2026-08-18_65d645ae0fb2016e4a127cbc64f06181_icedid_njrat

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-18_65d645ae0fb2016e4a127cbc64f06181_icedid_njrat
Size 2.7MB
Sample260818-wccn3seq8w
SHA256 c83602f2d55a01715cfe78cdc1777254181872f47641055303a3e7b778ffc71c
MD5 65d645ae0fb2016e4a127cbc64f06181
SHA1 7735d917a9976d7f1c9af6fd632f30eb1a66ffce
SHA512 620822789e92afb36960580896675ec35a8513c414b6e785abca61e1268b03c0e2832bfdedc0cc41c31b7b8a4f466059101e01ad8b80b2dfb68c606fb862493f
SSDEEP 49152:03WzXv55dPXkiR3IOI/89T59Zx/f4nq7BHY8KREGZbFLNiXicJFFRGNzj3:t9Cna+R37wRGpj3
TLSH
T182D59E5BABA841F4C17AC17CC983894AF6B178154F719BDF01A1426E1F336E18E3E762
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-18_65d645ae0fb2016e4a127cbc64f06181_icedid_njrat

File Explorer

2026-08-18_65d645ae0fb2016e4a127cbc64f06181_icedid_njrat

.exe 2.7MB

2026-08-18_65d645ae0fb2016e4a127cbc64f06181_icedid_njrat

IMPHASH ff5cd5f1a8bf02f01560436a9ddc7ae0
SHA256 c83602f2d55a01715cfe78cdc1777254181872f47641055303a3e7b778ffc71c
MD5 65d645ae0fb2016e4a127cbc64f06181
SHA1 7735d917a9976d7f1c9af6fd632f30eb1a66ffce
SHA512 620822789e92afb36960580896675ec35a8513c414b6e785abca61e1268b03c0e2832bfdedc0cc41c31b7b8a4f466059101e01ad8b80b2dfb68c606fb862493f
SSDEEP 49152:03WzXv55dPXkiR3IOI/89T59Zx/f4nq7BHY8KREGZbFLNiXicJFFRGNzj3:t9Cna+R37wRGpj3
TLSH
T182D59E5BABA841F4C17AC17CC983894AF6B178154F719BDF01A1426E1F336E18E3E762
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1017728

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\qba1\workspace\11566\SSE_Storage_Middleware\RstMwService\output\Release\x64\RstMwService.pdb

api-ms-win-core-synch-l1-1-0

CreateMutexA ReleaseMutex InitializeCriticalSection LeaveCriticalSection TryEnterCriticalSection CreateEventW WaitForSingleObjectEx CreateEventA ResetEvent SetWaitableTimer InitializeCriticalSectionAndSpinCount SetEvent CreateMutexW ReleaseSemaphore DeleteCriticalSection WaitForSingleObject OpenEventA EnterCriticalSection

api-ms-win-core-processthreads-l1-1-0

ExitThread GetCurrentThread TlsAlloc TlsSetValue TlsFree GetThreadPriority SetThreadPriority GetCurrentThreadId SwitchToThread CreateThread GetStartupInfoW ExitProcess GetExitCodeThread TerminateProcess GetCurrentProcess TlsGetValue GetCurrentProcessId

api-ms-win-core-errorhandling-l1-1-0

SetLastError SetUnhandledExceptionFilter UnhandledExceptionFilter RaiseException GetLastError

api-ms-win-core-handle-l1-1-0

CloseHandle DuplicateHandle

api-ms-win-service-core-l1-1-0

StartServiceCtrlDispatcherW SetServiceStatus

api-ms-win-eventing-classicprovider-l1-1-0

GetTraceEnableFlags TraceMessage GetTraceEnableLevel UnregisterTraceGuids RegisterTraceGuidsW GetTraceLoggerHandle

