2026-07-30_e4e1e851345c98d49779c1ffac108516_icedid_njrat

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-30_e4e1e851345c98d49779c1ffac108516_icedid_njrat
Size 10.1MB
Sample260730-fe9htstscw
SHA256 5b9239640315d2b879a8ae99bb0912d433d9aa1b46859edc2441833402898ac8
MD5 e4e1e851345c98d49779c1ffac108516
SHA1 3ad7b04e8a38df2a2157850716698297edfecdfb
SHA512 69931ff01419c2aaf95a5038dc817138c5f130976860fad10099499de3aa5b695fa1f0e4a7967ffa898cf7997745c773f4e320fc0f75a2bbb550e650c75fc847
SSDEEP 49152:6zipvXmFPuybQnrpSu7V7yi9bkkMs1UC2BPIEQEtOJTKvaKhWFwQuskEfwNjvId8:JdzFXUCIOKhWF0pNS8
TLSH
T155B65B2871EC41C9F0E1B0BD8A978157E9F23C541B758ADB10A4813D5F3BAE52B36EB1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

2026-07-30_e4e1e851345c98d49779c1ffac108516_icedid_njrat

.exe 10.1MB

2026-07-30_e4e1e851345c98d49779c1ffac108516_icedid_njrat

IMPHASH 6b1a170a71c26de54083f11fa365bdf1
SHA256 5b9239640315d2b879a8ae99bb0912d433d9aa1b46859edc2441833402898ac8
MD5 e4e1e851345c98d49779c1ffac108516
SHA1 3ad7b04e8a38df2a2157850716698297edfecdfb
SHA512 69931ff01419c2aaf95a5038dc817138c5f130976860fad10099499de3aa5b695fa1f0e4a7967ffa898cf7997745c773f4e320fc0f75a2bbb550e650c75fc847
SSDEEP 49152:6zipvXmFPuybQnrpSu7V7yi9bkkMs1UC2BPIEQEtOJTKvaKhWFwQuskEfwNjvId8:JdzFXUCIOKhWF0pNS8
TLSH
T155B65B2871EC41C9F0E1B0BD8A978157E9F23C541B758ADB10A4813D5F3BAE52B36EB1
MD5 SHA1 SHA512 SSDEEP TLSH

Digest

8c:45:7a:54:55:99:f5:2a:64:1e:94:50:ec:a5:ae:26:82:ef:f6:4b:cc:b8:69:e8:65:43:0b:f8:3c:2a:4f:d7

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=22178368,CN=MICRO-STAR INTERNATIONAL CO.\, LTD.,O=MICRO-STAR INTERNATIONAL CO.\, LTD.,STREET=No. 69\, Lide St.\, Zhonghe Dist.,L=New Taipei,ST=New Taipei,C=TW,1.3.6.1.4.1.311.60.2.1.3=#13025457,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

Feb 26, 2026

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Subject

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Serial Number

78:03:18:42:45:70:8a:41:cf:6f:01:b8:ee:b4:a9:54

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 28, 2020 - Mar 18, 2029

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Serial Number

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 28, 2020 - Jul 28, 2030

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

Serial Number

0d:d7:1f:dd:49:a3:e4:3d:fc:5d:e6:f5

Issuer

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 16, 2023 - Apr 11, 2026

Minor OS version

Major OS version

Entry point

22941

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\Drigon Center\Output\CC_Engine_x64.pdb

kernel32

HeapReAlloc HeapFree HeapSize GetProcessHeap DeviceIoControl InitializeCriticalSectionEx DeleteCriticalSection ReleaseMutex WaitForSingleObject CreateMutexW OpenMutexW CreateEventW Sleep GetCurrentProcess GetCurrentProcessId CreateThread GetCurrentThread SetThreadPriority ResumeThread SetPriorityClass GetProcessId OpenProcess GetLocalTime GetWindowsDirectoryW GetVersionExW CreateFileMappingW OpenFileMappingW MapViewOfFile UnmapViewOfFile SetProcessWorkingSetSize FindResourceExW FreeLibrary GetModuleFileNameW GetModuleHandleW GetProcAddress LoadResource LockResource SizeofResource FindResourceW HeapAlloc GetProcessAffinityMask SetProcessAffinityMask SetThreadAffinityMask lstrcpyW CopyFileW MultiByteToWideChar WideCharToMultiByte SetThreadUILanguage K32EmptyWorkingSet K32GetProcessMemoryInfo CreateToolhelp32Snapshot Process32FirstW Process32NextW WriteConsoleW SetEndOfFile SetStdHandle FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP GetACP IsValidCodePage SetConsoleCtrlHandler GetFileSizeEx GetConsoleOutputCP SetFilePointerEx ReadConsoleW GetConsoleMode GetTimeZoneInformation GetFileType EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW VirtualProtect HeapDestroy QueryPerformanceFrequency QueryPerformanceCounter WaitNamedPipeW CreateNamedPipeW SetNamedPipeHandleState DisconnectNamedPipe ConnectNamedPipe DecodePointer OutputDebugStringW WriteFile ReadFile GetFileSize GetFileAttributesExW GetFileAttributesW FlushFileBuffers DeleteFileW CreateDirectoryW VerifyVersionInfoW FormatMessageW LocalFree ExitProcess GetLastError RaiseException CloseHandle CreateFileW LoadLibraryW VerSetConditionMask IsThreadAFiber FlsFree FlsSetValue FlsGetValue FlsAlloc GetStdHandle FileTimeToSystemTime SystemTimeToTzSpecificLocalTime FindNextFileW FindFirstFileExW FindClose GetCurrentDirectoryW SetCurrentDirectoryW RtlUnwind SetEnvironmentVariableW FreeLibraryAndExitThread ExitThread GetModuleHandleExW LoadLibraryExW TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount SetLastError InterlockedFlushSList InterlockedPushEntrySList RtlUnwindEx RtlPcToFileHeader GetStartupInfoW IsDebuggerPresent InitializeSListHead IsProcessorFeaturePresent TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext GetCPInfo CompareStringEx GetStringTypeW GetNativeSystemInfo GetExitCodeThread SwitchToThread WaitForSingleObjectEx CreateSymbolicLinkW GetFileInformationByHandleEx CloseThreadpoolWait SetThreadpoolWait FormatMessageA ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive GetCurrentThreadId WakeConditionVariable WakeAllConditionVariable SleepConditionVariableSRW ReleaseSRWLockShared AcquireSRWLockShared TryAcquireSRWLockShared GetTickCount64 EnterCriticalSection LeaveCriticalSection GetLocaleInfoEx EncodePointer LCMapStringEx SetFileInformationByHandle GetTempPathW InitOnceExecuteOnce CreateEventExW CreateSemaphoreExW FlushProcessWriteBuffers GetCurrentProcessorNumber GetSystemTimeAsFileTime FreeLibraryWhenCallbackReturns CreateThreadpoolTimer SetThreadpoolTimer WaitForThreadpoolTimerCallbacks CloseThreadpoolTimer CreateThreadpoolWait

user32

GetMessageW MessageBoxW DispatchMessageW PeekMessageW ExitWindowsEx RegisterDeviceNotificationW DefWindowProcW UnregisterClassW wsprintfW LoadStringW TranslateMessage RegisterClassExW LoadIconW LoadCursorW EndPaint BeginPaint TranslateAcceleratorW LoadAcceleratorsW KillTimer SetTimer EndDialog DialogBoxParamW DestroyWindow IsWindow CreateWindowExW

advapi32

ConvertStringSecurityDescriptorToSecurityDescriptorW RegSetValueExW RegNotifyChangeKeyValue RegDeleteValueW RegDeleteKeyW RegCreateKeyExW LookupPrivilegeValueW SetSecurityDescriptorDacl SetKernelObjectSecurity InitializeSecurityDescriptor AdjustTokenPrivileges OpenProcessToken StartServiceW QueryServiceStatus OpenServiceW OpenSCManagerW DeleteService CreateServiceW ControlService CloseServiceHandle RegSetValueExA RegQueryValueExW RegQueryValueExA RegOpenKeyExW RegOpenKeyExA RegCreateKeyA RegCloseKey

shell32

ord680 ShellExecuteExW

ole32

CoInitialize CoSetProxyBlanket CoInitializeSecurity CoInitializeEx CoUninitialize CoCreateInstance

oleaut32

GetErrorInfo VariantChangeType SysAllocString SysFreeString SetErrorInfo SafeArrayDestroy SafeArrayGetUBound SafeArrayGetLBound SafeArrayAccessData SafeArrayUnaccessData VariantInit CreateErrorInfo VariantClear SysAllocStringLen

platform

GetPlatform

netapi32

NetWkstaGetInfo NetApiBufferFree

shlwapi

StrCmpIW PathFileExistsW PathStripToRootW

version

GetFileVersionInfoSizeW VerQueryValueW GetFileVersionInfoW

setupapi

CM_Get_Res_Des_Data_Size SetupDiGetClassDevsW CM_Get_First_Log_Conf SetupDiGetDeviceRegistryPropertyW SetupDiEnumDeviceInfo CM_Get_Next_Res_Des SetupDiDestroyDeviceInfoList CM_Get_Res_Des_Data CM_Free_Res_Des_Handle

pdh

PdhAddCounterW PdhCollectQueryData PdhCloseQuery PdhGetFormattedCounterValue PdhOpenQueryW

Name

.text

Size

8.8MB

Virtual Size

8.8MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.0MB

Virtual Size

1.0MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

74KB

Virtual Size

110KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

153KB

Virtual Size

152KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

14KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

1024B

Virtual Size

777B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.00cfg

Size

512B

Virtual Size

373B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

1024B

Virtual Size

563B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

10KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

57KB

Virtual Size

57KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-30_e4e1e851345c98d49779c1ffac108516_icedid_njrat

kernel32

user32

advapi32

shell32

ole32

oleaut32

platform

netapi32

shlwapi

version

setupapi

pdh

generic