2026-07-18_7c2bf919e7e452d059ac2d91c7247502_icedid_njrat

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-18_7c2bf919e7e452d059ac2d91c7247502_icedid_njrat
Size 8.9MB
Sample260718-bbndzaa18m
SHA256 f0a83f1fd5106113f9567bc52adee5533d51f72b59f08a6fc64471e42b481997
MD5 7c2bf919e7e452d059ac2d91c7247502
SHA1 c33ae0e17566b18e89f88755d9be300f9c970258
SHA512 347eaa1bcb4f1d193f03261411ad984d1d5b80d263e3cba5e678507fc810a9558de696e9a40afc18d56b267c22bd8544f3ce9e9b5130d5aba5e32ad5b88ee46e
SSDEEP 196608:SJfG9ddLDWUiXKCu/FCZOII+dmhvUUERJMXdqcWTAj8vJM8:SJfGRuXKx66+xUoMXsAj8C
TLSH
T14A962316B7658D37C1260238C4D30F147F79EDA09693572BB38CB938BFA1B958F06689
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects executables referencing many IR and analysis tools 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_References_SecTools

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-18_7c2bf919e7e452d059ac2d91c7247502_icedid_njrat

File Explorer

2026-07-18_7c2bf919e7e452d059ac2d91c7247502_icedid_njrat

.exe 8.9MB

2026-07-18_7c2bf919e7e452d059ac2d91c7247502_icedid_njrat

IMPHASH 20a42d7f62d98cde3f2d80f7186664aa
SHA256 f0a83f1fd5106113f9567bc52adee5533d51f72b59f08a6fc64471e42b481997
MD5 7c2bf919e7e452d059ac2d91c7247502
SHA1 c33ae0e17566b18e89f88755d9be300f9c970258
SHA512 347eaa1bcb4f1d193f03261411ad984d1d5b80d263e3cba5e678507fc810a9558de696e9a40afc18d56b267c22bd8544f3ce9e9b5130d5aba5e32ad5b88ee46e
SSDEEP 196608:SJfG9ddLDWUiXKCu/FCZOII+dmhvUUERJMXdqcWTAj8vJM8:SJfGRuXKx66+xUoMXsAj8C
TLSH
T14A962316B7658D37C1260238C4D30F147F79EDA09693572BB38CB938BFA1B958F06689
MD5 SHA1 SHA512 SSDEEP TLSH

Detects executables referencing many IR and analysis tools
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

435136

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

advapi32

RegOpenKeyExA RegQueryValueExA RegCloseKey

d3d11

D3D11CreateDeviceAndSwapChain

d3dcompiler_47

D3DCompile

wininet

InternetOpenUrlA HttpSendRequestA HttpOpenRequestA InternetReadFile InternetCloseHandle InternetOpenA InternetConnectA

kernel32

GetModuleFileNameA MoveFileA CloseHandle GetLastError WaitForSingleObject CreateRemoteThread OpenProcess VirtualAllocEx WriteProcessMemory VirtualFreeEx GetModuleHandleA GetProcAddress CreateToolhelp32Snapshot Process32FirstW Process32NextW CreateFileA GetFileSize ReadFile GetFileAttributesA WriteFile GetTempPathA GetModuleHandleW LoadResource LockResource SizeofResource FindResourceA GetVolumeInformationA IsDebuggerPresent CheckRemoteDebuggerPresent RaiseException GetCurrentProcess GetCurrentProcessId TerminateProcess GetCurrentThread GetCurrentThreadId OpenThread SetThreadPriority SuspendThread ResumeThread GetThreadContext GetSystemTimeAsFileTime GetTickCount64 VirtualQuery Thread32First Thread32Next Sleep FlushInstructionCache OutputDebugStringA GlobalAlloc GlobalUnlock GlobalLock GlobalFree MultiByteToWideChar QueryPerformanceCounter QueryPerformanceFrequency FreeLibrary LoadLibraryA GetLocaleInfoA IsDBCSLeadByte AreFileApisANSI GetLocaleInfoEx FormatMessageA LocalFree WideCharToMultiByte InitializeSListHead SetUnhandledExceptionFilter GetStartupInfoW VirtualProtect

