2026-08-09_65e1bcdf06898bb86b9faa4b213fbb36_icedid_njrat

General

Target
2026-08-09_65e1bcdf06898bb86b9faa4b213fbb36_icedid_njrat
Size 790KB
Sample260809-rms2laswgz
SHA256 bbd24cfd9359787c91c447c3e4a2f19244fcb82eb6024bc6d21c7f769b8a6ca7
MD5 65e1bcdf06898bb86b9faa4b213fbb36
SHA1 be0c2d0e88f6e517f61d447965116288b1003f71
SHA512 800651726bade3edacb3574d787ce921c39d9c498e50a5ec8708ae6f3572e33cacfda241cb58c62b61630bee5377ab8c0642d3fe4e0908c8bc43541ec6caaa76
SSDEEP 12288:crCB1igsNHfcsc+ZOnZxwWMzy8dY7WMyVOY3XHrE9baannDdryBkoGsS0zMG3x:BslZOZj7W9XHmm3BtlAq
TLSH
T15F059E77677E48EFD8B3423C75129BB1F961F6CD0197A3DAA1A20255063FB10EE066B0
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects executables packed with VMProtect. 1 IoCs

resource	yara_rule
sample	INDICATOR_EXE_Packed_VMProtect

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-09_65e1bcdf06898bb86b9faa4b213fbb36_icedid_njrat

File Explorer

2026-08-09_65e1bcdf06898bb86b9faa4b213fbb36_icedid_njrat

.exe 790KB

2026-08-09_65e1bcdf06898bb86b9faa4b213fbb36_icedid_njrat

IMPHASH 69c8890c645bc52baf5347009201dcb7
SHA256 bbd24cfd9359787c91c447c3e4a2f19244fcb82eb6024bc6d21c7f769b8a6ca7
MD5 65e1bcdf06898bb86b9faa4b213fbb36
SHA1 be0c2d0e88f6e517f61d447965116288b1003f71
SHA512 800651726bade3edacb3574d787ce921c39d9c498e50a5ec8708ae6f3572e33cacfda241cb58c62b61630bee5377ab8c0642d3fe4e0908c8bc43541ec6caaa76
SSDEEP 12288:crCB1igsNHfcsc+ZOnZxwWMzy8dY7WMyVOY3XHrE9baannDdryBkoGsS0zMG3x:BslZOZj7W9XHmm3BtlAq
TLSH
T15F059E77677E48EFD8B3423C75129BB1F961F6CD0197A3DAA1A20255063FB10EE066B0
MD5 SHA1 SHA512 SSDEEP TLSH

Detects executables packed with VMProtect.
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

6

Entry point

83976

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP IMAGE_FILE_NET_RUN_FROM_SWAP

PDB paths

P:\Target\x64\ship\delivery\x-none\ose.pdb

advapi32

RegCloseKey RegCreateKeyExW RegEnumKeyExW RegOpenKeyExW SetThreadToken RegEnumValueW RegQueryValueExW RegSetValueExW RegNotifyChangeKeyValue SetServiceStatus StartServiceCtrlDispatcherW DuplicateToken GetUserNameA RegDeleteValueW RegisterServiceCtrlHandlerW CryptGetHashParam CryptCreateHash CryptHashData CryptDestroyHash AllocateAndInitializeSid CheckTokenMembership FreeSid LookupAccountNameW ConvertStringSecurityDescriptorToSecurityDescriptorW CryptAcquireContextW CryptReleaseContext SetFileSecurityW RegDeleteKeyW OpenThreadToken

kernel32

CloseHandle GetLastError SetEvent GetModuleFileNameW GetDriveTypeW GetLogicalDrives lstrcmpW lstrlenW InitializeCriticalSection EnterCriticalSection LeaveCriticalSection DeleteCriticalSection Sleep ExitProcess GetCommandLineW SetErrorMode ResetEvent ReleaseMutex WaitForMultipleObjectsEx CreateMutexW CreateEventW CreateProcessW GetSystemInfo GetTickCount MoveFileExW CreateFileA CreateFileW ReadFile SetFilePointer RaiseException FreeLibrary GetModuleHandleW GetProcAddress LoadLibraryExW DosDateTimeToFileTime MultiByteToWideChar WideCharToMultiByte ReleaseSemaphore WaitForSingleObject WaitForMultipleObjects CreateSemaphoreW CreateThread SetFilePointerEx VirtualAlloc VirtualFree GlobalAlloc GlobalFree GetSystemTimeAsFileTime ExpandEnvironmentStringsW CompareStringW SetEndOfFile SetFileTime WriteFile GetSystemTime SystemTimeToFileTime LocalFree FindClose GetTempPathA CreateDirectoryW GetFileAttributesW GetTempPathW FindFirstFileW GetFileSizeEx QueryPerformanceCounter DeleteFileW SystemTimeToTzSpecificLocalTime GetTimeZoneInformation GetStdHandle lstrlenA FindNextFileW RemoveDirectoryW SetFileAttributesW GetFileAttributesExW GetFileTime CopyFileW CreateHardLinkW FormatMessageA GetComputerNameW GetCurrentThread HeapAlloc HeapReAlloc HeapFree HeapSize GetProcessHeap GetCurrentProcessId GetCurrentThreadId InitializeSListHead RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent GetCurrentProcess TerminateProcess RtlUnwindEx RtlPcToFileHeader SetLastError EncodePointer InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree GetModuleFileNameA GetModuleHandleExW GetACP GetStringTypeW GetFileType FindFirstFileExA FindNextFileA IsValidCodePage GetOEMCP GetCPInfo GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW LCMapStringW SetStdHandle GetConsoleCP GetConsoleMode FlushFileBuffers WriteConsoleW LoadLibraryExA VirtualQuery VirtualProtect

rpcrt4

RpcServerUseProtseqEpW RpcServerRegisterIfEx RpcServerUnregisterIf NdrServerCall2 RpcImpersonateClient RpcRevertToSelf

wintrust

WinVerifyTrust

Name

.text

Size

157KB

Virtual Size

157KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

56KB

Virtual Size

56KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

8KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.vmp1

Size

560KB

Virtual Size

1.8MB

Characteristics

IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-09_65e1bcdf06898bb86b9faa4b213fbb36_icedid_njrat

advapi32

kernel32

rpcrt4

wintrust

generic