api-ms-win-service-winsvc-l1-1-0

RegisterServiceCtrlHandlerW

setupapi

CM_Get_Device_ID_List_SizeW SetupDiEnumDeviceInfo SetupDiDestroyDeviceInfoList SetupDiGetClassDevsA SetupDiGetDeviceRegistryPropertyA SetupDiEnumDeviceInterfaces SetupDiGetDeviceInterfaceDetailA SetupDiRemoveDevice CM_Get_DevNode_Status CM_Get_Device_ID_ListW CM_Reenumerate_DevNode CM_Locate_DevNodeA CM_Locate_DevNodeW

advapi32

DeregisterEventSource RegisterEventSourceW ReportEventW RegDeleteTreeW RegSetValueExW CloseServiceHandle OpenSCManagerW ControlService EnumDependentServicesW StartServiceW ChangeServiceConfigW OpenServiceW QueryServiceStatusEx InitiateSystemShutdownA RegSetKeyValueW RegCreateKeyExW LookupPrivilegeValueA AdjustTokenPrivileges OpenProcessToken RegDeleteValueA RegCreateKeyExA RegSetValueExA RegQueryValueExA RegOpenKeyExA RegQueryValueExW RegOpenKeyExW RegCloseKey IsValidSid InitializeSid AllocateAndInitializeSid FreeSid InitializeSecurityDescriptor SetSecurityDescriptorDacl SetEntriesInAclW OpenThreadToken CopySid EqualSid GetLengthSid GetSidLengthRequired GetSidSubAuthority GetSidSubAuthorityCount GetTokenInformation

ole32

CoGetInterfaceAndReleaseStream CoCreateGuid StringFromGUID2 CoMarshalInterThreadInterfaceInStream CoTaskMemFree CoReleaseMarshalData CoUninitialize CoInitializeEx CoCreateInstance

oleaut32

SysAllocString SysFreeString VariantInit VariantClear

userenv

UnloadUserProfile

api-ms-win-security-base-l1-2-2

DeriveCapabilitySidsFromName

api-ms-win-core-heap-l2-1-0

LocalFree LocalAlloc

rpcrt4

RpcServerListen RpcServerInqBindings NdrClientCall3 RpcServerRegisterIf3 RpcServerUnregisterIf RpcImpersonateClient RpcRevertToSelfEx I_RpcGetCurrentCallHandle NdrServerCall2 RpcRaiseException I_RpcGetBuffer NdrComplexStructMarshall NdrCorrelationInitialize NdrCorrelationPass NdrCorrelationFree NdrComplexStructBufferSize RpcStringFreeA UuidToStringA NdrComplexStructFree NdrConvert NdrServerInitializeNew RpcServerUseProtseqEpW RpcBindingVectorFree RpcRevertToSelf I_RpcBindingInqLocalClientPID RpcStringFreeW RpcStringBindingComposeW RpcEpUnregister RpcBindingFromStringBindingW RpcEpRegisterW RpcMgmtStopServerListening

api-ms-win-core-util-l1-1-0

EncodePointer DecodePointer

api-ms-win-core-heap-l1-1-0

HeapDestroy HeapFree HeapSize GetProcessHeap HeapReAlloc HeapAlloc

api-ms-win-core-timezone-l1-1-0

GetTimeZoneInformation SystemTimeToFileTime FileTimeToSystemTime

api-ms-win-core-sysinfo-l1-1-0

GetSystemInfo GetTickCount GetSystemTimeAsFileTime GetSystemTime GetVersionExW GetLogicalProcessorInformation

api-ms-win-core-libraryloader-l1-2-0

FreeLibrary GetModuleFileNameW FreeLibraryAndExitThread GetModuleHandleW GetModuleHandleExW GetModuleHandleA GetProcAddress LoadLibraryExW

api-ms-win-core-localization-l1-2-0

IsValidCodePage GetOEMCP EnumSystemLocalesW GetUserDefaultLCID GetLocaleInfoW GetCPInfo GetACP LCMapStringW FormatMessageW IsValidLocale

