2026-08-03_7571e687c10aac634e1cf5ac4bccc8bb_icedid_njrat

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-03_7571e687c10aac634e1cf5ac4bccc8bb_icedid_njrat
Size 2.6MB
Sample260803-c1rncsba72
SHA256 ff230caddab69f6305c4f3d3da67925c228823bb4f28c9bffac3a3721b6fe113
MD5 7571e687c10aac634e1cf5ac4bccc8bb
SHA1 e9c6eb0ba762f1c2e695266b3bad5cd233c5236f
SHA512 7fde85b2a89d6fbef2ccf7580e3ea771e1f0a97e648f4d982492073ac57e788fd455cd4559561c5c1cd71536394021d6972ab8a4600709a504036aef7c71c1b3
SSDEEP 49152:2UFamPhSs5BjQWTIUxR/Br9Zx/73oI1PZtVfBh7R/tEilpQJSPYG:fQjuPtBhHEiln
TLSH
T122C59E16BBA841F0D0A6C27CCA938A46FBB174555B319BCF05A2425F1F336E18E7E712
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-03_7571e687c10aac634e1cf5ac4bccc8bb_icedid_njrat

File Explorer

2026-08-03_7571e687c10aac634e1cf5ac4bccc8bb_icedid_njrat

.exe 2.6MB

2026-08-03_7571e687c10aac634e1cf5ac4bccc8bb_icedid_njrat

IMPHASH 7ccd21f1f6a339315bb7a4cc362f9cc7
SHA256 ff230caddab69f6305c4f3d3da67925c228823bb4f28c9bffac3a3721b6fe113
MD5 7571e687c10aac634e1cf5ac4bccc8bb
SHA1 e9c6eb0ba762f1c2e695266b3bad5cd233c5236f
SHA512 7fde85b2a89d6fbef2ccf7580e3ea771e1f0a97e648f4d982492073ac57e788fd455cd4559561c5c1cd71536394021d6972ab8a4600709a504036aef7c71c1b3
SSDEEP 49152:2UFamPhSs5BjQWTIUxR/Br9Zx/73oI1PZtVfBh7R/tEilpQJSPYG:fQjuPtBhHEiln
TLSH
T122C59E16BBA841F0D0A6C27CCA938A46FBB174555B319BCF05A2425F1F336E18E7E712
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

975120

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\qba1\workspace\6642\SSE_Storage_Middleware\RstMwService\output\Release\x64\RstMwService.pdb

api-ms-win-core-synch-l1-1-0

InitializeCriticalSection TryEnterCriticalSection EnterCriticalSection WaitForSingleObjectEx ReleaseSemaphore CreateEventW ResetEvent InitializeCriticalSectionAndSpinCount LeaveCriticalSection SetEvent WaitForSingleObject OpenEventA ReleaseMutex CreateMutexW CreateMutexA CreateEventA DeleteCriticalSection

api-ms-win-core-processthreads-l1-1-0

ExitProcess CreateThread SetThreadPriority TlsAlloc TlsGetValue TlsSetValue TlsFree SwitchToThread GetExitCodeThread GetCurrentProcess GetStartupInfoW GetCurrentThread ExitThread GetCurrentProcessId TerminateProcess GetCurrentThreadId GetThreadPriority

api-ms-win-core-errorhandling-l1-1-0

SetLastError SetUnhandledExceptionFilter GetLastError RaiseException UnhandledExceptionFilter

api-ms-win-core-handle-l1-1-0

DuplicateHandle CloseHandle

api-ms-win-service-core-l1-1-0

SetServiceStatus StartServiceCtrlDispatcherW

api-ms-win-eventing-classicprovider-l1-1-0

UnregisterTraceGuids GetTraceEnableFlags GetTraceLoggerHandle RegisterTraceGuidsW GetTraceEnableLevel TraceMessage