user32

GetCapture SetCapture IsWindowUnicode LoadCursorW GetKeyState ScreenToClient ClientToScreen GetCursorPos SetCursor SetCursorPos GetClientRect GetMessageExtraInfo TrackMouseEvent GetKeyboardLayout EmptyClipboard GetClipboardData SetClipboardData TranslateMessage DispatchMessageW PeekMessageW SendMessageW DefWindowProcW PostQuitMessage UnregisterClassW RegisterClassExW CreateWindowExW DestroyWindow ShowWindow SetLayeredWindowAttributes IsWindowVisible ReleaseCapture GetSystemMetrics UpdateWindow SetForegroundWindow GetWindowLongA SetWindowLongA EnumWindows GetWindowThreadProcessId GetWindowTextA FindWindowA GetTopWindow GetWindow OpenClipboard CloseClipboard GetForegroundWindow

shell32

ShellExecuteW

msvcp140

_Query_perf_frequency _Query_perf_counter ?_Throw_Cpp_error@std@@YAXH@Z _Cnd_do_broadcast_at_thread_exit _Thrd_detach ?_Xinvalid_argument@std@@YAXPEBD@Z ?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADXZ ?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ ?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?_Xlength_error@std@@YAXPEBD@Z ?_Xout_of_range@std@@YAXPEBD@Z ?_Syserror_map@std@@YAPEBDH@Z ?_Winerror_map@std@@YAHH@Z ?_Random_device@std@@YAIXZ ?uncaught_exception@std@@YA_NXZ ?good@ios_base@std@@QEBA_NXZ ?flags@ios_base@std@@QEBAHXZ ?width@ios_base@std@@QEBA_JXZ ?width@ios_base@std@@QEAA_J_J@Z ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z

imm32

ImmReleaseContext ImmSetCompositionWindow ImmSetCandidateWindow ImmGetContext

vcruntime140

__current_exception_context __C_specific_handler memcmp __current_exception __std_terminate memset memmove memcpy _CxxThrowException __std_exception_destroy __std_exception_copy memchr

vcruntime140_1

__CxxFrameHandler4

api-ms-win-crt-heap-l1-1-0

realloc malloc _set_new_mode free _callnewh

api-ms-win-crt-string-l1-1-0

strlen strcmp strncmp tolower wcslen

api-ms-win-crt-runtime-l1-1-0

_initialize_wide_environment _get_wide_winmain_command_line _initterm _initterm_e exit _exit _seh_filter_exe _c_exit _configure_wide_argv _cexit _crt_atexit _register_onexit_function _initialize_onexit_table _register_thread_local_exe_atexit_callback _beginthreadex terminate _set_app_type _errno

api-ms-win-crt-convert-l1-1-0

strtol strtoull

api-ms-win-crt-stdio-l1-1-0

fclose fseek ftell feof __p__commode _set_fmode fread ferror __stdio_common_vsscanf __stdio_common_vsprintf __stdio_common_vfprintf fwrite fflush _wfopen __acrt_iob_func fgetc ungetc

api-ms-win-crt-filesystem-l1-1-0

remove

api-ms-win-crt-math-l1-1-0

sqrtf fmodf cosf ceilf ldexp sinf acosf __setusermatherr powf

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-locale-l1-1-0

___lc_codepage_func _configthreadlocale

Name

.text

Size

426KB

Virtual Size

426KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

858KB

Virtual Size

857KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

1024B

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

19KB

Virtual Size

18KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.stub

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

7.7MB

Virtual Size

7.7MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

1024B

Virtual Size

608B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-18_7c2bf919e7e452d059ac2d91c7247502_icedid_njrat

advapi32

d3d11

d3dcompiler_47

wininet

kernel32

user32

shell32

msvcp140

imm32

vcruntime140

vcruntime140_1

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic