2026-08-04_117dc080675a16f2704274bac3ecdb95_icedid_njrat

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-04_117dc080675a16f2704274bac3ecdb95_icedid_njrat
Size 1.9MB
Sample260804-3dfwfsshne
SHA256 5c9da3acf705114e8cc63af82f5744960f45eb1a2b2a1045b1e19bec36fd8202
MD5 117dc080675a16f2704274bac3ecdb95
SHA1 3e3cd466b584c5788f75da2cb5dba9d86ed83421
SHA512 888db3adc2e050092f202b5111ff1e3efe448e70d0f4e728a91037869301de855ae4f12faaddcf9936428dca972efaa641cc5030df8410a65f2a2d44c6482786
SSDEEP 49152:UdIqJvkezfydaWzMKPM5bzpk+g6HnuFUTP/:edRU9+
TLSH
T146957C16F6EA10E4F57AD13489A3761FF83678540734A7DBA6814A091FB1FE0BA7E340
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-04_117dc080675a16f2704274bac3ecdb95_icedid_njrat

File Explorer

2026-08-04_117dc080675a16f2704274bac3ecdb95_icedid_njrat

.exe 1.9MB

2026-08-04_117dc080675a16f2704274bac3ecdb95_icedid_njrat

IMPHASH c86361132d4c3ef23261a73e66c37886
SHA256 5c9da3acf705114e8cc63af82f5744960f45eb1a2b2a1045b1e19bec36fd8202
MD5 117dc080675a16f2704274bac3ecdb95
SHA1 3e3cd466b584c5788f75da2cb5dba9d86ed83421
SHA512 888db3adc2e050092f202b5111ff1e3efe448e70d0f4e728a91037869301de855ae4f12faaddcf9936428dca972efaa641cc5030df8410a65f2a2d44c6482786
SSDEEP 49152:UdIqJvkezfydaWzMKPM5bzpk+g6HnuFUTP/:edRU9+
TLSH
T146957C16F6EA10E4F57AD13489A3761FF83678540734A7DBA6814A091FB1FE0BA7E340
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1957376

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

d3d11

D3D11CreateDeviceAndSwapChain

kernel32

Process32NextW GetProcAddress lstrcmpiW GetProcessHandleCount VirtualProtect RtlAddFunctionTable LoadLibraryA VirtualAllocEx CreateRemoteThread VirtualFreeEx GetExitCodeProcess VirtualFree VirtualAlloc OpenProcess Process32FirstW GetSystemInfo ReadProcessMemory WideCharToMultiByte VirtualQueryEx GetFileAttributesA GlobalAlloc GlobalLock GlobalUnlock GlobalFree GetLocaleInfoA QueryPerformanceFrequency IsDBCSLeadByte FreeLibrary QueryPerformanceCounter FlsGetValue FlsAlloc SetLastError RaiseException RtlPcToFileHeader CreateToolhelp32Snapshot Sleep RtlLookupFunctionEntry InitializeSListHead GetSystemTimeAsFileTime GetCurrentProcessId GetModuleHandleW GetStartupInfoW SetUnhandledExceptionFilter GetStringTypeW GetCPInfo CompareStringEx SleepConditionVariableSRW WakeAllConditionVariable GetSystemTimePreciseAsFileTime LCMapStringEx DecodePointer EncodePointer DeleteCriticalSection InitializeCriticalSectionEx LeaveCriticalSection EnterCriticalSection GetCurrentThreadId TryAcquireSRWLockExclusive AcquireSRWLockExclusive ReleaseSRWLockExclusive FlsFree TerminateProcess GetModuleFileNameW GetModuleHandleExW CreateFileA GetLastError MultiByteToWideChar GetModuleHandleA GetProcessId SetProcessWorkingSetSize GetTickCount HeapAlloc HeapSize GetTickCount64 WriteFile WaitNamedPipeA ReadFile CreateThread ExitProcess OutputDebugStringA GetComputerNameA LocalFree CloseHandle GetCurrentProcess RtlUnwind GetVolumeInformationW SetEndOfFile RtlUnwindEx HeapValidate ExitThread CreateFileW SetStdHandle SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW FindNextFileW FindFirstFileExW FindClose GetOEMCP GetACP IsValidCodePage GetFileSizeEx FreeLibraryAndExitThread IsProcessorFeaturePresent GetStdHandle GetCommandLineA GetCommandLineW RtlCaptureContext RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter GetFileType GetConsoleOutputCP FlushFileBuffers GetTimeZoneInformation ReadConsoleW GetConsoleMode SetFilePointerEx EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW LoadLibraryExW GetProcessHeap HeapQueryInformation HeapReAlloc HeapFree WriteConsoleW OutputDebugStringW FlsSetValue