api-ms-win-service-winsvc-l1-1-0

RegisterServiceCtrlHandlerW

setupapi

SetupDiEnumDeviceInfo SetupDiDestroyDeviceInfoList SetupDiGetClassDevsA SetupDiGetDeviceRegistryPropertyA SetupDiEnumDeviceInterfaces SetupDiGetDeviceInterfaceDetailA CM_Reenumerate_DevNode CM_Locate_DevNodeA CM_Locate_DevNodeW CM_Get_Device_ID_List_SizeW CM_Get_Device_ID_ListW SetupDiRemoveDevice CM_Get_DevNode_Status

advapi32

InitiateSystemShutdownA DeregisterEventSource RegisterEventSourceW ReportEventW RegDeleteTreeW RegSetValueExW CloseServiceHandle OpenSCManagerW ControlService EnumDependentServicesW StartServiceW ChangeServiceConfigW OpenServiceW QueryServiceStatusEx RegSetKeyValueW RegCreateKeyExW LookupPrivilegeValueA AdjustTokenPrivileges OpenProcessToken RegDeleteValueA RegCreateKeyExA RegSetValueExA RegQueryValueExA RegOpenKeyExA RegQueryValueExW RegOpenKeyExW RegCloseKey SetEntriesInAclW SetSecurityDescriptorDacl OpenThreadToken AllocateAndInitializeSid CopySid EqualSid FreeSid GetLengthSid GetSidLengthRequired GetSidSubAuthority GetSidSubAuthorityCount GetTokenInformation InitializeSecurityDescriptor InitializeSid IsValidSid

ole32

CoMarshalInterThreadInterfaceInStream CoTaskMemFree CoGetInterfaceAndReleaseStream CoReleaseMarshalData StringFromGUID2 CoUninitialize CoCreateInstance CoCreateGuid CoInitialize CoInitializeEx

oleaut32

VariantInit SysAllocString SysFreeString VariantClear

userenv

UnloadUserProfile

api-ms-win-core-util-l1-1-0

DecodePointer EncodePointer

api-ms-win-core-heap-l1-1-0

HeapSize GetProcessHeap HeapReAlloc HeapAlloc HeapDestroy HeapFree

api-ms-win-security-base-l1-2-2

DeriveCapabilitySidsFromName

api-ms-win-core-heap-l2-1-0

LocalFree LocalAlloc

rpcrt4

NdrCorrelationFree NdrCorrelationPass NdrCorrelationInitialize NdrComplexStructMarshall I_RpcGetBuffer RpcRaiseException NdrServerCall2 RpcBindingFromStringBindingW RpcStringBindingComposeW NdrComplexStructBufferSize RpcBindingVectorFree RpcStringFreeW RpcStringFreeA UuidToStringA NdrClientCall3 RpcServerInqBindings RpcServerListen RpcServerRegisterIf3 RpcServerUnregisterIf RpcServerUseProtseqEpW RpcMgmtStopServerListening RpcRevertToSelfEx RpcEpRegisterW RpcEpUnregister NdrComplexStructFree NdrConvert RpcImpersonateClient NdrServerInitializeNew I_RpcGetCurrentCallHandle I_RpcBindingInqLocalClientPID RpcRevertToSelf

api-ms-win-core-processthreads-l1-1-1

GetThreadTimes OpenProcess IsProcessorFeaturePresent

api-ms-win-core-psapi-l1-1-0

K32EnumProcesses K32GetModuleBaseNameW

api-ms-win-core-timezone-l1-1-0

SystemTimeToFileTime GetTimeZoneInformation FileTimeToSystemTime

api-ms-win-core-sysinfo-l1-1-0

GetLogicalProcessorInformation GetSystemTimeAsFileTime GetSystemTime GetVersionExW GetSystemInfo GetTickCount

api-ms-win-core-libraryloader-l1-2-0

FreeLibrary GetModuleHandleA GetModuleFileNameW FreeLibraryAndExitThread LoadLibraryExW GetModuleHandleExW GetProcAddress GetModuleHandleW

api-ms-win-core-localization-l1-2-0

GetOEMCP IsValidLocale GetCPInfo FormatMessageW GetUserDefaultLCID GetLocaleInfoW LCMapStringW IsValidCodePage EnumSystemLocalesW GetACP

