2026-07-30_eff523fdde3f44a355b7acceacbaa2b2_icedid_njrat

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-30_eff523fdde3f44a355b7acceacbaa2b2_icedid_njrat
Size 2.7MB
Sample260730-hf5mdaseqa
SHA256 d44766a1eebfcb2a545bd72b5eafaca30df01b752d65809a119fb54e37e409e6
MD5 eff523fdde3f44a355b7acceacbaa2b2
SHA1 b0934269cf6c7b7faa37e18b8b45c7db1380832b
SHA512 5f77f0706fafb46e7a62c6e8be2df5217dd82f2de3ddfe337a05107b788e55dc0172bba834f632a48b851a7404c955b75887e1d1144bc521a0052614c36dda1a
SSDEEP 24576:iVXNjE5nL3hXjM0Y9EVGh6WpROMD+J89ukVLxuISvx8RR90c:AXRE5hpVGh5Rj+bkVexGRuc
TLSH
T10CD5F90BF7B621D4E1BAC138D553222AFD7134A6833897DB66C19E061B61BE4ED3E740
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects executables containing commands for clearing Windows Event Logs 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_ClearWinLogs

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-30_eff523fdde3f44a355b7acceacbaa2b2_icedid_njrat

File Explorer

2026-07-30_eff523fdde3f44a355b7acceacbaa2b2_icedid_njrat

.exe 2.7MB

2026-07-30_eff523fdde3f44a355b7acceacbaa2b2_icedid_njrat

IMPHASH f8150461a34ed5769aeee6277137155d
SHA256 d44766a1eebfcb2a545bd72b5eafaca30df01b752d65809a119fb54e37e409e6
MD5 eff523fdde3f44a355b7acceacbaa2b2
SHA1 b0934269cf6c7b7faa37e18b8b45c7db1380832b
SHA512 5f77f0706fafb46e7a62c6e8be2df5217dd82f2de3ddfe337a05107b788e55dc0172bba834f632a48b851a7404c955b75887e1d1144bc521a0052614c36dda1a
SSDEEP 24576:iVXNjE5nL3hXjM0Y9EVGh6WpROMD+J89ukVLxuISvx8RR90c:AXRE5hpVGh5Rj+bkVexGRuc
TLSH
T10CD5F90BF7B621D4E1BAC138D553222AFD7134A6833897DB66C19E061B61BE4ED3E740
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects executables containing commands for clearing Windows Event Logs
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

19271

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\User\Desktop\SOURCES MY PROJECTS FOR GAMES\412421414\WintorezCPP\x64\Debug\WintorezLoader.pdb

winhttp

WinHttpCloseHandle WinHttpQueryHeaders WinHttpConnect WinHttpReadData WinHttpQueryDataAvailable WinHttpQueryOption WinHttpSetOption WinHttpOpenRequest WinHttpAddRequestHeaders WinHttpSendRequest WinHttpOpen WinHttpReceiveResponse

bcrypt

BCryptOpenAlgorithmProvider BCryptCloseAlgorithmProvider BCryptCreateHash BCryptHashData BCryptFinishHash BCryptDestroyHash

advapi32

RegSetValueExA SetSecurityDescriptorDacl InitializeSecurityDescriptor FreeSid CheckTokenMembership AllocateAndInitializeSid RegDeleteKeyA RegDeleteValueA RegEnumKeyExA RegEnumValueA RegOpenKeyExA RegQueryValueExA RegCloseKey

comctl32

ord17

comdlg32

GetOpenFileNameA

shell32

SHGetFolderPathA SHBrowseForFolderA SHGetPathFromIDListA ShellExecuteW ShellExecuteA

kernel32

EnumSystemLocalesW GetConsoleOutputCP GetConsoleMode GetFileSizeEx SetFilePointerEx ReadConsoleW GetTimeZoneInformation FindFirstFileExW IsValidCodePage GetACP GetOEMCP GetCommandLineA CompareStringW GetTimeFormatW GetDateFormatW FlsFree FlsSetValue FlsGetValue GetEnvironmentVariableA CreateDirectoryA CreateFileA DeleteFileA DeleteFileW FindClose FindFirstFileA FindFirstFileW FindNextFileA FindNextFileW FlushFileBuffers GetFileAttributesA GetFileSize GetVolumeInformationW ReadFile RemoveDirectoryA SetFileAttributesA SetFilePointer WriteFile GetVolumeInformationA IsDebuggerPresent CheckRemoteDebuggerPresent CloseHandle DuplicateHandle GetLastError QueryPerformanceCounter QueryPerformanceFrequency SetEvent WaitForSingleObject CreateEventA Sleep GetCurrentProcess GetCurrentProcessId ExitProcess TerminateProcess GetExitCodeProcess CreateThread GetCommandLineW OpenThread GetExitCodeThread ResumeThread CreateProcessA CreateProcessW OpenProcess GetTickCount VirtualAllocEx VirtualProtectEx ReadProcessMemory WriteProcessMemory MapViewOfFile VirtualFreeEx UnmapViewOfFile GetModuleFileNameA GetModuleFileNameW GetModuleHandleA GetModuleHandleExA GetProcAddress LoadLibraryA GlobalAlloc GlobalUnlock GlobalLock LocalFree CreateFileMappingA CopyFileA MoveFileA GetComputerNameA MultiByteToWideChar CreateToolhelp32Snapshot Process32FirstW Process32NextW Thread32First Thread32Next Module32FirstW Module32NextW FlsAlloc SetConsoleCtrlHandler WriteConsoleW OutputDebugStringW GetFileType GetProcessHeap HeapQueryInformation HeapReAlloc HeapFree GetFileAttributesExW GetCurrentThread GetStdHandle FreeLibraryAndExitThread LCMapStringW ExitThread GetModuleHandleExW GetSystemInfo HeapValidate HeapSize HeapAlloc LoadLibraryExW FreeLibrary TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount SetLastError InterlockedFlushSList InterlockedPushEntrySList RtlUnwindEx RaiseException RtlPcToFileHeader InitializeSListHead GetStartupInfoW IsProcessorFeaturePresent SetUnhandledExceptionFilter GetUserDefaultLCID GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle CreateFileW SetEndOfFile CreateRemoteThread RtlUnwind IsValidLocale GetLocaleInfoW UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext GetCPInfo CompareStringEx GetStringTypeW WaitForSingleObjectEx SwitchToThread GetCurrentThreadId GetNativeSystemInfo FormatMessageA WideCharToMultiByte EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive WakeConditionVariable WakeAllConditionVariable SleepConditionVariableSRW GetLocaleInfoEx EncodePointer DecodePointer LCMapStringEx SetFileInformationByHandle GetTempPathW InitOnceExecuteOnce CreateEventExW CreateSemaphoreExW FlushProcessWriteBuffers GetCurrentProcessorNumber GetSystemTimeAsFileTime GetTickCount64 FreeLibraryWhenCallbackReturns CreateThreadpoolTimer SetThreadpoolTimer WaitForThreadpoolTimerCallbacks CloseThreadpoolTimer CreateThreadpoolWait SetThreadpoolWait CloseThreadpoolWait GetModuleHandleW GetFileInformationByHandleEx CreateSymbolicLinkW

user32

UpdateWindow DrawTextA GetSystemMetrics EnableWindow KillTimer SetTimer EmptyClipboard SetClipboardData CloseClipboard OpenClipboard SetWindowTextA GetDlgItemTextA SetDlgItemTextA GetDlgItem IsWindowVisible SetWindowDisplayAffinity DestroyWindow CreateWindowExA RegisterClassA PostQuitMessage DefWindowProcA PostMessageW SendMessageW UnregisterHotKey RegisterHotKey DispatchMessageW TranslateMessage GetMessageW MessageBoxA InvalidateRect FillRect EnumWindows GetWindowThreadProcessId LoadCursorW GetDlgCtrlID ShowWindow

gdi32

SetBkMode CreateFontA CreateSolidBrush DeleteObject SelectObject SetBkColor SetTextColor

ole32

CoTaskMemFree

setupapi

SetupDiSetClassInstallParamsA SetupDiGetDeviceRegistryPropertyA SetupDiCallClassInstaller SetupDiGetClassDevsA SetupDiDestroyDeviceInfoList SetupDiEnumDeviceInfo

Name

.text

Size

2.2MB

Virtual Size

2.2MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

468KB

Virtual Size

467KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

11KB

Virtual Size

23KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

86KB

Virtual Size

85KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

13KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

1024B

Virtual Size

777B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.00cfg

Size

512B

Virtual Size

373B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

12KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-30_eff523fdde3f44a355b7acceacbaa2b2_icedid_njrat

winhttp

bcrypt

advapi32

comctl32

comdlg32

shell32

kernel32

user32

gdi32

ole32

setupapi

generic