20bd4949049c93e63d594fbe8f4ba66d25cb9f4cfc758f0de8030e
MD5 0342c591e77beadb1fd279b412c89345
SHA1 18f2037ad679947869d81e8a2927af6e7ff65d75
SHA512 6b38b116f23527a8eb99f759ad92a755ea00a88b5217d2fc990573c88deb0db5f0533b88e15501e4aded914102ee4874ec1b94171efab14816cea4fe87651d14
SSDEEP 49152:jXm+Lui/ooNw/YDNA9Iiqn5T8+HE8QIMvAs8pWy4y3VLuxPNyA+2dmKrTZdRX:j2diqARjVqxDmGTZzX
TLSH
T14106F046E29746A8DF76673884946323D2B03CC557B087E32BDC49646FB3AF41ABD780
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-14_0342c591e77beadb1fd279b412c89345_icedid_njrat_stealc

File Explorer

2026-07-14_0342c591e77beadb1fd279b412c89345_icedid_njrat_stealc

.exe 3.7MB

2026-07-14_0342c591e77beadb1fd279b412c89345_icedid_njrat_stealc

IMPHASH 92c0960530747fb0aef161a82bd6f68b
SHA256 59d6a5f5ef20bd4949049c93e63d594fbe8f4ba66d25cb9f4cfc758f0de8030e
MD5 0342c591e77beadb1fd279b412c89345
SHA1 18f2037ad679947869d81e8a2927af6e7ff65d75
SHA512 6b38b116f23527a8eb99f759ad92a755ea00a88b5217d2fc990573c88deb0db5f0533b88e15501e4aded914102ee4874ec1b94171efab14816cea4fe87651d14
SSDEEP 49152:jXm+Lui/ooNw/YDNA9Iiqn5T8+HE8QIMvAs8pWy4y3VLuxPNyA+2dmKrTZdRX:j2diqARjVqxDmGTZzX
TLSH
T14106F046E29746A8DF76673884946323D2B03CC557B087E32BDC49646FB3AF41ABD780
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

861224

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

d3d11

D3D11CreateDeviceAndSwapChain

d3dx11_43

D3DX11CreateShaderResourceViewFromMemory

kernel32

VerSetConditionMask QueryPerformanceCounter QueryPerformanceFrequency FreeLibrary GetModuleHandleA GetProcAddress LoadLibraryA GetLocaleInfoA CloseHandle ExitProcess CreateProcessW GetModuleFileNameW GetModuleHandleW WaitForSingleObject GetExitCodeProcess GetExitCodeThread OpenProcess VirtualAllocEx ReadProcessMemory WriteProcessMemory VirtualFreeEx CreateFileW SetStdHandle GetProcessHeap FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW FindClose WideCharToMultiByte GetFileSizeEx SetFilePointerEx ReadConsoleW GetConsoleMode GetConsoleOutputCP FlushFileBuffers HeapReAlloc GetFileType EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW VirtualProtect FlsFree FlsSetValue FlsGetValue FlsAlloc HeapFree HeapAlloc WriteFile GetStdHandle ReadFile MultiByteToWideChar GlobalFree GlobalLock GlobalUnlock GlobalAlloc GetModuleHandleExW FreeLibraryAndExitThread ExitThread CreateThread LoadLibraryExW TlsFree TlsSetValue TlsGetValue FreeConsole AllocConsole HeapSize WriteConsoleW SetEndOfFile TlsAlloc InitializeCriticalSectionAndSpinCount SetLastError GetLastError Sleep GetCurrentThreadId ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive RtlUnwind SleepConditionVariableSRW InitializeCriticalSectionEx GetSystemTimeAsFileTime WakeAllConditionVariable EnterCriticalSection LeaveCriticalSection DeleteCriticalSection EncodePointer DecodePointer LCMapStringEx CompareStringEx GetCPInfo GetStringTypeW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent GetCurrentProcess TerminateProcess GetCurrentProcessId InitializeSListHead RtlPcToFileHeader RaiseException RtlUnwindEx

user32

LoadCursorW TranslateMessage DispatchMessageW PeekMessageW OpenClipboard CloseClipboard SetClipboardData GetClipboardData EmptyClipboard GetKeyboardLayout TrackMouseEvent GetMessageExtraInfo GetKeyState GetCapture EnumDisplayMonitors GetMonitorInfoW MapWindowPoints UpdateWindow MoveWindow SetLayeredWindowAttributes ShowWindow DestroyWindow CreateWindowExW RegisterClassExW UnregisterClassW DefWindowProcW SetWindowLongW SetForegroundWindow SetProcessDPIAware MonitorFromWindow SetCapture ScreenToClient ClientToScreen GetCursorPos SetCursor SetCursorPos GetClientRect ReleaseDC GetDC GetForegroundWindow IsWindowUnicode ReleaseCapture GetAsyncKeyState

gdi32

DeleteObject GetDeviceCaps CreateSolidBrush CreateRectRgn

winhttp

WinHttpOpen WinHttpCloseHandle WinHttpConnect WinHttpReadData WinHttpQueryDataAvailable WinHttpOpenRequest WinHttpSendRequest WinHttpReceiveResponse

imm32

ImmReleaseContext ImmSetCompositionWindow ImmSetCandidateWindow ImmGetContext

d3dcompiler_43

D3DCompile

dwmapi

DwmExtendFrameIntoClientArea DwmIsCompositionEnabled DwmGetColorizationColor DwmEnableBlurBehindWindow

Name

.text

Size

1.0MB

Virtual Size

1.0MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

2.5MB

Virtual Size

2.5MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

121KB

Virtual Size

162KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

42KB

Virtual Size

42KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

488B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-14_0342c591e77beadb1fd279b412c89345_icedid_njrat_stealc

d3d11

d3dx11_43

kernel32

user32

gdi32

winhttp

imm32

d3dcompiler_43

dwmapi

generic