2026-07-31_f6abfe6f2dd569cdb04b5a97df36ddb0_icedid_njrat_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-31_f6abfe6f2dd569cdb04b5a97df36ddb0_icedid_njrat_stealc
Size 10.6MB
Sample260731-msmdsagh46
SHA256 37b32dae3ab8218226933160ca08cc0edca51fad6cbf600403c45c55a6dd5797
MD5 f6abfe6f2dd569cdb04b5a97df36ddb0
SHA1 4fb3c6943b0f2060efc6904b65a396e2cd3551d0
SHA512 8947cd8d654a2d9607dc72e1e67aca92ebc28a7b17f9915662f6592e7a633e179aea96d885351b6885699cc82cae8ff092a7c83e05d64b108603467969d00dca
SSDEEP 196608:gFnr+uVDYMlUAuHMqzsuecDdsuxWpuHcicDQsuxWJecDZsuxW73cDUsuxWr:/umafSWcDds9pwcDQs9AcDZs9rcDUs9
TLSH
T12BB6F187B3D94599D027B0348A52590BE3313428072086EB7FDD4A6E5FBB7F08B7AB51
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-31_f6abfe6f2dd569cdb04b5a97df36ddb0_icedid_njrat_stealc

File Explorer

2026-07-31_f6abfe6f2dd569cdb04b5a97df36ddb0_icedid_njrat_stealc

.exe 10.6MB

2026-07-31_f6abfe6f2dd569cdb04b5a97df36ddb0_icedid_njrat_stealc

IMPHASH 17df95d6ff1622cc39ac6db8683a88c9
SHA256 37b32dae3ab8218226933160ca08cc0edca51fad6cbf600403c45c55a6dd5797
MD5 f6abfe6f2dd569cdb04b5a97df36ddb0
SHA1 4fb3c6943b0f2060efc6904b65a396e2cd3551d0
SHA512 8947cd8d654a2d9607dc72e1e67aca92ebc28a7b17f9915662f6592e7a633e179aea96d885351b6885699cc82cae8ff092a7c83e05d64b108603467969d00dca
SSDEEP 196608:gFnr+uVDYMlUAuHMqzsuecDdsuxWpuHcicDQsuxWJecDZsuxW73cDUsuxWr:/umafSWcDds9pwcDQs9AcDZs9rcDUs9
TLSH
T12BB6F187B3D94599D027B0348A52590BE3313428072086EB7FDD4A6E5FBB7F08B7AB51
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

607708

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

d3d11

D3D11CreateDeviceAndSwapChain

d3dcompiler_47

D3DCompile

winhttp

WinHttpSetTimeouts WinHttpReceiveResponse WinHttpOpenRequest WinHttpOpen WinHttpSendRequest WinHttpConnect WinHttpCrackUrl WinHttpQueryDataAvailable WinHttpQueryHeaders WinHttpCloseHandle WinHttpSetOption WinHttpReadData

ole32

CoInitializeEx PropVariantClear CreateStreamOnHGlobal CoSetProxyBlanket CoCreateInstance CoUninitialize

oleaut32

VariantInit SysStringLen VariantClear SysFreeString SysAllocString

gdiplus

GdipBitmapLockBits GdiplusStartup GdipGetImageHeight GdipCloneImage GdipGetPropertyItemSize GdipGetPropertyItem GdipCreateBitmapFromStream GdipAlloc GdipDisposeImage GdipFree GdipImageSelectActiveFrame GdipBitmapUnlockBits GdipImageGetFrameCount GdipGetImageWidth

userenv

CreateEnvironmentBlock DestroyEnvironmentBlock

wtsapi32

WTSQueryUserToken

kernel32

AreFileApisANSI GetFileAttributesExW GetFileInformationByHandleEx FormatMessageA GetLocaleInfoEx CreateDirectoryW SizeofResource HeapFree SetPriorityClass GetCommandLineW GetCurrentProcess OutputDebugStringA GetModuleFileNameW SetThreadPriority GetTempPathW FindResourceA WaitForSingleObject CreateFileW K32GetProcessImageFileNameW GetSystemDirectoryW GetModuleHandleA OpenProcess CreateToolhelp32Snapshot ProcessIdToSessionId Sleep GetLastError Process32NextW SetFileInformationByHandle GetCurrentThread LockResource QueryPerformanceFrequency GlobalAlloc DeleteFileW Process32FirstW GlobalFree AcquireSRWLockExclusive CreateThread WakeAllConditionVariable FindResourceW HeapAlloc K32EnumProcesses Beep GetProcAddress GlobalLock WTSGetActiveConsoleSessionId ExitProcess GetComputerNameW GetCurrentProcessId GetProcessHeap GlobalMemoryStatusEx CreateProcessW GetModuleHandleW CopyFileW WideCharToMultiByte CreateProcessA CreateDirectoryA CreateFileMappingW CreateEventA QueryPerformanceCounter GetTickCount GlobalUnlock IsDebuggerPresent GetComputerNameA SetUnhandledExceptionFilter WriteProcessMemory QueryFullProcessImageNameW LoadLibraryA VirtualProtectEx VirtualAllocEx CreateRemoteThread GetSystemTimeAsFileTime VirtualFreeEx ResumeThread GetThreadContext SetThreadContext GetTickCount64 GetVolumeInformationW MultiByteToWideChar LocalFree GetLocaleInfoA IsDBCSLeadByte VerSetConditionMask FreeLibrary VirtualFree DeviceIoControl VirtualAlloc GetCurrentThreadId SleepConditionVariableSRW ReleaseSRWLockExclusive LoadResource UnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent InitializeSListHead GetStartupInfoW CloseHandle FindClose FindFirstFileW FindFirstFileExW FindNextFileW