api-ms-win-core-datetime-l1-1-1

GetDateFormatEx GetTimeFormatEx

api-ms-win-core-synch-l1-2-0

Sleep SignalObjectAndWait

api-ms-win-core-string-obsolete-l1-1-0

lstrlenA

api-ms-win-core-file-l1-1-0

FindNextFileW FindClose GetFinalPathNameByHandleW WriteFile GetDiskFreeSpaceExA ReadFile FlushFileBuffers DeleteFileW GetFileType CreateFileA CreateFileW SetFilePointerEx FindFirstFileExW

api-ms-win-core-io-l1-1-0

DeviceIoControl

api-ms-win-ntuser-sysparams-l1-1-0

GetSystemMetrics

api-ms-win-core-sysinfo-l1-2-0

VerSetConditionMask

api-ms-win-core-kernel32-legacy-l1-1-2

VerifyVersionInfoA

api-ms-win-devices-config-l1-1-1

CM_Get_DevNode_PropertyW

api-ms-win-core-synch-ansi-l1-1-0

CreateSemaphoreA OpenMutexA

api-ms-win-core-file-l2-1-1

OpenFileById

api-ms-win-core-processenvironment-l1-1-0

SetEnvironmentVariableA GetStdHandle FreeEnvironmentStringsW SetStdHandle GetCommandLineW GetCommandLineA SetEnvironmentVariableW GetEnvironmentStringsW

api-ms-win-core-file-ansi-l1-1-0

QueryDosDeviceA

api-ms-win-core-string-l1-1-0

WideCharToMultiByte MultiByteToWideChar GetStringTypeW CompareStringW

api-ms-win-core-rtlsupport-l1-1-0

RtlLookupFunctionEntry RtlUnwindEx RtlPcToFileHeader RtlVirtualUnwind RtlCaptureContext

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-interlocked-l1-1-0

InterlockedPopEntrySList InterlockedFlushSList QueryDepthSList InitializeSListHead InterlockedPushEntrySList

api-ms-win-core-debug-l1-1-0

IsDebuggerPresent

api-ms-win-core-threadpool-legacy-l1-1-0

CreateTimerQueue UnregisterWaitEx DeleteTimerQueueTimer ChangeTimerQueueTimer CreateTimerQueueTimer

