2026-08-15_496f967d5e0a873cb7f18bb1e96a43b5_icedid

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-15_496f967d5e0a873cb7f18bb1e96a43b5_icedid
Size 14.6MB
Sample260815-elnz2aen21
SHA256 04b0da242f78c0ed0b4180437a7976c226987b7893800db7f4a09640a7fc380f
MD5 496f967d5e0a873cb7f18bb1e96a43b5
SHA1 58641fb92458acf2625b5990cb56c3a5ca5ef6f8
SHA512 130ba76699567eb514d69a0c3f58c98f6ac77651778924eaa4f704a8c45ab10e80074165dabbe45fe3477af71db87ccb7a68a2029305b3fc4e3dc757954fddf5
SSDEEP 393216:MXqiiQpDtwIGRlyLiimdEKUXogIONSjWBU9K0x0z:biiQpDtDGbyLpmdEVaON3y9S
TLSH
T102F6238662BC40F8D162D139C8068A4BEBF2F8510B71C7EF11655B6E5F777A20D2A327
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

UPX dump on OEP (original entry point) 1 IoCs

resource	yara_rule
sample	UPX

File Explorer

2026-08-15_496f967d5e0a873cb7f18bb1e96a43b5_icedid

.exe 14.6MB

2026-08-15_496f967d5e0a873cb7f18bb1e96a43b5_icedid

IMPHASH 50da9c66b00fd68bbfb8d54a47418acd
SHA256 04b0da242f78c0ed0b4180437a7976c226987b7893800db7f4a09640a7fc380f
MD5 496f967d5e0a873cb7f18bb1e96a43b5
SHA1 58641fb92458acf2625b5990cb56c3a5ca5ef6f8
SHA512 130ba76699567eb514d69a0c3f58c98f6ac77651778924eaa4f704a8c45ab10e80074165dabbe45fe3477af71db87ccb7a68a2029305b3fc4e3dc757954fddf5
SSDEEP 393216:MXqiiQpDtwIGRlyLiimdEKUXogIONSjWBU9K0x0z:biiQpDtDGbyLpmdEVaON3y9S
TLSH
T102F6238662BC40F8D162D139C8068A4BEBF2F8510B71C7EF11655B6E5F777A20D2A327
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x64 arch:x64

UPX dump on OEP (original entry point)

Digest

6b:38:d8:c9:71:8c:72:a1:4b:56:03:a1:3a:3c:00:9d:24:c8:47:2d:8c:66:4e:d0:2d:fe:af:a2:69:f7:9f:0a

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=HYDROVISUAL SRL,O=HYDROVISUAL SRL,L=Odorheiu Secuiesc,ST=Harghita,C=RO

