2026-07-30_a0269ad26cb644366d683d9605fd696e_icedid_njrat

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-30_a0269ad26cb644366d683d9605fd696e_icedid_njrat
Size 1.2MB
Sample260730-vsd2eacg56
SHA256 0c4b980c9fc2224c5a7b50783071173c42c6a013a82b1cedd31fd0aa02cc6016
MD5 a0269ad26cb644366d683d9605fd696e
SHA1 9ed0ef1f552c93fe492e0fee21dd63b19213cbdc
SHA512 797029adaf4a569fd2bef9222b477030c4fab146d650fe5cef0d828d9b04decc54881144126b7ccee6fe8c278a04524dbc2a09cda8196952e660c03de5a0feb1
SSDEEP 24576:lDHw8aTONhLl3Iys6mctvE/BT76+1NCE:hHw8aUs6mGvKVO+n1
TLSH
T1BE55E17567E913E2D0B7D17F8A85CB5AE6F17814472097C702D0429A2F23AE84E3F726
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-30_a0269ad26cb644366d683d9605fd696e_icedid_njrat

File Explorer

2026-07-30_a0269ad26cb644366d683d9605fd696e_icedid_njrat

.exe 1.2MB

2026-07-30_a0269ad26cb644366d683d9605fd696e_icedid_njrat

IMPHASH d8f487f16ccc3e647a634871ddee503c
SHA256 0c4b980c9fc2224c5a7b50783071173c42c6a013a82b1cedd31fd0aa02cc6016
MD5 a0269ad26cb644366d683d9605fd696e
SHA1 9ed0ef1f552c93fe492e0fee21dd63b19213cbdc
SHA512 797029adaf4a569fd2bef9222b477030c4fab146d650fe5cef0d828d9b04decc54881144126b7ccee6fe8c278a04524dbc2a09cda8196952e660c03de5a0feb1
SSDEEP 24576:lDHw8aTONhLl3Iys6mctvE/BT76+1NCE:hHw8aUs6mGvKVO+n1
TLSH
T1BE55E17567E913E2D0B7D17F8A85CB5AE6F17814472097C702D0429A2F23AE84E3F726
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

12506

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\a\MedalStudio\MedalStudio\HookCapture\build\injector\RelWithDebInfo\inject-helper64-v2.pdb

kernel32

GetCurrentProcess OpenThread GetExitCodeThread GetProcessIdOfThread FreeLibrary GetProcAddress LoadLibraryW MultiByteToWideChar CreateRemoteThread OpenProcess VirtualAllocEx WriteProcessMemory VirtualFreeEx GetModuleHandleW OutputDebugStringA CreateMutexW OpenMutexW CreateEventW OpenEventW Sleep GetCurrentThreadId GetTickCount64 CreateFileMappingW OpenFileMappingW MapViewOfFile UnmapViewOfFile CreateFileA ReadFile WriteFile ConnectNamedPipe DisconnectNamedPipe SetNamedPipeHandleState CancelIoEx CreateThread CreateNamedPipeA WriteConsoleW SetEndOfFile HeapReAlloc HeapSize ReadConsoleW WaitForSingleObject SetErrorMode GetLastError CloseHandle GetCurrentProcessId GetFullPathNameW InitOnceBeginInitialize InitOnceComplete RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW RtlPcToFileHeader RaiseException RtlUnwindEx InterlockedPushEntrySList InterlockedFlushSList SetLastError EncodePointer EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW GetStdHandle GetModuleFileNameW ExitProcess GetModuleHandleExW GetCommandLineA GetCommandLineW GetCurrentThread HeapAlloc HeapFree GetTempPathW FlsAlloc FlsGetValue FlsSetValue FlsFree IsThreadAFiber InitializeCriticalSectionEx VirtualProtect GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetFileType FlushFileBuffers GetConsoleOutputCP GetConsoleMode SetConsoleCtrlHandler OutputDebugStringW FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle GetStringTypeW GetProcessHeap GetFileSizeEx SetFilePointerEx CreateFileW RtlUnwind

user32

PostThreadMessageW SetWindowsHookExW UnhookWindowsHookEx

advapi32

InitializeSecurityDescriptor LookupPrivilegeValueW AdjustTokenPrivileges OpenProcessToken SetSecurityDescriptorDacl

Name

.text

Size

564KB

Virtual Size

564KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

101KB

Virtual Size

101KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

23KB

Virtual Size

23KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

1024B

Virtual Size

796B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.00cfg

Size

512B

Virtual Size

373B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

1024B

Virtual Size

563B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

572KB

Virtual Size

576KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-30_a0269ad26cb644366d683d9605fd696e_icedid_njrat

kernel32

user32

advapi32

generic