2026-08-13_75cc9e9d503fe6f2055c13e13c00de1e_icedid_njrat

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-13_75cc9e9d503fe6f2055c13e13c00de1e_icedid_njrat
Size 2.7MB
Sample260813-e7tgms1hra
SHA256 90d7edc6d0c63cfd7d998046a27410f180d6c2d0574f26562f745e9bdde1cb95
MD5 75cc9e9d503fe6f2055c13e13c00de1e
SHA1 cf92a574ca08be0a2e5daf018fbe77151da381be
SHA512 b6d69db09e0c6c7b5b668f03b5b01beba6b27ae758948af8c5ab4d9e4b53f658afbc9550159cb1a39933f687483e51a36203f9e9cdc632c95c899e7ce145a3eb
SSDEEP 24576:iVXNjE5nL3hXjM0Y9EVGh6WpROMD+J89ukVLxuISvx8RR90+:AXRE5hpVGh5Rj+bkVexGRu+
TLSH
T1A0D5F90BF7B621D4E1BAC138D553222AFD7134A6833897DB66C19E061B61BE4ED3E740
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects executables containing commands for clearing Windows Event Logs 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_ClearWinLogs

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-13_75cc9e9d503fe6f2055c13e13c00de1e_icedid_njrat

File Explorer

2026-08-13_75cc9e9d503fe6f2055c13e13c00de1e_icedid_njrat

.exe 2.7MB

2026-08-13_75cc9e9d503fe6f2055c13e13c00de1e_icedid_njrat

IMPHASH f8150461a34ed5769aeee6277137155d
SHA256 90d7edc6d0c63cfd7d998046a27410f180d6c2d0574f26562f745e9bdde1cb95
MD5 75cc9e9d503fe6f2055c13e13c00de1e
SHA1 cf92a574ca08be0a2e5daf018fbe77151da381be
SHA512 b6d69db09e0c6c7b5b668f03b5b01beba6b27ae758948af8c5ab4d9e4b53f658afbc9550159cb1a39933f687483e51a36203f9e9cdc632c95c899e7ce145a3eb
SSDEEP 24576:iVXNjE5nL3hXjM0Y9EVGh6WpROMD+J89ukVLxuISvx8RR90+:AXRE5hpVGh5Rj+bkVexGRu+
TLSH
T1A0D5F90BF7B621D4E1BAC138D553222AFD7134A6833897DB66C19E061B61BE4ED3E740
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects executables containing commands for clearing Windows Event Logs
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

19271

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\User\Desktop\SOURCES MY PROJECTS FOR GAMES\412421414\WintorezCPP\x64\Debug\WintorezLoader.pdb

winhttp

WinHttpCloseHandle WinHttpQueryHeaders WinHttpConnect WinHttpReadData WinHttpQueryDataAvailable WinHttpQueryOption WinHttpSetOption WinHttpOpenRequest WinHttpAddRequestHeaders WinHttpSendRequest WinHttpOpen WinHttpReceiveResponse

bcrypt

BCryptOpenAlgorithmProvider BCryptCloseAlgorithmProvider BCryptCreateHash BCryptHashData BCryptFinishHash BCryptDestroyHash

advapi32

RegSetValueExA SetSecurityDescriptorDacl InitializeSecurityDescriptor FreeSid CheckTokenMembership AllocateAndInitializeSid RegDeleteKeyA RegDeleteValueA RegEnumKeyExA RegEnumValueA RegOpenKeyExA RegQueryValueExA RegCloseKey

comctl32

ord17

comdlg32

GetOpenFileNameA

shell32

SHGetFolderPathA SHBrowseForFolderA SHGetPathFromIDListA ShellExecuteW ShellExecuteA