Chains

Jun 8, 2026

CN=HYDROVISUAL SRL,O=HYDROVISUAL SRL,L=Odorheiu Secuiesc,ST=Harghita,C=RO

CN=Certum Code Signing 2021 CA,O=Asseco Data Systems S.A.,C=PL

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

CN=HYDROVISUAL SRL,O=HYDROVISUAL SRL,L=Odorheiu Secuiesc,ST=Harghita,C=RO

CN=Certum Code Signing 2021 CA,O=Asseco Data Systems S.A.,C=PL

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Subject

CN=HYDROVISUAL SRL,O=HYDROVISUAL SRL,L=Odorheiu Secuiesc,ST=Harghita,C=RO

Serial Number

47:97:27:76:98:15:bb:d6:10:49:8a:40:9a:43:b3:85

Issuer

CN=Certum Code Signing 2021 CA,O=Asseco Data Systems S.A.,C=PL

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 16, 2026 - Mar 16, 2027

Subject

CN=Certum Code Signing 2021 CA,O=Asseco Data Systems S.A.,C=PL

Serial Number

99:a3:80:0a:26:55:3b:65:ab:dc:6e:84:a6:b3:ea:39

Issuer

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 19, 2021 - May 18, 2036

Subject

CN=Certum Timestamp 2026,O=Asseco Data Systems S.A.,C=PL

Serial Number

28:f0:77:c1:1c:36:bd:fe:5f:74:32:47:70:27:2e:03

Issuer

CN=Certum Timestamping 2021 CA,O=Asseco Data Systems S.A.,C=PL

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 11, 2026 - Feb 27, 2036

Subject

CN=Certum Timestamping 2021 CA,O=Asseco Data Systems S.A.,C=PL

Serial Number

e7:ff:69:c7:3b:35:ce:4b:91:26:d8:74:7c:68:a5:87

Issuer

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 19, 2021 - May 18, 2036

Subject

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Serial Number

1b:b5:8f:25:2a:df:23:00:49:28:c9:ae:3d:7e:ed:27

Issuer

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

May 31, 2021 - Sep 17, 2029

Minor OS version

Major OS version

Entry point

1300136

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

GetVolumeInformationW GetFullPathNameW GetLocaleInfoW GetUserDefaultUILanguage SetEndOfFile GetFileAttributesExW FileTimeToLocalFileTime GetFileSizeEx GetFileTime GetTempFileNameW GetWindowsDirectoryW GetNumberFormatW GetTickCount GetProfileIntW SearchPathW VirtualProtect FindResourceExW ExitProcess DecodePointer HeapFree HeapAlloc GetCommandLineA GetStartupInfoW RtlLookupFunctionEntry RtlUnwindEx RaiseException RtlPcToFileHeader EncodePointer HeapReAlloc ExitThread CreateThread HeapSize HeapQueryInformation GetSystemTimeAsFileTime VirtualAlloc SetThreadStackGuarantee GetSystemInfo VirtualQuery SetStdHandle GetFileType UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlCaptureContext TerminateProcess FlsGetValue FlsSetValue FlsFree FlsAlloc GetStdHandle HeapSetInformation GetVersion HeapCreate GetModuleFileNameA FindFirstFileW GetEnvironmentStringsW SetHandleCount QueryPerformanceCounter GetStringTypeW GetCPInfo GetACP GetOEMCP IsValidCodePage GetTimeZoneInformation LCMapStringW GetConsoleCP GetConsoleMode WriteConsoleW SetEnvironmentVariableA UnlockFile LockFile FlushFileBuffers WriteFile lstrcmpiW GlobalFlags FreeResource GlobalAddAtomW GlobalFindAtomW GlobalDeleteAtom GetVersionExW InitializeCriticalSectionAndSpinCount lstrcmpW FileTimeToSystemTime lstrcmpA GlobalGetAtomNameW WaitForSingleObject GetCurrentThreadId ResumeThread SetThreadPriority CopyFileW GlobalSize FormatMessageW MulDiv GetCurrentProcessId FindResourceW LoadResource LockResource SizeofResource ActivateActCtx ReleaseActCtx DeactivateActCtx GlobalFree DeleteCriticalSection LocalReAlloc TlsSetValue GlobalAlloc GlobalHandle GlobalUnlock GlobalReAlloc GlobalLock TlsAlloc InitializeCriticalSection EnterCriticalSection TlsGetValue LeaveCriticalSection LocalAlloc SetLastError FindClose DuplicateHandle FreeEnvironmentStringsW GetFileSize MoveFileExW CreateSymbolicLinkW GetCurrentProcess LocalFree GetLastError GetExitCodeProcess GetCurrentDirectoryW GetTempPathW DeleteFileW RemoveDirectoryW GetFileAttributesW GetDiskFreeSpaceW _lopen CreateFileW SetCurrentDirectoryW CreateDirectoryW SetFilePointer ReadFile _lcreat _lwrite _lclose WideCharToMultiByte GetModuleFileNameW CloseHandle GetModuleHandleW GetProcAddress GetSystemDirectoryW lstrlenW lstrcatW lstrcpyW LoadLibraryW lstrlenA lstrcpyA CompareStringW Sleep FreeLibrary MultiByteToWideChar