api-ms-win-core-systemtopology-l1-1-0

GetNumaHighestNodeNumber

api-ms-win-core-processtopology-obsolete-l1-1-0

SetThreadAffinityMask GetProcessAffinityMask

api-ms-win-core-kernel32-legacy-l1-1-0

RegisterWaitForSingleObject UnregisterWait

api-ms-win-core-memory-l1-1-0

VirtualAlloc VirtualFree VirtualProtect VirtualQuery

api-ms-win-core-libraryloader-l1-2-1

LoadLibraryW

api-ms-win-core-console-l1-1-0

WriteConsoleW GetConsoleCP ReadConsoleW GetConsoleMode

??0CConsolidatedError@@QEAA@AEBV0@@Z ??0CConsolidatedError@@QEAA@W4ISDI2_ERRORS@CConsolidatedErrorGenerated@@@Z ??0CConsolidatedError@@QEAA@XZ ??0GlobalLogger@@AEAA@XZ ??0ISIAccelerateAction@@QEAA@XZ ??0scoped_c_thread_locale@details@utility@@QEAA@XZ ??0value@json@web@@QEAA@$$QEAV012@@Z ??0value@json@web@@QEAA@AEBV012@@Z ??0value@json@web@@QEAA@H@Z ??0value@json@web@@QEAA@I@Z ??0value@json@web@@QEAA@N@Z ??0value@json@web@@QEAA@PEB_W@Z ??0value@json@web@@QEAA@PEB_W_N@Z ??0value@json@web@@QEAA@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z ??0value@json@web@@QEAA@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@_N@Z ??0value@json@web@@QEAA@XZ ??0value@json@web@@QEAA@_J@Z ??0value@json@web@@QEAA@_K@Z ??0value@json@web@@QEAA@_N@Z ??1CConsolidatedError@@QEAA@XZ ??1GlobalLogger@@QEAA@XZ ??1ISIAccelerateAction@@QEAA@XZ ??1scoped_c_thread_locale@details@utility@@QEAA@XZ ??4CConsolidatedError@@QEAAAEAV0@AEBV0@@Z ??4CConsolidatedErrorGenerated@@QEAAAEAV0@$$QEAV0@@Z ??4CConsolidatedErrorGenerated@@QEAAAEAV0@AEBV0@@Z ??4GlobalLogger@@AEAAAEAV0@$$QEAV0@@Z ??4value@json@web@@QEAAAEAV012@$$QEAV012@@Z ??4value@json@web@@QEAAAEAV012@AEBV012@@Z ??5json@web@@YAAEAV?$basic_istream@_WU?$char_traits@_W@std@@@std@@AEAV23@AEAVvalue@01@@Z ??6json@web@@YAAEAV?$basic_ostream@_WU?$char_traits@_W@std@@@std@@AEAV23@AEBVvalue@01@@Z ??8value@json@web@@QEBA_NAEBV012@@Z ??Avalue@json@web@@AEAAAEAV012@AEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z ??Avalue@json@web@@QEAAAEAV012@AEBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z ??Avalue@json@web@@QEAAAEAV012@_K@Z ??BCConsolidatedError@@QEBA?AU_ISI_Error@@XZ ?AddDebugInformation@CConsolidatedError@@QEAAXPEBDZZ ?AddDebugInformation@CConsolidatedError@@QEAAXPEB_WZZ ?AddErrorMessage@CConsolidatedError@@QEAAXPEBDZZ ?AddErrorMessage@CConsolidatedError@@QEAAXPEB_WZZ ?CleanupIsiError@@YAXI@Z ?CleanupIsiError@@YAXPEAU_ISI_Error@@@Z ?ClearError@CConsolidatedError@@QEAAXXZ ?FreeStringResources@CConsolidatedError@@AEAAXXZ ?GetDebugInformation@CConsolidatedError@@QEBAKPEADH@Z ?GetDebugInformation@CConsolidatedError@@QEBAKPEA_WH@Z ?GetDebugInformation@CConsolidatedError@@QEBAPEBDXZ ?GetErrorCodeString@CConsolidatedError@@QEBAKPEADH@Z ?GetErrorCodeString@CConsolidatedError@@QEBAKPEA_WH@Z ?GetErrorCodeString@CConsolidatedError@@QEBAPEBDXZ ?GetErrorMessage@CConsolidatedError@@QEBAKPEADH@Z ?GetErrorMessage@CConsolidatedError@@QEBAKPEA_WH@Z ?GetErrorMessage@CConsolidatedError@@QEBAPEBDXZ ?GetSrtEolError@CConsolidatedError@@SA?AV1@XZ ?InternalAddDebugInformation@CConsolidatedError@@AEAAXPEBDPEAD@Z ?InternalAddErrorMessage@CConsolidatedError@@AEAAXPEBDPEAD@Z ?IsBusy@CConsolidatedError@@QEBA_NXZ ?IsError@CConsolidatedError@@QEBA_NXZ ?IsPending@CConsolidatedError@@QEBA_NXZ ?IsSuccessful@CConsolidatedError@@QEBA_NXZ ?MAX_ERROR_STRING_SIZE@CConsolidatedError@@2HB ?MapIsiStatus@CConsolidatedError@@AEBA?AW4ISDI2_ERRORS@CConsolidatedErrorGenerated@@W4_ISI_Status@@@Z ?NO_ID@GlobalLogger@@2_KB ?SMALL_STRING_SIZE@CConsolidatedError@@2HB ?SetError@CConsolidatedError@@QEAAXV1@@Z ?SetError@CConsolidatedError@@QEAAXW4ISDI2_ERRORS@CConsolidatedErrorGenerated@@PEBD1@Z ?SetError@CConsolidatedError@@QEAAXW4ISDI2_ERRORS@CConsolidatedErrorGenerated@@PEBD@Z ?SetError@CConsolidatedError@@QEAAXW4ISDI2_ERRORS@CConsolidatedErrorGenerated@@PEB_W1@Z ?SetError@CConsolidatedError@@QEAAXW4ISDI2_ERRORS@CConsolidatedErrorGenerated@@PEB_W@Z ?SetError@CConsolidatedError@@QEAAXW4ISDI2_ERROR_TYPE@1@KPEBD@Z ?SetError@CConsolidatedError@@QEAAXW4ISDI2_ERROR_TYPE@1@KPEB_W@Z ?SetError@CConsolidatedError@@QEAAXW4_ISI_Status@@PEBD1@Z ?SetError@CConsolidatedError@@QEAAXW4_ISI_Status@@PEB_W1@Z ?SetErrorCodeString@CConsolidatedError@@AEAAXXZ ?SetLoggingOff@GlobalLogger@@SAXXZ ?SetLoggingOn@GlobalLogger@@SAXXZ ?