2026-07-22_1f8d6afa8a3983dd4d824b7ae5411dca_icedid_njrat

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-22_1f8d6afa8a3983dd4d824b7ae5411dca_icedid_njrat
Size 6.9MB
Sample260723-cd65jafb72
SHA256 9aab6f3bc1f3c85789026276de3f032782fc7679ac5cc1addd30179783343898
MD5 1f8d6afa8a3983dd4d824b7ae5411dca
SHA1 950642e752768296401a1dd1634cd2c600c197cf
SHA512 9945da037f49e2eb313ca0aff5791699dc7fe5de3a7507cf853687d2e28757e2d1f59d7a935b4a9b63a2e9c5a7440efd590a3a02345c61c9279d1983ac765a19
SSDEEP 49152:m47fnW9GJsWlLatkH6D+/D4+65jHh5FDt7aljggHfk2hhKE17Yjd7ncqPAylHqTV:17uAlLN2h3t7WRQyV
TLSH
T1D176E616B6FA10D1D1BAC079D503972BED60309A433C66FB938189C96F707E8AE7C752
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects executables containing URLs to raw contents of a Github gist 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-22_1f8d6afa8a3983dd4d824b7ae5411dca_icedid_njrat

File Explorer

2026-07-22_1f8d6afa8a3983dd4d824b7ae5411dca_icedid_njrat

.exe 6.9MB

2026-07-22_1f8d6afa8a3983dd4d824b7ae5411dca_icedid_njrat

IMPHASH 0eb74d232fb8d65a60f33831b24a03a5
SHA256 9aab6f3bc1f3c85789026276de3f032782fc7679ac5cc1addd30179783343898
MD5 1f8d6afa8a3983dd4d824b7ae5411dca
SHA1 950642e752768296401a1dd1634cd2c600c197cf
SHA512 9945da037f49e2eb313ca0aff5791699dc7fe5de3a7507cf853687d2e28757e2d1f59d7a935b4a9b63a2e9c5a7440efd590a3a02345c61c9279d1983ac765a19
SSDEEP 49152:m47fnW9GJsWlLatkH6D+/D4+65jHh5FDt7aljggHfk2hhKE17Yjd7ncqPAylHqTV:17uAlLN2h3t7WRQyV
TLSH
T1D176E616B6FA10D1D1BAC079D503972BED60309A433C66FB938189C96F707E8AE7C752
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects executables containing URLs to raw contents of a Github gist
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2632528

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\Client\Downloads\spectre\build\x64\Debug\Spectre.pdb

d3d11

D3D11CreateDeviceAndSwapChain

winhttp

WinHttpOpen WinHttpQueryDataAvailable WinHttpReadData WinHttpConnect WinHttpCloseHandle WinHttpReceiveResponse WinHttpCrackUrl WinHttpOpenRequest WinHttpSendRequest