user32

SetForegroundWindow ReleaseCapture UpdateWindow GetCursorPos GetAsyncKeyState ReleaseDC SystemParametersInfoW GetKeyState GetMessageExtraInfo GetCapture ClientToScreen TrackMouseEvent GetKeyboardLayout GetForegroundWindow LoadCursorW SetCursor GetClientRect IsWindowUnicode SetCursorPos OpenClipboard CloseClipboard EmptyClipboard GetClipboardData SetClipboardData DefWindowProcW PostMessageW GetWindowRect DestroyWindow GetDC IsWindowVisible SetWindowPos SetWindowLongPtrW CreateWindowExW ScreenToClient GetSystemMetrics GetWindowLongPtrW RegisterClassExW ShowWindow IsWindow DispatchMessageW PeekMessageW SetLayeredWindowAttributes TranslateMessage SetCapture UpdateLayeredWindow PostQuitMessage

gdi32

CreateDIBSection CreateCompatibleDC DeleteDC DeleteObject SelectObject

advapi32

RegCloseKey GetUserNameA ConvertSidToStringSidA RegQueryValueExA OpenProcessToken RegOpenKeyExA GetTokenInformation

shell32

ShellExecuteW ShellExecuteA

ole32

CoCreateInstance CreateStreamOnHGlobal CoInitializeEx

bcrypt

BCryptCreateHash BCryptHashData BCryptDestroyHash BCryptCloseAlgorithmProvider BCryptGetProperty BCryptOpenAlgorithmProvider BCryptFinishHash

winhttp

WinHttpQueryDataAvailable WinHttpConnect WinHttpSetTimeouts WinHttpSendRequest WinHttpCloseHandle WinHttpOpenRequest WinHttpReadData WinHttpOpen WinHttpReceiveResponse WinHttpQueryHeaders

ntdll

NtWriteVirtualMemory NtReadVirtualMemory NtQueryVirtualMemory

gdiplus

GdipDeletePath GdipDisposeImage GdipSetSmoothingMode GdipCreatePath GdipCreateFont GdipCreateSolidFill GdipFillPath GdipGraphicsClear GdipDrawLine GdipFillRectangle GdipClosePathFigure GdipFree GdipDrawPath GdipAlloc GdipCreateFromHDC GdipFillEllipse GdipSetTextRenderingHint GdipCloneBrush GdipAddPathArc GdipDeleteGraphics GdipDeleteFont GdipDeletePen GdipCreatePen1 GdiplusStartup GdiplusShutdown GdipAddPathLine GdipDeleteFontFamily GdipCreateBitmapFromStream GdipDeleteBrush GdipCloneImage GdipDrawImageRect GdipCreateFontFamilyFromName GdipDrawString

imm32

ImmSetCandidateWindow ImmReleaseContext ImmGetContext ImmSetCompositionWindow

d3dcompiler_47

D3DCompile

Name

.text

Size

1.0MB

Virtual Size

1.0MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

398KB

Virtual Size

397KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

414KB

Virtual Size

422KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

43KB

Virtual Size

43KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1024B

Virtual Size

696B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

41KB

Virtual Size

91KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-04_117dc080675a16f2704274bac3ecdb95_icedid_njrat

d3d11

kernel32

user32

gdi32

advapi32

shell32

ole32

bcrypt

winhttp

ntdll

gdiplus

imm32

d3dcompiler_47

generic