__autoclassinit2@CConsolidatedError@@QEAAX_K@Z ?__autoclassinit2@GlobalLogger@@QEAAX_K@Z ?_disableLogging@GlobalLogger@@0_NA ?array@value@json@web@@SA?AV123@V?$vector@Vvalue@json@web@@V?$allocator@Vvalue@json@web@@@std@@@std@@@Z ?array@value@json@web@@SA?AV123@XZ ?array@value@json@web@@SA?AV123@_K@Z ?as_array@value@json@web@@QEAAAEAVarray@23@XZ ?as_array@value@json@web@@QEBAAEBVarray@23@XZ ?as_bool@value@json@web@@QEBA_NXZ ?as_double@value@json@web@@QEBANXZ ?as_integer@value@json@web@@QEBAHXZ ?as_number@value@json@web@@QEBAAEBVnumber@23@XZ ?as_object@value@json@web@@QEAAAEAVobject@23@XZ ?as_object@value@json@web@@QEBAAEBVobject@23@XZ ?as_string@value@json@web@@QEBAAEBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@XZ ?at@value@json@web@@QEAAAEAV123@AEBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z ?at@value@json@web@@QEAAAEAV123@_K@Z ?at@value@json@web@@QEBAAEBV123@AEBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z ?at@value@json@web@@QEBAAEBV123@_K@Z ?boolean@value@json@web@@SA?AV123@_N@Z ?c_locale@scoped_c_thread_locale@details@utility@@SAPEAU__crt_locale_pointers@@XZ ?checkIfDiskPairValid@ISIAccelerateAction@@UEAA?AU_ISI_Error@@IIAEAW4_ISI_NgsaDiskPairStatus@@@Z ?checkIfDiskValid@ISIAccelerateAction@@UEAA?AU_ISI_Error@@IW4_ISI_NgsaDiskConcatenationMember@@AEAW4_ISI_NgsaDiskValidForConcatenationStatus@@@Z ?clean@GlobalLogger@@QEAAX_K@Z ?configDiskAcceleration@ISIAccelerateAction@@UEAA?AU_ISI_Error@@IW4_ISI_NvcMode@@@Z ?configVolumeAcceleration@ISIAccelerateAction@@UEAA?AU_ISI_Error@@IW4_ISI_NvcMode@@@Z ?default_error_condition@windows_category_impl@details@utility@@UEBA?AVerror_condition@std@@H@Z ?doClearBlockCache@ISIAccelerateAction@@UEAA?AU_ISI_Error@@XZ ?doCreateCacheVolumeTask@ISIAccelerateAction@@UEAA?AU_ISI_Error@@I@Z ?doDisassociate@ISIAccelerateAction@@UEAA?AU_ISI_Error@@AEBU_ISI_VolumeInfo@@@Z ?doNgsaAutomation@ISIAccelerateAction@@UEAA?AU_ISI_Error@@AEAI@Z ?doNgsaDisableOneStep@ISIAccelerateAction@@UEAA?AU_ISI_Error@@XZ ?doNgsaEnableOneStep@ISIAccelerateAction@@UEAA?AU_ISI_Error@@XZ ?doNgsaStartTools@ISIAccelerateAction@@UEAA?AU_ISI_Error@@XZ ?doResetVolportPerformanceCounters@ISIAccelerateAction@@UEAA?AU_ISI_Error@@XZ ?doSeparateConcatenation@ISIAccelerateAction@@UEAA?AU_ISI_Error@@I@Z ?doSeparateConcatenationNoSync@ISIAccelerateAction@@QEAA?AU_ISI_Error@@XZ ?erase@value@json@web@@QEAAXAEBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z ?erase@value@json@web@@QEAAX_K@Z ?format@value@json@web@@AEBAXAEAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z ?format@value@json@web@@AEBAXAEAV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z ?from_string@datetime@utility@@SA?AV12@AEBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@W4date_format@12@@Z ?generate@nonce_generator@utility@@QEAA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@XZ ?get@GlobalLogger@@SAAEAV1@XZ ?getError@GlobalLogger@@QEAA?AVCConsolidatedError@@_K_N@Z ?getLastError@GlobalLogger@@QEAA?AVCConsolidatedError@@_N@Z ?getLastId@GlobalLogger@@QEAA_KXZ ?getMaxCacheSize@ISIAccelerateAction@@SA_K_N@Z ?getMinCacheSize@ISIAccelerateAction@@SA_K_N@Z ?getNgsaInfo@ISIAccelerateAction@@QEAA?AU_ISI_NgsaInfo@@XZ ?has_array_field@value@json@web@@QEBA_NAEBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z ?has_boolean_field@value@json@web@@QEBA_NAEBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z ?has_double_field@value@json@web@@QEBA_NAEBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z ?has_integer_field@value@json@web@@QEBA_NAEBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z ?has_number_field@value@json@web@@QEBA_NAEBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z ?has_object_field@value@json@web@@QEBA_NAEBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z ?has_string_field@value@json@web@@QEBA_NAEBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z ?is_double@value@json@web@@QEBA_NXZ ?is_int32@number@json@web@@QEBA_NXZ ?is_int64@number@json@web@@QEBA_NXZ ?is_integer@value@json@web@@QEBA_NXZ ?is_uint32@number@json@web@@QEBA_NXZ ?keep_object_element_order@json@web@@YAX_N@Z ?latin1_to_utf16@conversions@utility@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@AEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@4@@Z ?latin1_to_utf8@conversions@utility@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AEBV34@@Z ?message@windows_category_impl@details@utility@@UEBA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@H@Z ?null@value@json@web@@SA?AV123@XZ ?number@value@json@web@@SA?AV123@H@Z ?number@value@json@web@@SA?AV123@I@Z ?number@value@json@web@@SA?AV123@N@Z ?number@value@json@web@@SA?AV123@_J@Z ?number@value@json@web@@SA?AV123@_K@Z ?object@value@json@web@@SA?AV123@V?$vector@U?$pair@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@Vvalue@json@web@@@std@@V?$allocator@U?$pair@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@Vvalue@json@web@@@std@@@2@@std@@_N@Z ?object@value@json@web@@SA?AV123@_N@Z ?parse@value@json@web@@SA?AV123@AEAV?$basic_istream@DU?$char_traits@D@std@@@std@@@Z ?parse@value@json@web@@SA?AV123@AEAV?$basic_istream@DU?$char_traits@D@std@@@std@@AEAVerror_code@5@@Z ?parse@value@json@web@@SA?AV123@AEAV?$basic_istream@_WU?$char_traits@_W@std@@@std@@@Z ?parse@value@json@web@@SA?AV123@AEAV?$basic_istream@_WU?$char_traits@_W@std@@@std@@AEAVerror_code@5@@Z ?parse@value@json@web@@SA?AV123@AEBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z ?parse@value@json@web@@SA?AV123@AEBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@AEAVerror_code@5@@Z ?platform_category@details@utility@@YAAEBVerror_category@std@@XZ ?resetCacheToAvailable@ISIAccelerateAction@@UEAA?AU_ISI_Error@@I@Z ?seconds_to_xml_duration@timespan@utility@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@V?$duration@_JU?$ratio@$00$00@std@@@chrono@4@@Z ?serialize@value@json@web@@QEBA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@XZ ?serialize@value@json@web@@QEBAXAEAV?$basic_ostream@DU?$char_traits@D@std@@@std@@@Z ?serialize@value@json@web@@QEBAXAEAV?$basic_ostream@_WU?$char_traits@_W@std@@@std@@@Z ?setCacheVolSize@ISIAccelerateAction@@UEAAX_K@Z ?setError@GlobalLogger@@QEAA_KAEBVCConsolidatedError@@@Z ?setError@GlobalLogger@@QEAA_KAEBVCConsolidatedError@@AEAU_ISI_Error@@@Z ?setFastDisk@ISIAccelerateAction@@UEAAXI@Z ?setFileCacheSize@ISIAccelerateAction@@UEAAXI@Z ?setMigrationStart@ISIAccelerateAction@@UEAAX_K@Z ?setPreservePinningData@ISIAccelerateAction@@UEAAX_N@Z ?setSeparationSafe@ISIAccelerateAction@@UEAAX_N@Z ?setSlowDisk@ISIAccelerateAction@@UEAAXI@Z ?string@value@json@web@@CA?AV123@AEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z ?string@value@json@web@@SA?AV123@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z ?string@value@json@web@@SA?AV123@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@_N@Z ?system_type_to_datetime@datetime@utility@@CA_NPEAX_KPEAV12@@Z ?to_string@datetime@utility@@QEBA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@W4date_format@12@@Z ?to_string@value@json@web@@QEBA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@XZ ?to_string_t@conversions@utility@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@$$QEAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@4@@Z ?to_string_t@conversions@utility@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@AEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@4@@Z ?to_utf16string@conversions@utility@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@AEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@4@@Z ?to_utf8string@conversions@utility@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AEBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@4@@Z ?turnOffVolumeOrDiskAcceleration@ISIAccelerateAction@@UEAA?AU_ISI_Error@@I@Z ?type@value@json@web@@QEBA?AW4value_type@123@XZ ?usascii_to_utf16@conversions@utility@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@AEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@4@@Z ?utc_now@datetime@utility@@SA?AV12@XZ ?utf16_to_utf8@conversions@utility@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AEBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@4@@Z ?utf8_to_utf16@conversions@utility@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@AEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@4@@Z ?waitForNvcMode@ISIAccelerateAction@@UEAA?AU_ISI_Error@@IW4_ISI_NvcMode@@@Z ?windows_category@details@utility@@YAAEBVerror_category@std@@XZ ?xml_duration_to_seconds@timespan@utility@@YA?AV?$duration@_JU?$ratio@$00$00@std@@@chrono@std@@AEBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@5@@Z GetLPCId ISI_NgsaDiskPairStatusToDescription ISI_NgsaDiskValidForConcatenationStatusToDescription ISI_NgsaOperationStatusToDescription IsiAddDisksToArray IsiArraySetWriteCacheState IsiCacheVolumeCreateFromArray IsiCacheVolumeCreateFromDisks IsiDiskAssignStoragePool IsiDiskClaim IsiDiskClearMetadata IsiDiskDestroyCache IsiDiskGetPartitionTableInfos IsiDiskMarkAsFailed IsiDiskMarkAsNormal IsiDiskMarkAsSpare IsiDiskMarkOffline IsiDiskMarkOnline IsiDiskResetSmartEvent IsiDiskSetCacheBufferFlushSetting IsiDiskSetCacheMode IsiDiskSetCacheSpindownPolicy IsiDiskSetSmartEvent IsiDiskSetWriteCachingPolicySetting IsiDiskUnlock IsiDiskUnmarkAsSpare IsiEventClose IsiEventSetUpForAllWithHandle IsiEventWaitWithHandle IsiExpandVolume IsiFinalize IsiGetArrayHandles IsiGetArrayHandlesByControllerHandle IsiGetArrayInfo IsiGetControllerHandles IsiGetControllerInfo IsiGetDiskIdentifyData IsiGetEndDeviceHandles IsiGetEndDeviceInfo IsiGetErrorDebugMessage IsiGetErrorMessage IsiGetIsRTD3HotEnabled IsiGetIsmArrays IsiGetIsmEndDevices IsiGetIsmVolumes IsiGetLastErrorDebugMessage IsiGetLastErrorMessage IsiGetMiddlewareVersionInfo IsiGetNgsaDiskPairHandles IsiGetNgsaDiskPairInfo IsiGetNgsaHandles IsiGetNgsaInfo IsiGetNgsaInfoEx IsiGetNvCachePolicyStatInfo IsiGetNvCacheStat2Info IsiGetNvCacheStatInfo IsiGetNvCacheUnifiedStats IsiGetNvcInfo IsiGetOptaneOptimizationInfo IsiGetPhyHandles IsiGetPhyInfo IsiGetRaidInfo IsiGetRaidInfoHandles IsiGetRaidLevelInfo IsiGetRdpDictEndDevices IsiGetSystemInfo IsiGetVolportPerformanceCounters IsiGetVolumeHandles IsiGetVolumeInfo IsiGetVolumeMigrationRange IsiGetZpoddInfo IsiInitialize IsiNvcDisassociate IsiROHISetState IsiRaidLevelModify IsiReadPatrolSetState IsiRefreshPartitionInfo IsiRescan IsiSessionClose IsiSessionOpen IsiSetIntelHybridDiskSubClassCode IsiSetLpmStatus IsiSetReadPatrolUnit IsiToggleCoalescerPolicy IsiUpdatePmInterfaceFields IsiVdsHandlerMakeSpaceForMetadataOnSystemDisk IsiVolumeCancelVerify IsiVolumeConvertIrrtToRaid1 IsiVolumeConvertRaid1ToIrrt IsiVolumeCreate IsiVolumeCreateFromDisks IsiVolumeDelete IsiVolumeDestroyCache IsiVolumeInitialize IsiVolumeIrrtCreate IsiVolumeIrrtMountPartner IsiVolumeIrrtSetAutomaticSync IsiVolumeIrrtSetManualSync IsiVolumeIrrtSwapDisks IsiVolumeIrrtSync IsiVolumeIrrtUnMountPartner IsiVolumeMarkAsNormal IsiVolumeRebuild IsiVolumeRename IsiVolumeSetBufferFlush IsiVolumeSetCacheMode IsiVolumeSetCachePolicy IsiVolumeSetCacheSpindownPolicy IsiVolumeSetExportPolicy IsiVolumeVerify