user32

SetRect SetCursorPos BringWindowToTop LockWindowUpdate GetMenuDefaultItem InvertRect HideCaret EnableScrollBar GetNextDlgTabItem GetIconInfo LoadImageW GetNextDlgGroupItem EndDialog CreateDialogIndirectParamW TranslateAcceleratorW InsertMenuItemW ReuseDDElParam UnpackDDElParam DefFrameProcW DefMDIChildProcW DrawMenuBar TranslateMDISysAccel MonitorFromPoint UnionRect UpdateLayeredWindow IsMenu CreateMenu PostThreadMessageW WaitMessage SetMenuDefaultItem IsClipboardFormatAvailable FrameRect GetUpdateRect OpenClipboard SetClipboardData CloseClipboard EmptyClipboard RegisterClipboardFormatW CopyIcon CharUpperBuffW GetDoubleClickTime IsCharLowerW GetKeyNameTextW MapVirtualKeyExW SubtractRect MapDialogRect DrawIcon DestroyCursor GetWindowRgn DestroyAcceleratorTable SetParent SetWindowRgn IsZoomed OffsetRect IsRectEmpty KillTimer SetTimer DeleteMenu ShowOwnedPopups IntersectRect InvalidateRect IsIconic SetLayeredWindowAttributes EnumDisplayMonitors SetRectEmpty CopyImage PostQuitMessage EndPaint BeginPaint GetWindowDC DrawTextExW DrawTextW TabbedTextOutW FillRect SystemParametersInfoW DestroyMenu GetMenuItemInfoW InflateRect CharUpperW DestroyIcon GetDesktopWindow RealChildWindowFromPoint ClientToScreen ShowWindow MoveWindow SetWindowTextW IsDialogMessageW CheckDlgButton RegisterWindowMessageW LoadIconW SendDlgItemMessageW SendDlgItemMessageA CreateAcceleratorTableW IsChild GetCapture GetClassNameW GetClassLongPtrW SetPropW GetPropW RemovePropW IsWindow SetFocus GetForegroundWindow SetActiveWindow BeginDeferWindowPos EndDeferWindowPos GetDlgItem GetTopWindow DestroyWindow GetWindowLongPtrW SetWindowLongPtrW GetMessageTime GetMessagePos MonitorFromWindow GetMonitorInfoW MapWindowPoints ScrollWindow TrackPopupMenu SetMenu SetScrollRange GetScrollRange SetScrollPos GetScrollPos SetForegroundWindow ShowScrollBar RedrawWindow UpdateWindow GetClientRect PostMessageW CreateWindowExW GetClassInfoExW GetClassInfoW RegisterClassW AdjustWindowRectEx GetWindowRect ScreenToClient EqualRect DeferWindowPos GetScrollInfo SetScrollInfo SetWindowPlacement GetWindowPlacement GetDlgCtrlID DefWindowProcW CallWindowProcW GetMenu SetWindowLongW SetWindowPos CopyRect PtInRect GetWindow SetMenuItemBitmaps GetMenuCheckMarkDimensions LoadBitmapW GetFocus ModifyMenuW EnableMenuItem CheckMenuItem GetWindowTextLengthW GetWindowTextW GetSystemMetrics GetDC ReleaseDC GetSysColor GetSysColorBrush SetWindowsHookExW CallNextHookEx GetMessageW GetActiveWindow IsWindowVisible GetKeyState GetCursorPos ValidateRect GetMenuState GetMenuStringW AppendMenuW GetMenuItemID InsertMenuW GetMenuItemCount GetSubMenu RemoveMenu MessageBoxW SetCursor LoadCursorW wsprintfW MsgWaitForMultipleObjects GetWindowThreadProcessId SendMessageW GetWindowLongW GetParent GetLastActivePopup IsWindowEnabled EnableWindow UnhookWindowsHookEx PeekMessageW DispatchMessageW TranslateMessage LoadAcceleratorsW GetKeyboardState GetKeyboardLayout MapVirtualKeyW ToUnicodeEx CopyAcceleratorTableW DrawFocusRect DrawFrameControl DrawEdge DrawIconEx DrawStateW MessageBeep ReleaseCapture SetCapture GetSystemMenu LoadMenuW SetClassLongPtrW GetAsyncKeyState NotifyWinEvent WindowFromPoint WinHelpW CreatePopupMenu GrayStringW

advapi32

RegCreateKeyExW RegOpenKeyExW RegCloseKey RegDeleteValueW RegSetValueExW RegEnumKeyExW RegQueryValueExW RegDeleteKeyW OpenProcessToken GetTokenInformation

shell32

ShellExecuteW ShellExecuteExW SHGetFileInfoW SHBrowseForFolderW SHAppBarMessage DragQueryFileW DragFinish SHGetFolderPathW SHGetSpecialFolderLocation SHGetPathFromIDListW SHGetDesktopFolder