urlmon

URLDownloadToFileW

kernel32

GlobalAlloc GlobalUnlock GlobalLock GlobalFree MultiByteToWideChar WideCharToMultiByte VerSetConditionMask QueryPerformanceCounter QueryPerformanceFrequency FreeLibrary GetModuleHandleA GetProcAddress LoadLibraryA GetLocaleInfoA CloseHandle ReadProcessMemory CreateToolhelp32Snapshot Module32First Module32Next GetLastError ReleaseMutex CreateMutexA Sleep GetCurrentProcess GetCurrentThread SetThreadPriority GetThreadPriority SetPriorityClass OpenProcess AllocConsole FreeConsole AttachConsole SetConsoleTitleA Process32First Process32Next WriteProcessMemory GetModuleFileNameA HeapQueryInformation SetFilePointerEx ReadConsoleW GetConsoleMode GetConsoleOutputCP FlushFileBuffers EnumSystemLocalesW GetUserDefaultLCID GetEnvironmentStringsW GetLocaleInfoW WaitForSingleObject CompareStringW GetTimeFormatW GetDateFormatW VirtualProtect IsThreadAFiber FlsFree FlsSetValue FlsGetValue FlsAlloc SetConsoleCtrlHandler OutputDebugStringW WriteFile ExitProcess FreeLibraryAndExitThread ResumeThread ExitThread CreateThread GetSystemInfo HeapValidate HeapSize WriteConsoleW GetModuleHandleExW GetFileType GetStdHandle TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount RtlUnwind SetLastError LoadLibraryExW GetModuleFileNameW InterlockedFlushSList InterlockedPushEntrySList RtlUnwindEx RtlPcToFileHeader VirtualQuery InitializeSListHead GetCurrentProcessId GetExitCodeProcess CreateProcessW GetTimeZoneInformation IsValidCodePage FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle GetStartupInfoW RaiseException IsDebuggerPresent IsProcessorFeaturePresent GetACP GetOEMCP GetCommandLineA LCMapStringW GetCommandLineW IsValidLocale CreateDirectoryW TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry CreateFileA GetFileSizeEx ReadFile HeapAlloc HeapReAlloc HeapFree GetProcessHeap MapViewOfFile UnmapViewOfFile CreateFileMappingA LocalFree FormatMessageA GetLocaleInfoEx SetCurrentDirectoryW GetCurrentDirectoryW SetEndOfFile CreateFileW FindClose FindFirstFileW FindFirstFileExW FindNextFileW GetDiskFreeSpaceExW GetFileAttributesW GetFileAttributesExW GetFileInformationByHandle GetFinalPathNameByHandleW GetFullPathNameW SetFileAttributesW SetFileInformationByHandle SetFileTime GetTempPathW AreFileApisANSI DeviceIoControl GetModuleHandleW CreateDirectoryExW CopyFileW MoveFileExW CreateHardLinkW GetFileInformationByHandleEx CreateSymbolicLinkW InitOnceBeginInitialize InitOnceComplete WaitForSingleObjectEx SwitchToThread GetCurrentThreadId GetExitCodeThread GetNativeSystemInfo ReleaseSRWLockExclusive ReleaseSRWLockShared AcquireSRWLockExclusive AcquireSRWLockShared TryAcquireSRWLockExclusive TryAcquireSRWLockShared SleepConditionVariableSRW GetTickCount64 EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer LCMapStringEx InitOnceExecuteOnce CreateEventExW CreateSemaphoreExW FlushProcessWriteBuffers GetCurrentProcessorNumber GetSystemTimeAsFileTime FreeLibraryWhenCallbackReturns CreateThreadpoolTimer SetThreadpoolTimer WaitForThreadpoolTimerCallbacks CloseThreadpoolTimer CreateThreadpoolWait SetThreadpoolWait CloseThreadpoolWait WakeConditionVariable WakeAllConditionVariable GetStringTypeW CompareStringEx GetCPInfo RtlCaptureContext

user32

SetClipboardData GetClipboardData EmptyClipboard CloseClipboard OpenClipboard ScreenToClient GetKeyboardLayout SetWindowLongPtrA SetWindowLongA UpdateWindow GetSystemMetrics SetWindowDisplayAffinity SetWindowPos SetLayeredWindowAttributes ShowWindow DestroyWindow CreateWindowExW RegisterClassExW UnregisterClassW PostQuitMessage DefWindowProcA PeekMessageA DispatchMessageA TranslateMessage SendInput GetWindowThreadProcessId FindWindowA MapVirtualKeyW ToUnicode GetKeyboardState GetAsyncKeyState SetProcessDPIAware MonitorFromWindow LoadCursorA TrackMouseEvent ClientToScreen GetCursorPos SetCursor SetCursorPos GetClientRect ReleaseDC GetDC GetForegroundWindow IsWindowUnicode ReleaseCapture SetCapture GetCapture GetKeyState GetMessageExtraInfo

gdi32

DeleteObject GetDeviceCaps CreateRectRgn

advapi32

GetTokenInformation OpenProcessToken

shell32

SHGetKnownFolderPath

ole32

CoTaskMemFree

imm32

ImmGetContext ImmReleaseContext ImmSetCompositionWindow ImmSetCandidateWindow

d3dcompiler_47

D3DCompile

dwmapi

DwmExtendFrameIntoClientArea DwmIsCompositionEnabled DwmEnableBlurBehindWindow DwmGetColorizationColor

Name

.textbss

Size

Virtual Size

2.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.text

Size

5.1MB

Virtual Size

5.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.4MB

Virtual Size

1.4MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

16KB

Virtual Size

60KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

250KB

Virtual Size

249KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

13KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.msvcjmc

Size

14KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

1024B

Virtual Size

777B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.00cfg

Size

512B

Virtual Size

373B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

1024B

Virtual Size

563B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

50KB

Virtual Size

49KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-22_1f8d6afa8a3983dd4d824b7ae5411dca_icedid_njrat

d3d11

winhttp

urlmon

kernel32

user32

gdi32

advapi32

shell32

ole32

imm32

d3dcompiler_47

dwmapi

generic