Name

.text

Size

1.3MB

Virtual Size

1.3MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

585KB

Virtual Size

584KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

42KB

Virtual Size

69KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

72KB

Virtual Size

72KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

1024B

Virtual Size

617B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

580KB

Virtual Size

584KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-03_7571e687c10aac634e1cf5ac4bccc8bb_icedid_njrat

api-ms-win-core-synch-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-service-core-l1-1-0

api-ms-win-eventing-classicprovider-l1-1-0

api-ms-win-service-winsvc-l1-1-0

setupapi

advapi32

ole32

oleaut32

userenv

api-ms-win-core-util-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-security-base-l1-2-2

api-ms-win-core-heap-l2-1-0

rpcrt4

api-ms-win-core-processthreads-l1-1-1

api-ms-win-core-psapi-l1-1-0

api-ms-win-core-timezone-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-datetime-l1-1-1

api-ms-win-core-synch-l1-2-0

api-ms-win-core-string-obsolete-l1-1-0

api-ms-win-core-file-l1-1-0

api-ms-win-core-io-l1-1-0

api-ms-win-ntuser-sysparams-l1-1-0

api-ms-win-core-sysinfo-l1-2-0

api-ms-win-core-kernel32-legacy-l1-1-2

api-ms-win-devices-config-l1-1-1

api-ms-win-core-synch-ansi-l1-1-0

api-ms-win-core-file-l2-1-1

api-ms-win-core-processenvironment-l1-1-0

api-ms-win-core-file-ansi-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-rtlsupport-l1-1-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-interlocked-l1-1-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-threadpool-legacy-l1-1-0

api-ms-win-core-systemtopology-l1-1-0

api-ms-win-core-processtopology-obsolete-l1-1-0

api-ms-win-core-kernel32-legacy-l1-1-0

api-ms-win-core-memory-l1-1-0

api-ms-win-core-libraryloader-l1-2-1

api-ms-win-core-console-l1-1-0

generic