kernel32

EnumSystemLocalesW GetConsoleOutputCP GetConsoleMode GetFileSizeEx SetFilePointerEx ReadConsoleW GetTimeZoneInformation FindFirstFileExW IsValidCodePage GetACP GetOEMCP GetCommandLineA CompareStringW GetTimeFormatW GetDateFormatW FlsFree FlsSetValue FlsGetValue GetEnvironmentVariableA CreateDirectoryA CreateFileA DeleteFileA DeleteFileW FindClose FindFirstFileA FindFirstFileW FindNextFileA FindNextFileW FlushFileBuffers GetFileAttributesA GetFileSize GetVolumeInformationW ReadFile RemoveDirectoryA SetFileAttributesA SetFilePointer WriteFile GetVolumeInformationA IsDebuggerPresent CheckRemoteDebuggerPresent CloseHandle DuplicateHandle GetLastError QueryPerformanceCounter QueryPerformanceFrequency SetEvent WaitForSingleObject CreateEventA Sleep GetCurrentProcess GetCurrentProcessId ExitProcess TerminateProcess GetExitCodeProcess CreateThread GetCommandLineW OpenThread GetExitCodeThread ResumeThread CreateProcessA CreateProcessW OpenProcess GetTickCount VirtualAllocEx VirtualProtectEx ReadProcessMemory WriteProcessMemory MapViewOfFile VirtualFreeEx UnmapViewOfFile GetModuleFileNameA GetModuleFileNameW GetModuleHandleA GetModuleHandleExA GetProcAddress LoadLibraryA GlobalAlloc GlobalUnlock GlobalLock LocalFree CreateFileMappingA CopyFileA MoveFileA GetComputerNameA MultiByteToWideChar CreateToolhelp32Snapshot Process32FirstW Process32NextW Thread32First Thread32Next Module32FirstW Module32NextW FlsAlloc SetConsoleCtrlHandler WriteConsoleW OutputDebugStringW GetFileType GetProcessHeap HeapQueryInformation HeapReAlloc HeapFree GetFileAttributesExW GetCurrentThread GetStdHandle FreeLibraryAndExitThread LCMapStringW ExitThread GetModuleHandleExW GetSystemInfo HeapValidate HeapSize HeapAlloc LoadLibraryExW FreeLibrary TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount SetLastError InterlockedFlushSList InterlockedPushEntrySList RtlUnwindEx RaiseException RtlPcToFileHeader InitializeSListHead GetStartupInfoW IsProcessorFeaturePresent SetUnhandledExceptionFilter GetUserDefaultLCID GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle CreateFileW SetEndOfFile CreateRemoteThread RtlUnwind IsValidLocale GetLocaleInfoW UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext GetCPInfo CompareStringEx GetStringTypeW WaitForSingleObjectEx SwitchToThread GetCurrentThreadId GetNativeSystemInfo FormatMessageA WideCharToMultiByte EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive WakeConditionVariable WakeAllConditionVariable SleepConditionVariableSRW GetLocaleInfoEx EncodePointer DecodePointer LCMapStringEx SetFileInformationByHandle GetTempPathW InitOnceExecuteOnce CreateEventExW CreateSemaphoreExW FlushProcessWriteBuffers GetCurrentProcessorNumber GetSystemTimeAsFileTime GetTickCount64 FreeLibraryWhenCallbackReturns CreateThreadpoolTimer SetThreadpoolTimer WaitForThreadpoolTimerCallbacks CloseThreadpoolTimer CreateThreadpoolWait SetThreadpoolWait CloseThreadpoolWait GetModuleHandleW GetFileInformationByHandleEx CreateSymbolicLinkW

user32

UpdateWindow DrawTextA GetSystemMetrics EnableWindow KillTimer SetTimer EmptyClipboard SetClipboardData CloseClipboard OpenClipboard SetWindowTextA GetDlgItemTextA SetDlgItemTextA GetDlgItem IsWindowVisible SetWindowDisplayAffinity DestroyWindow CreateWindowExA RegisterClassA PostQuitMessage DefWindowProcA PostMessageW SendMessageW UnregisterHotKey RegisterHotKey DispatchMessageW TranslateMessage GetMessageW MessageBoxA InvalidateRect FillRect EnumWindows GetWindowThreadProcessId LoadCursorW GetDlgCtrlID ShowWindow

gdi32

SetBkMode CreateFontA CreateSolidBrush DeleteObject SelectObject SetBkColor SetTextColor

ole32

CoTaskMemFree

setupapi

SetupDiSetClassInstallParamsA SetupDiGetDeviceRegistryPropertyA SetupDiCallClassInstaller SetupDiGetClassDevsA SetupDiDestroyDeviceInfoList SetupDiEnumDeviceInfo

Name

.text

Size

2.2MB

Virtual Size

2.2MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

468KB

Virtual Size

467KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

11KB

Virtual Size

23KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

86KB

Virtual Size

85KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

13KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

1024B

Virtual Size

777B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.00cfg

Size

512B

Virtual Size

373B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

12KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-13_75cc9e9d503fe6f2055c13e13c00de1e_icedid_njrat

winhttp

bcrypt

advapi32

comctl32

comdlg32

shell32

kernel32

user32

gdi32

ole32

setupapi

generic