2026-08-15_571d585467abc9534ec560812aa66407_icedid_njrat_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-15_571d585467abc9534ec560812aa66407_icedid_njrat_stealc
Size 17.9MB
Sample260815-jhd3wasake
SHA256 dc06cc5a7b1ffcd9384f10ab11a4bf9ac05bda3eae39529a7cacfadb88a81805
MD5 571d585467abc9534ec560812aa66407
SHA1 db2ff049eb60a15c4702bb9a8c493b5752329a52
SHA512 0623976407eb36ace8b4bb74d373ca6eb3753fac9e6c4a61e1ec14d498ee3a28a2d19afa9694e12b4927100fc0f71c5c1d733bc8a48f933cfed777ae34b38f5c
SSDEEP 393216:wN/ta6dNoJDtyzwl/K94yiU5J47eVARkiDqd3FRr:kaOWEMKQU5J47eU/u3
TLSH
T12F1723D262E802ECC0435138C54E438BEAA1747647B78BDB36D94D067F22DD5CABA736
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects executables containing URLs to raw contents of a Github gist 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-15_571d585467abc9534ec560812aa66407_icedid_njrat_stealc

File Explorer

2026-08-15_571d585467abc9534ec560812aa66407_icedid_njrat_stealc

.exe 17.9MB

2026-08-15_571d585467abc9534ec560812aa66407_icedid_njrat_stealc

IMPHASH 5490681b768dc619da5825f13472c80e
SHA256 dc06cc5a7b1ffcd9384f10ab11a4bf9ac05bda3eae39529a7cacfadb88a81805
MD5 571d585467abc9534ec560812aa66407
SHA1 db2ff049eb60a15c4702bb9a8c493b5752329a52
SHA512 0623976407eb36ace8b4bb74d373ca6eb3753fac9e6c4a61e1ec14d498ee3a28a2d19afa9694e12b4927100fc0f71c5c1d733bc8a48f933cfed777ae34b38f5c
SSDEEP 393216:wN/ta6dNoJDtyzwl/K94yiU5J47eVARkiDqd3FRr:kaOWEMKQU5J47eU/u3
TLSH
T12F1723D262E802ECC0435138C54E438BEAA1747647B78BDB36D94D067F22DD5CABA736
MD5 SHA1 SHA512 SSDEEP TLSH

Detects executables containing URLs to raw contents of a Github gist
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

18747392

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

d3d11

D3D11CreateDeviceAndSwapChain

d3dcompiler_43

D3DCompile

ntdll

RtlPcToFileHeader RtlUnwindEx RtlUnwind RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind

winhttp

WinHttpOpen WinHttpQueryDataAvailable WinHttpConnect WinHttpSetTimeouts WinHttpSendRequest WinHttpCloseHandle WinHttpQueryHeaders WinHttpSetOption WinHttpOpenRequest WinHttpReceiveResponse WinHttpReadData

wininet

InternetOpenUrlA InternetOpenA InternetCloseHandle InternetReadFile

kernel32

GlobalFree GlobalLock WideCharToMultiByte GlobalUnlock GetModuleHandleA GetLocaleInfoA LoadLibraryA QueryPerformanceFrequency GetProcAddress FreeLibrary QueryPerformanceCounter GetVolumeInformationA GlobalMemoryStatusEx GetComputerNameA ReadFile GetModuleFileNameA GetFileAttributesExA WriteFile GetTempPathA CreateFileA DeleteFileA CloseHandle GetCurrentProcessId CreateProcessA GetTickCount FlushFileBuffers CreateNamedPipeA WaitForSingleObject DisconnectNamedPipe Sleep GetLastError CancelIoEx ResetEvent GetOverlappedResult CreateEventA ConnectNamedPipe WriteProcessMemory GetFullPathNameA lstrlenA OpenProcess CreateToolhelp32Snapshot Process32NextW Process32FirstW Module32FirstW VirtualAllocEx GetModuleHandleW CreateRemoteThread Module32NextW ExitProcess CreateDirectoryA FindFirstFileA FindNextFileA FindClose CopyFileA GetFileSizeEx HeapAlloc HeapReAlloc HeapFree GetProcessHeap MapViewOfFile UnmapViewOfFile GlobalAlloc GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW VirtualProtect FlsFree FlsSetValue FlsGetValue FlsAlloc ReadConsoleW GetConsoleMode SetFilePointerEx FreeLibraryAndExitThread ExitThread CreateThread WriteConsoleW GetModuleHandleExW GetModuleFileNameW GetFileType GetStdHandle LoadLibraryExW TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount SetLastError RaiseException InitializeSListHead GetStartupInfoW IsDebuggerPresent IsProcessorFeaturePresent TerminateProcess GetCurrentProcess SetUnhandledExceptionFilter UnhandledExceptionFilter GetCPInfo MultiByteToWideChar IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetConsoleOutputCP OutputDebugStringW GetTimeZoneInformation FindFirstFileExW FindNextFileW IsValidCodePage GetACP SetEndOfFile GetOEMCP GetCommandLineA GetCommandLineW GetStringTypeW GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle CreateFileW GetSystemTimeAsFileTime HeapSize CreateFileMappingA SleepConditionVariableSRW WakeAllConditionVariable TryAcquireSRWLockExclusive AcquireSRWLockExclusive GetCurrentThreadId EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer LCMapStringEx ReleaseSRWLockExclusive

user32

ReleaseCapture IsWindowUnicode GetClientRect SetCursor SetCapture LoadCursorW GetForegroundWindow GetKeyboardLayout SetCursorPos ClientToScreen GetCapture ScreenToClient GetMessageExtraInfo ReleaseDC SetClipboardData GetClipboardData EmptyClipboard CloseClipboard OpenClipboard TrackMouseEvent GetDC GetKeyState DefWindowProcW GetWindowRect DestroyWindow CreateWindowExW UnregisterClassW RegisterClassExW ShowWindow DispatchMessageW PeekMessageW MoveWindow TranslateMessage LoadIconW PostQuitMessage UpdateWindow EnumDisplayDevicesA GetSystemMetrics GetCursorPos

gdi32

DeleteDC CreateCompatibleDC DeleteObject SelectObject BitBlt CreateCompatibleBitmap

advapi32

RegCloseKey RegOpenKeyExA GetUserNameA RegQueryValueExA InitializeSecurityDescriptor SetSecurityDescriptorDacl

shell32

SHGetFolderPathA

ole32

CoInitializeEx CLSIDFromString CreateStreamOnHGlobal CoUninitialize

imm32

ImmSetCompositionWindow ImmGetContext ImmSetCandidateWindow ImmReleaseContext

gdiplus

GdipCloneImage GdiplusShutdown GdiplusStartup GdipAlloc GdipSaveImageToStream GdipFree GdipDisposeImage GdipCreateBitmapFromHBITMAP

iphlpapi

GetAdaptersInfo

Name

.text

Size

1.0MB

Virtual Size

1.0MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

16.8MB

Virtual Size

16.8MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

6KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

49KB

Virtual Size

48KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.gate

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-15_571d585467abc9534ec560812aa66407_icedid_njrat_stealc

d3d11

d3dcompiler_43

ntdll

winhttp

wininet

kernel32

user32

gdi32

advapi32

shell32

ole32

imm32

gdiplus

iphlpapi

generic