user32

SetCursor SetProcessDPIAware IsWindowUnicode LoadCursorW ReleaseCapture SetCursorPos ReleaseDC GetCursorPos GetClipboardData GetWindowThreadProcessId DefWindowProcW MonitorFromPoint DestroyWindow IsWindowVisible SetWindowRgn GetKeyboardLayout ScreenToClient GetSystemMetrics UnregisterClassW SetCapture RegisterClassExW ShowWindow OpenClipboard DispatchMessageW CloseClipboard EmptyClipboard PeekMessageW MessageBoxA GetForegroundWindow EnumWindows TranslateMessage SetClipboardData GetClientRect PostQuitMessage SystemParametersInfoW UpdateWindow GetWindowTextW TrackMouseEvent ClientToScreen GetCapture GetDC GetShellWindow GetMessageExtraInfo GetKeyState CreateWindowExW

gdi32

GetDeviceCaps CreateRoundRectRgn GetStockObject

advapi32

SaferCreateLevel LookupPrivilegeValueW AdjustTokenPrivileges CryptAcquireContextW SaferCloseLevel GetUserNameA CreateProcessWithTokenW CryptCreateHash CryptHashData CryptDestroyHash OpenProcessToken CreateProcessAsUserW CryptGetHashParam DuplicateTokenEx SaferComputeTokenFromLevel CryptReleaseContext RegOpenKeyExW RegCloseKey RegOpenKeyW RegCreateKeyW RegDeleteTreeW RegSetKeyValueW RegQueryValueExW

shell32

ShellExecuteW SHGetFolderPathW

msvcp140

?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?_Syserror_map@std@@YAPEBDH@Z ?_Xlength_error@std@@YAXPEBD@Z ?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Xout_of_range@std@@YAXPEBD@Z ?_Id_cnt@id@locale@std@@0HA ?_Xbad_alloc@std@@YAXXZ ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ??0_Lockit@std@@QEAA@H@Z ??1_Lockit@std@@QEAA@XZ ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z ?good@ios_base@std@@QEBA_NXZ ??7ios_base@std@@QEBA_NXZ ?_Winerror_map@std@@YAHH@Z ?always_noconv@codecvt_base@std@@QEBA_NXZ

dwmapi

DwmExtendFrameIntoClientArea DwmSetWindowAttribute

crypt32

CryptProtectData CryptUnprotectData

ntdll

NtQuerySystemInformation RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext RtlInitUnicodeString NtLoadDriver NtUnloadDriver RtlAdjustPrivilege

imm32

ImmSetCandidateWindow ImmGetContext ImmSetCompositionWindow ImmReleaseContext

vcruntime140_1

__CxxFrameHandler4

vcruntime140

memcpy __current_exception memcmp memchr memset memmove strchr __std_terminate wcsstr __std_exception_copy __std_exception_destroy __current_exception_context __C_specific_handler _CxxThrowException

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vsscanf __stdio_common_vsnprintf_s _get_stream_buffer_pointers __acrt_iob_func _fseeki64 fread fsetpos setvbuf fgetpos __stdio_common_vsprintf _wfopen fopen_s fwrite _set_fmode __stdio_common_vfprintf fgetc __stdio_common_vsprintf_s fseek fclose _wfopen_s fflush __stdio_common_vswprintf_s fputc ftell __p__commode ungetc

api-ms-win-crt-heap-l1-1-0

_callnewh malloc realloc _set_new_mode free

api-ms-win-crt-utility-l1-1-0

qsort rand srand

api-ms-win-crt-string-l1-1-0

strncpy _stricmp strncmp _strnicmp tolower strncpy_s _wcsicmp towlower strcmp

api-ms-win-crt-runtime-l1-1-0

_register_onexit_function _c_exit _exit terminate abort _register_thread_local_exe_atexit_callback _crt_atexit _initterm exit _cexit _get_wide_winmain_command_line _invoke_watson _seh_filter_exe _initterm_e _set_app_type _configure_wide_argv _initialize_wide_environment _initialize_onexit_table

api-ms-win-crt-filesystem-l1-1-0

_lock_file _wremove _unlock_file

api-ms-win-crt-convert-l1-1-0

_atoi64 strtol

api-ms-win-crt-math-l1-1-0

expf sinf ldexp sqrtf powf __setusermatherr fmodf cosf acosf floorf ceilf

api-ms-win-crt-time-l1-1-0

_time64

api-ms-win-crt-locale-l1-1-0

_configthreadlocale ___lc_codepage_func

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-31_f6abfe6f2dd569cdb04b5a97df36ddb0_icedid_njrat_stealc

d3d11

d3dcompiler_47

winhttp

ole32

oleaut32

gdiplus

userenv

wtsapi32

kernel32

user32

gdi32

advapi32

shell32

msvcp140

dwmapi

crypt32

ntdll

imm32

vcruntime140_1

vcruntime140

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic