2026-07-18_e9752694e41b4cfc4db24713afe23fda_icedid_njrat

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-18_e9752694e41b4cfc4db24713afe23fda_icedid_njrat
Size 2.6MB
Sample260718-a264bsax9p
SHA256 f00d3e1d145d79e973e50f3219cbd68314c6ab97fce1facb6e39cf9828d5a28d
MD5 e9752694e41b4cfc4db24713afe23fda
SHA1 63a649b62e0a6c6a6682ea91712c1c9518faa382
SHA512 8fbd3cd49f93dd5c4828a7ec9af4e1977df0df51bd7fd844184df9cf3031e00116760c2b546ce42dbb2aa832ef4ace72a2b418911f27f69f24aa49aba1b0d94b
SSDEEP 24576:CHQFchJnU7KH/DOiwHv+amFELpIJZosyrq/IfmigQJK:ChjOiwPfSELKorqbs
TLSH
T18AC5C60BE6B611D1D0BAC03C9552622EFC7134A6833897EFA6D19A561B70FE4EE3D740
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-18_e9752694e41b4cfc4db24713afe23fda_icedid_njrat

File Explorer

2026-07-18_e9752694e41b4cfc4db24713afe23fda_icedid_njrat

.exe 2.6MB

2026-07-18_e9752694e41b4cfc4db24713afe23fda_icedid_njrat

IMPHASH b1fe43060f1a28193b77414c749b9562
SHA256 f00d3e1d145d79e973e50f3219cbd68314c6ab97fce1facb6e39cf9828d5a28d
MD5 e9752694e41b4cfc4db24713afe23fda
SHA1 63a649b62e0a6c6a6682ea91712c1c9518faa382
SHA512 8fbd3cd49f93dd5c4828a7ec9af4e1977df0df51bd7fd844184df9cf3031e00116760c2b546ce42dbb2aa832ef4ace72a2b418911f27f69f24aa49aba1b0d94b
SSDEEP 24576:CHQFchJnU7KH/DOiwHv+amFELpIJZosyrq/IfmigQJK:ChjOiwPfSELKorqbs
TLSH
T18AC5C60BE6B611D1D0BAC03C9552622EFC7134A6833897EFA6D19A561B70FE4EE3D740
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1029204

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\occhi\Desktop\Atlas.AC\Atlas C++\bin\Debug\Atlas.ac.pdb

msimg32

AlphaBlend

user32

DispatchMessageW DefWindowProcW PostQuitMessage RegisterClassW GetMessageW DestroyWindow ShowWindow SetWindowPos OpenClipboard CloseClipboard GetClipboardData TranslateMessage CreateWindowExW GetWindowRect GetKeyState EnumWindows GetWindowTextW LoadImageW LoadCursorW FindWindowW FillRect ScreenToClient GetCursorPos SetCapture SetCursor InvalidateRect EndPaint BeginPaint SetForegroundWindow UpdateWindow DrawTextW GetSystemMetrics KillTimer SetTimer ReleaseCapture

gdi32

MoveToEx CreateDIBSection SetTextColor SetStretchBltMode StretchBlt SetBkMode SelectObject RoundRect LineTo GetTextExtentPoint32W Ellipse DeleteObject DeleteDC CreateSolidBrush CreatePen CreateFontW CreateCompatibleDC CreateCompatibleBitmap BitBlt

shell32

ShellExecuteW SHGetFolderPathW

winhttp

WinHttpOpenRequest WinHttpCrackUrl WinHttpOpen WinHttpCloseHandle WinHttpConnect WinHttpReadData WinHttpQueryDataAvailable WinHttpQueryHeaders WinHttpSendRequest WinHttpReceiveResponse

wintrust

WTHelperProvDataFromStateData WinVerifyTrust WTHelperGetProvSignerFromChain WTHelperGetProvCertFromChain

crypt32

CertGetNameStringW

iphlpapi

GetAdaptersInfo

advapi32

OpenEventLogW ConvertSidToStringSidW RegQueryValueExW RegOpenKeyExW RegEnumValueW RegEnumKeyExW RegCloseKey GetUserNameW ReadEventLogW AllocateAndInitializeSid CloseEventLog GetTokenInformation FreeSid CheckTokenMembership OpenProcessToken

kernel32

SetConsoleCtrlHandler HeapReAlloc HeapQueryInformation FlsAlloc FlsGetValue FlsSetValue FlsFree IsThreadAFiber VirtualProtect GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW WriteConsoleW OutputDebugStringW WriteFile GetStdHandle ExitProcess GetSystemInfo HeapValidate HeapSize GetModuleHandleExW TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount SetLastError LoadLibraryExW GetModuleFileNameW InterlockedFlushSList InterlockedPushEntrySList RtlUnwindEx GetTimeZoneInformation FindFirstFileExW GetCurrentThread GetFileType IsValidCodePage GetACP GetOEMCP GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle GetFileSizeEx SetFilePointerEx FlushFileBuffers GetConsoleOutputCP GetConsoleMode ReadConsoleW QueryFullProcessImageNameW CloseHandle GetLastError CreateMutexW GlobalUnlock GlobalLock CompareFileTime CreateFileW FindClose FindFirstFileW FindNextFileW GetDriveTypeW GetFileAttributesExW GetLogicalDrives GetVolumeInformationW ReadFile GetCurrentProcess OpenProcess GetSystemTimeAsFileTime GetTickCount64 GetWindowsDirectoryW LocalFree RtlUnwind GetComputerNameW FileTimeToSystemTime MultiByteToWideChar WideCharToMultiByte CreateToolhelp32Snapshot Process32FirstW Process32NextW RtlPcToFileHeader QueryPerformanceCounter QueryPerformanceFrequency FormatMessageA GetStringTypeW EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection SetFileInformationByHandle GetTempPathW InitOnceExecuteOnce CreateEventExW CreateSemaphoreExW FlushProcessWriteBuffers GetCurrentProcessorNumber FreeLibraryWhenCallbackReturns CreateThreadpoolTimer SetThreadpoolTimer WaitForThreadpoolTimerCallbacks CloseThreadpoolTimer CreateThreadpoolWait SetThreadpoolWait CloseThreadpoolWait GetModuleHandleW GetProcAddress GetFileInformationByHandleEx CreateSymbolicLinkW GetLocaleInfoEx EncodePointer DecodePointer LCMapStringEx CompareStringEx GetCPInfo RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent GetCurrentThreadId IsDebuggerPresent GetStartupInfoW RaiseException GetCurrentProcessId InitializeSListHead HeapAlloc HeapFree GetProcessHeap VirtualQuery FreeLibrary

Name

.textbss

Size

Virtual Size

988KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.text

Size

2.0MB

Virtual Size

2.0MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

422KB

Virtual Size

422KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

12KB

Virtual Size

25KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

98KB

Virtual Size

98KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

11KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.msvcjmc

Size

1024B

Virtual Size

937B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.00cfg

Size

512B

Virtual Size

373B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

1024B

Virtual Size

563B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

34KB

Virtual Size

33KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

15KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-18_e9752694e41b4cfc4db24713afe23fda_icedid_njrat

msimg32

user32

gdi32

shell32

winhttp

wintrust

crypt32

iphlpapi

advapi32

kernel32

generic