msimg32

TransparentBlt AlphaBlend

comctl32

ImageList_GetIconSize

shlwapi

PathStripToRootW PathIsUNCW PathFindExtensionW PathFindFileNameW PathRemoveFileSpecW

oleacc

CreateStdAccessibleObject AccessibleObjectFromWindow LresultFromObject

gdiplus

GdipGetImageGraphicsContext GdipBitmapUnlockBits GdipFree GdipAlloc GdipDeleteGraphics GdipDisposeImage GdipCreateBitmapFromHBITMAP GdiplusStartup GdiplusShutdown GdipCreateFromHDC GdipSetInterpolationMode GdipDrawImageRectI GdipCloneImage GdipGetImageWidth GdipGetImageHeight GdipGetImagePixelFormat GdipGetImagePaletteSize GdipGetImagePalette GdipCreateBitmapFromStream GdipCreateBitmapFromScan0 GdipBitmapLockBits GdipDrawImageI

imm32

ImmReleaseContext ImmGetContext ImmGetOpenStatus

winmm

PlaySoundW

gdi32

CreateCompatibleBitmap CreateRectRgnIndirect GetTextMetricsW EnumFontFamiliesW GetTextCharsetInfo SetRectRgn CopyMetaFileW CreateDCW CreateBitmap SetTextColor SetBkColor GetObjectW DeleteObject CreateFontIndirectW CreateCompatibleDC DeleteDC ExtSelectClipRgn BitBlt ExtTextOutW GetTextExtentPoint32W SaveDC RestoreDC SetBkMode CreateDIBitmap CreateHatchBrush CreateSolidBrush CreatePen GetObjectType SelectPalette SetPolyFillMode SetROP2 SetMapMode GetClipBox ExcludeClipRect IntersectClipRect LineTo MoveToEx SetTextAlign GetLayout SelectClipRgn GetStockObject GetViewportExtEx GetWindowExtEx GetPixel PtVisible RectVisible TextOutW Escape CombineRgn PatBlt DPtoLP ScaleWindowExtEx SetWindowExtEx OffsetWindowOrgEx SetWindowOrgEx CreateDIBSection CreateRoundRectRgn CreatePolygonRgn GetBkColor GetTextColor CreateEllipticRgn Polyline Ellipse Polygon CreatePalette GetPaletteEntries GetNearestPaletteIndex RealizePalette GetSystemPaletteEntries OffsetRgn GetRgnBox SetDIBColorTable StretchBlt SetPixel Rectangle EnumFontFamiliesExW LPtoDP GetWindowOrgEx GetViewportOrgEx PtInRegion FillRgn FrameRgn GetBoundsRect ExtFloodFill SetPaletteEntries GetTextFaceW SetPixelV CreateRectRgn CreatePatternBrush ScaleViewportExtEx SetViewportExtEx OffsetViewportOrgEx SetViewportOrgEx SetLayout GetDeviceCaps SelectObject

winspool.drv

ClosePrinter DocumentPropertiesW OpenPrinterW

comdlg32

GetFileTitleW

ole32

OleGetClipboard RegisterDragDrop CoLockObjectExternal DoDragDrop CreateStreamOnHGlobal OleLockRunning IsAccelerator OleTranslateAccelerator OleDestroyMenuDescriptor OleCreateMenuDescriptor CoInitializeEx CoUninitialize CoInitialize CoTaskMemFree CoCreateInstance OleDuplicateData CoTaskMemAlloc ReleaseStgMedium RevokeDragDrop

oleaut32

VariantClear VariantChangeType VariantTimeToSystemTime SystemTimeToVariantTime SysStringLen SysAllocStringLen VarBstrFromDate VariantInit SysAllocString SysFreeString

Name

.text

Size

1.4MB

Virtual Size

1.4MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

511KB

Virtual Size

510KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

31KB

Virtual Size

79KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

71KB

Virtual Size

71KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

text

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE

Name

data

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

50KB

Virtual Size

50KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

75KB

Virtual Size

74KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-15_496f967d5e0a873cb7f18bb1e96a43b5_icedid

kernel32

user32

advapi32

shell32

msimg32

comctl32

shlwapi

oleacc

gdiplus

imm32

winmm

gdi32

winspool.drv

comdlg32

ole32

oleaut32

generic