api-ms-win-core-datetime-l1-1-1

GetTimeFormatEx GetDateFormatEx

api-ms-win-core-synch-l1-2-0

Sleep SignalObjectAndWait

api-ms-win-core-string-obsolete-l1-1-0

lstrlenA

api-ms-win-core-processthreads-l1-1-1

OpenProcess GetThreadTimes IsProcessorFeaturePresent

api-ms-win-appmodel-runtime-l1-1-0

GetPackageId GetPackagePath

api-ms-win-core-path-l1-1-0

PathCchAppend

api-ms-win-core-psapi-l1-1-0

K32GetModuleFileNameExW K32GetModuleBaseNameW

wintrust

WinVerifyTrust

api-ms-win-core-file-l1-1-0

FindClose SetFilePointerEx DeleteFileW FindNextFileW CreateFileW GetFinalPathNameByHandleW FlushFileBuffers GetFileType FindFirstFileExW CreateFileA ReadFile GetDiskFreeSpaceExA WriteFile

api-ms-win-core-io-l1-1-0

DeviceIoControl

api-ms-win-ntuser-sysparams-l1-1-0

GetSystemMetrics

api-ms-win-core-sysinfo-l1-2-0

VerSetConditionMask

api-ms-win-core-kernel32-legacy-l1-1-2

VerifyVersionInfoA

api-ms-win-devices-config-l1-1-1

CM_Get_DevNode_PropertyW

api-ms-win-core-synch-ansi-l1-1-0

OpenMutexA CreateSemaphoreA CreateWaitableTimerA

api-ms-win-core-synch-l1-2-1

WaitForMultipleObjects

api-ms-win-core-file-l2-1-1

OpenFileById

api-ms-win-core-processenvironment-l1-1-0

FreeEnvironmentStringsW SetEnvironmentVariableW GetEnvironmentStringsW SetStdHandle GetStdHandle GetCommandLineA GetCommandLineW SetEnvironmentVariableA

api-ms-win-core-file-ansi-l1-1-0

QueryDosDeviceA

api-ms-win-core-string-l1-1-0

GetStringTypeW MultiByteToWideChar WideCharToMultiByte CompareStringW

api-ms-win-core-rtlsupport-l1-1-0

RtlUnwindEx RtlLookupFunctionEntry RtlVirtualUnwind RtlCaptureContext RtlPcToFileHeader

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-interlocked-l1-1-0

InterlockedPushEntrySList QueryDepthSList InterlockedPopEntrySList InitializeSListHead InterlockedFlushSList

api-ms-win-core-debug-l1-1-0

IsDebuggerPresent

api-ms-win-core-threadpool-legacy-l1-1-0

UnregisterWaitEx DeleteTimerQueueTimer CreateTimerQueue ChangeTimerQueueTimer CreateTimerQueueTimer

api-ms-win-core-systemtopology-l1-1-0

GetNumaHighestNodeNumber

api-ms-win-core-processtopology-obsolete-l1-1-0

GetProcessAffinityMask SetThreadAffinityMask

api-ms-win-core-kernel32-legacy-l1-1-0

UnregisterWait RegisterWaitForSingleObject

api-ms-win-core-memory-l1-1-0

VirtualAlloc VirtualFree VirtualProtect VirtualQuery

api-ms-win-core-libraryloader-l1-2-1

LoadLibraryW

api-ms-win-core-console-l1-1-0

WriteConsoleW ReadConsoleW GetConsoleCP GetConsoleMode

??0CConsolidatedError@@QEAA@AEBV0@@Z ??0CConsolidatedError@@QEAA@W4ISDI2_ERRORS@CConsolidatedErrorGenerated@@@Z ??0CConsolidatedError@@QEAA@XZ ??0GlobalLogger@@AEAA@XZ ??0ISIAccelerateAction@@QEAA@XZ ??0scoped_c_thread_locale@details@utility@@QEAA@XZ ??0value@json@web@@QEAA@$$QEAV012@@Z ??0value@json@web@@QEAA@AEBV012@@Z ??0value@json@web@@QEAA@H@Z ??0value@json@web@@QEAA@I@Z ??0value@json@web@@QEAA@N@Z ??0value@json@web@@QEAA@PEB_W@Z ??0value@json@web@@QEAA@PEB_W_N@Z ??0value@json@web@@QEAA@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z ??0value@json@web@@QEAA@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@_N@Z ??0value@json@web@@QEAA@XZ ??0value@json@web@@QEAA@_J@Z ??0value@json@web@@QEAA@_K@Z ??0value@json@web@@QEAA@_N@Z ??1CConsolidatedError@@QEAA@XZ ??1GlobalLogger@@QEAA@XZ ??1ISIAccelerateAction@@QEAA@XZ ??1scoped_c_thread_locale@details@utility@@QEAA@XZ ??4CConsolidatedError@@QEAAAEAV0@AEBV0@@Z ??4CConsolidatedErrorGenerated@@QEAAAEAV0@$$QEAV0@@Z ??4CConsolidatedErrorGenerated@@QEAAAEAV0@AEBV0@@Z ??4GlobalLogger@@AEAAAEAV0@$$QEAV0@@Z ??4value@json@web@@QEAAAEAV012@$$QEAV012@@Z ??4value@json@web@@QEAAAEAV012@AEBV012@@Z ??5json@web@@YAAEAV?$basic_istream@_WU?$char_traits@_W@std@@@std@@AEAV23@AEAVvalue@01@@Z ??6json@web@@YAAEAV?$basic_ostream@_WU?$char_traits@_W@std@@@std@@AEAV23@AEBVvalue@01@@Z ??8value@json@web@@QEBA_NAEBV012@@Z ??Avalue@json@web@@AEAAAEAV012@AEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z ??Avalue@json@web@@QEAAAEAV012@AEBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z ??Avalue@json@web@@QEAAAEAV012@_K@Z ??BCConsolidatedError@@QEBA?AU_ISI_Error@@XZ ?AddDebugInformation@CConsolidatedError@@QEAAXPEBDZZ ?AddDebugInformation@CConsolidatedError@@QEAAXPEB_WZZ ?AddErrorMessage@CConsolidatedError@@QEAAXPEBDZZ ?AddErrorMessage@CConsolidatedError@@QEAAXPEB_WZZ ?CleanupIsiError@@YAXI@Z ?CleanupIsiError@@YAXPEAU_ISI_Error@@@Z ?ClearError@CConsolidatedError@@QEAAXXZ ?FreeStringResources@CConsolidatedError@@AEAAXXZ ?GetDebugInformation@CConsolidatedError@@QEBAKPEADH@Z ?GetDebugInformation@CConsolidatedError@@QEBAKPEA_WH@Z ?GetDebugInformation@CConsolidatedError@@QEBAPEBDXZ ?GetErrorCodeString@CConsolidatedError@@QEBAKPEADH@Z ?GetErrorCodeString@CConsolidatedError@@QEBAKPEA_WH@Z ?GetErrorCodeString@CConsolidatedError@@QEBAPEBDXZ ?GetErrorMessage@CConsolidatedError@@QEBAKPEADH@Z ?GetErrorMessage@CConsolidatedError@@QEBAKPEA_WH@Z ?GetErrorMessage@CConsolidatedError@@QEBAPEBDXZ ?GetSrtEolError@CConsolidatedError@@SA?AV1@XZ ?InternalAddDebugInformation@CConsolidatedError@@AEAAXPEBDPEAD@Z ?InternalAddErrorMessage@CConsolidatedError@@AEAAXPEBDPEAD@Z ?IsBusy@CConsolidatedError@@QEBA_NXZ ?IsError@CConsolidatedError@@QEBA_NXZ ?IsPending@CConsolidatedError@@QEBA_NXZ ?IsSuccessful@CConsolidatedError@@QEBA_NXZ ?MAX_ERROR_STRING_SIZE@CConsolidatedError@@2HB ?MapIsiStatus@CConsolidatedError@@AEBA?AW4ISDI2_ERRORS@CConsolidatedErrorGenerated@@W4_ISI_Status@@@Z ?NO_ID@GlobalLogger@@2_KB ?SMALL_STRING_SIZE@CConsolidatedError@@2HB ?SetError@CConsolidatedError@@QEAAXV1@@Z ?SetError@CConsolidatedError@@QEAAXW4ISDI2_ERRORS@CConsolidatedErrorGenerated@@PEBD1@Z ?SetError@CConsolidatedError@@QEAAXW4ISDI2_ERRORS@CConsolidatedErrorGenerated@@PEBD@Z ?SetError@CConsolidatedError@@QEAAXW4ISDI2_ERRORS@CConsolidatedErrorGenerated@@PEB_W1@Z ?SetError@CConsolidatedError@@QEAAXW4ISDI2_ERRORS@CConsolidatedErrorGenerated@@PEB_W@Z ?SetError@CConsolidatedError@@QEAAXW4ISDI2_ERROR_TYPE@1@KPEBD@Z ?SetError@CConsolidatedError@@QEAAXW4ISDI2_ERROR_TYPE@1@KPEB_W@Z ?SetError@CConsolidatedError@@QEAAXW4_ISI_Status@@PEBD1@Z ?SetError@CConsolidatedError@@QEAAXW4_ISI_Status@@PEB_W1@Z ?SetErrorCodeString@CConsolidatedError@@AEAAXXZ ?SetLoggingOff@GlobalLogger@@SAXXZ ?SetLoggingOn@GlobalLogger@@SAXXZ ?__autoclassinit2@CConsolidatedError@@QEAAX_K@Z ?__autoclassinit2@GlobalLogger@@QEAAX_K@Z ?_disableLogging@GlobalLogger@@0_NA ?array@value@json@web@@SA?AV123@V?$vector@Vvalue@json@web@@V?$allocator@Vvalue@json@web@@@std@@@std@@@Z ?array@value@json@web@@SA?AV123@XZ ?array@value@json@web@@SA?AV123@_K@Z ?as_array@value@json@web@@QEAAAEAVarray@23@XZ ?as_array@value@json@web@@QEBAAEBVarray@23@XZ ?as_bool@value@json@web@@QEBA_NXZ ?as_double@value@json@web@@QEBANXZ ?as_integer@value@json@web@@QEBAHXZ ?as_number@value@json@web@@QEBAAEBVnumber@23@XZ ?as_object@value@json@web@@QEAAAEAVobject@23@XZ ?as_object@value@json@web@@QEBAAEBVobject@23@XZ ?as_string@value@json@web@@QEBAAEBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@XZ ?at@value@json@web@@QEAAAEAV123@AEBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z ?at@value@json@web@@QEAAAEAV123@_K@Z ?at@value@json@web@@QEBAAEBV123@AEBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z ?at@value@json@web@@QEBAAEBV123@_K@Z ?boolean@value@json@web@@SA?AV123@_N@Z ?c_locale@scoped_c_thread_locale@details@utility@@SAPEAU__crt_locale_pointers@@XZ ?checkIfDiskPairValid@ISIAccelerateAction@@UEAA?AU_ISI_Error@@IIAEAW4_ISI_NgsaDiskPairStatus@@@Z ?checkIfDiskValid@ISIAccelerateAction@@UEAA?AU_ISI_Error@@IW4_ISI_NgsaDiskConcatenationMember@@AEAW4_ISI_NgsaDiskValidForConcatenationStatus@@@Z ?clean@GlobalLogger@@QEAAX_K@Z ?configDiskAcceleration@ISIAccelerateAction@@UEAA?AU_ISI_Error@@IW4_ISI_NvcMode@@@Z ?configVolumeAcceleration@ISIAccelerateAction@@UEAA?AU_ISI_Error@@IW4_ISI_NvcMode@@@Z ?default_error_condition@windows_category_impl@details@utility@@UEBA?AVerror_condition@std@@H@Z ?doClearBlockCache@ISIAccelerateAction@@UEAA?AU_ISI_Error@@XZ ?doCreateCacheVolumeTask@ISIAccelerateAction@@UEAA?AU_ISI_Error@@I@Z ?doDisassociate@ISIAccelerateAction@@UEAA?AU_ISI_Error@@AEBU_ISI_VolumeInfo@@@Z ?doNgsaAutomation@ISIAccelerateAction@@UEAA?AU_ISI_Error@@AEAI@Z ?doNgsaDisableOneStep@ISIAccelerateAction@@UEAA?AU_ISI_Error@@XZ ?doNgsaEnableOneStep@ISIAccelerateAction@@UEAA?AU_ISI_Error@@XZ ?doNgsaStartTools@ISIAccelerateAction@@UEAA?AU_ISI_Error@@XZ ?doResetVolportPerformanceCounters@ISIAccelerateAction@@UEAA?AU_ISI_Error@@XZ ?doSeparateConcatenation@ISIAccelerateAction@@UEAA?AU_ISI_Error@@I@Z ?doSeparateConcatenation@ISIAccelerateAction@@UEAA?AU_ISI_Error@@XZ ?doSeparateConcatenationNoSync@ISIAccelerateAction@@QEAA?AU_ISI_Error@@XZ ?erase@value@json@web@@QEAAXAEBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z ?erase@value@json@web@@QEAAX_K@Z ?format@value@json@web@@AEBAXAEAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z ?format@value@json@web@@AEBAXAEAV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z ?from_string@datetime@utility@@SA?AV12@AEBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@W4date_format@12@@Z ?generate@nonce_generator@utility@@QEAA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@XZ ?get@GlobalLogger@@SAAEAV1@XZ ?getError@GlobalLogger@@QEAA?AVCConsolidatedError@@_K_N@Z ?getLastError@GlobalLogger@@QEAA?AVCConsolidatedError@@_N@Z ?getLastId@GlobalLogger@@QEAA_KXZ ?getMaxCacheSize@ISIAccelerateAction@@SA_K_N@Z ?getMinCacheSize@ISIAccelerateAction@@SA_K_N@Z ?has_array_field@value@json@web@@QEBA_NAEBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z ?has_boolean_field@value@json@web@@QEBA_NAEBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z ?has_double_field@value@json@web@@QEBA_NAEBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z ?has_integer_field@value@json@web@@QEBA_NAEBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z ?has_number_field@value@json@web@@QEBA_NAEBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z ?has_object_field@value@json@web@@QEBA_NAEBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z ?has_string_field@value@json@web@@QEBA_NAEBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z ?is_double@value@json@web@@QEBA_NXZ ?is_int32@number@json@web@@QEBA_NXZ ?is_int64@number@json@web@@QEBA_NXZ ?is_integer@value@json@web@@QEBA_NXZ ?is_uint32@number@json@web@@QEBA_NXZ ?keep_object_element_order@json@web@@YAX_N@Z ?latin1_to_utf16@conversions@utility@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@AEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@4@@Z ?latin1_to_utf8@conversions@utility@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AEBV34@@Z ?message@windows_category_impl@details@utility@@UEBA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@H@Z ?null@value@json@web@@SA?AV123@XZ ?number@value@json@web@@SA?AV123@H@Z ?number@value@json@web@@SA?AV123@I@Z ?number@value@json@web@@SA?AV123@N@Z ?number@value@json@web@@SA?AV123@_J@Z ?number@value@json@web@@SA?AV123@_K@Z ?object@value@json@web@@SA?AV123@V?$vector@U?$pair@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@Vvalue@json@web@@@std@@V?$allocator@U?$pair@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@Vvalue@json@web@@@std@@@2@@std@@_N@Z ?object@value@json@web@@SA?AV123@_N@Z ?parse@value@json@web@@SA?AV123@AEAV?$basic_istream@DU?$char_traits@D@std@@@std@@@Z ?parse@value@json@web@@SA?AV123@AEAV?$basic_istream@DU?$char_traits@D@std@@@std@@AEAVerror_code@5@@Z ?parse@value@json@web@@SA?AV123@AEAV?$basic_istream@_WU?$char_traits@_W@std@@@std@@@Z ?parse@value@json@web@@SA?AV123@AEAV?$basic_istream@_WU?$char_traits@_W@std@@@std@@AEAVerror_code@5@@Z ?parse@value@json@web@@SA?AV123@AEBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z ?parse@value@json@web@@SA?AV123@AEBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@AEAVerror_code@5@@Z ?platform_category@details@utility@@YAAEBVerror_category@std@@XZ ?resetCacheToAvailable@ISIAccelerateAction@@UEAA?AU_ISI_Error@@I@Z ?seconds_to_xml_duration@timespan@utility@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@V?$duration@_JU?$ratio@$00$00@std@@@chrono@4@@Z ?serialize@value@json@web@@QEBA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@XZ ?serialize@value@json@web@@QEBAXAEAV?$basic_ostream@DU?$char_traits@D@std@@@std@@@Z ?serialize@value@json@web@@QEBAXAEAV?$basic_ostream@_WU?$char_traits@_W@std@@@std@@@Z ?setCacheVolSize@ISIAccelerateAction@@UEAAX_K@Z ?setError@GlobalLogger@@QEAA_KAEBVCConsolidatedError@@@Z ?setError@GlobalLogger@@QEAA_KAEBVCConsolidatedError@@AEAU_ISI_Error@@@Z ?setFastDisk@ISIAccelerateAction@@UEAAXI@Z ?setFcMode@ISIAccelerateAction@@UEAAXW4_ISI_NgsaFileCacheMode@@@Z ?setFileCacheSize@ISIAccelerateAction@@UEAAXI@Z ?setMigrationStart@ISIAccelerateAction@@UEAAX_K@Z ?setPreservePinningData@ISIAccelerateAction@@UEAAX_N@Z ?setSeparationSafe@ISIAccelerateAction@@UEAAX_N@Z ?setSlowDisk@ISIAccelerateAction@@UEAAXI@Z ?string@value@json@web@@CA?AV123@AEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z ?string@value@json@web@@SA?AV123@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z ?string@value@json@web@@SA?AV123@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@_N@Z ?system_type_to_datetime@datetime@utility@@CA_NPEAX_KPEAV12@@Z ?to_string@datetime@utility@@QEBA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@W4date_format@12@@Z ?to_string@value@json@web@@QEBA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@XZ ?to_string_t@conversions@utility@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@$$QEAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@4@@Z ?to_string_t@conversions@utility@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@AEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@4@@Z ?to_utf16string@conversions@utility@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@AEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@4@@Z ?to_utf8string@conversions@utility@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AEBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@4@@Z ?turnOffVolumeOrDiskAcceleration@ISIAccelerateAction@@UEAA?AU_ISI_Error@@I@Z ?type@value@json@web@@QEBA?AW4value_type@123@XZ ?usascii_to_utf16@conversions@utility@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@AEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@4@@Z ?utc_now@datetime@utility@@SA?AV12@XZ ?utf16_to_utf8@conversions@utility@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AEBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@4@@Z ?utf8_to_utf16@conversions@utility@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@AEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@4@@Z ?waitForNvcMode@ISIAccelerateAction@@UEAA?AU_ISI_Error@@IW4_ISI_NvcMode@@@Z ?windows_category@details@utility@@YAAEBVerror_category@std@@XZ ?xml_duration_to_seconds@timespan@utility@@YA?AV?$duration@_JU?$ratio@$00$00@std@@@chrono@std@@AEBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@5@@Z GetLPCId ISI_NgsaDiskPairStatusToDescription ISI_NgsaDiskValidForConcatenationStatusToDescription ISI_NgsaOperationStatusToDescription IsiAddDisksToArray IsiArraySetWriteCacheState IsiCacheVolumeCreateFromArray IsiCacheVolumeCreateFromDisks IsiDiskAssignStoragePool IsiDiskClaim IsiDiskClearMetadata IsiDiskDestroyCache IsiDiskGetPartitionTableInfos IsiDiskMarkAsFailed IsiDiskMarkAsNormal IsiDiskMarkAsSpare IsiDiskMarkOffline IsiDiskMarkOnline IsiDiskResetSmartEvent IsiDiskSetCacheBufferFlushSetting IsiDiskSetCacheMode IsiDiskSetCacheSpindownPolicy IsiDiskSetSmartEvent IsiDiskSetWriteCachingPolicySetting IsiDiskUnlock IsiDiskUnmarkAsSpare IsiEventClose IsiEventSetUpForAllWithHandle IsiEventWaitWithHandle IsiExpandVolume IsiFinalize IsiGetArrayHandles IsiGetArrayHandlesByControllerHandle IsiGetArrayInfo IsiGetControllerHandles IsiGetControllerInfo IsiGetDiskIdentifyData IsiGetEndDeviceHandles IsiGetEndDeviceInfo IsiGetErrorDebugMessage IsiGetErrorMessage IsiGetIsRTD3HotEnabled IsiGetIsmArrays IsiGetIsmEndDevices IsiGetIsmVolumes IsiGetLastErrorDebugMessage IsiGetLastErrorMessage IsiGetMiddlewareVersionInfo IsiGetNgsaDiskPairHandles IsiGetNgsaDiskPairInfo IsiGetNgsaHandles IsiGetNgsaInfo IsiGetNgsaInfoEx IsiGetNvCachePolicyStatInfo IsiGetNvCacheStat2Info IsiGetNvCacheStatInfo IsiGetNvCacheUnifiedStats IsiGetNvcInfo IsiGetOptaneOptimizationInfo IsiGetPhyHandles IsiGetPhyInfo IsiGetRaidInfo IsiGetRaidInfoHandles IsiGetRaidLevelInfo IsiGetRdpDictEndDevices IsiGetSystemInfo IsiGetVolportPerformanceCounters IsiGetVolumeHandles IsiGetVolumeInfo IsiGetVolumeMigrationRange IsiGetZpoddInfo IsiInitialize IsiNvcDisassociate IsiROHISetState IsiRaidLevelModify IsiReadPatrolSetState IsiRefreshPartitionInfo IsiRescan IsiSessionClose IsiSessionOpen IsiSetIntelHybridDiskSubClassCode IsiSetLpmStatus IsiSetReadPatrolUnit IsiToggleCoalescerPolicy IsiUpdatePmInterfaceFields IsiVdsHandlerMakeSpaceForMetadataOnSystemDisk IsiVolumeCancelVerify IsiVolumeConvertIrrtToRaid1 IsiVolumeConvertRaid1ToIrrt IsiVolumeCreate IsiVolumeCreateFromDisks IsiVolumeDelete IsiVolumeDestroyCache IsiVolumeInitialize IsiVolumeIrrtCreate IsiVolumeIrrtMountPartner IsiVolumeIrrtSetAutomaticSync IsiVolumeIrrtSetManualSync IsiVolumeIrrtSwapDisks IsiVolumeIrrtSync IsiVolumeIrrtUnMountPartner IsiVolumeMarkAsNormal IsiVolumeRebuild IsiVolumeRename IsiVolumeSetBufferFlush IsiVolumeSetCacheMode IsiVolumeSetCachePolicy IsiVolumeSetCacheSpindownPolicy IsiVolumeSetExportPolicy IsiVolumeVerify

Name

.text

Size

1.4MB

Virtual Size

1.4MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

617KB

Virtual Size

617KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

42KB

Virtual Size

71KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

77KB

Virtual Size

76KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

1024B

Virtual Size

617B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

580KB

Virtual Size

584KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-18_65d645ae0fb2016e4a127cbc64f06181_icedid_njrat

api-ms-win-core-synch-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-service-core-l1-1-0

api-ms-win-eventing-classicprovider-l1-1-0

api-ms-win-service-winsvc-l1-1-0

setupapi

advapi32

ole32

oleaut32

userenv

api-ms-win-security-base-l1-2-2

api-ms-win-core-heap-l2-1-0

rpcrt4

api-ms-win-core-util-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-timezone-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-datetime-l1-1-1

api-ms-win-core-synch-l1-2-0

api-ms-win-core-string-obsolete-l1-1-0

api-ms-win-core-processthreads-l1-1-1

api-ms-win-appmodel-runtime-l1-1-0

api-ms-win-core-path-l1-1-0

api-ms-win-core-psapi-l1-1-0

wintrust

api-ms-win-core-file-l1-1-0

api-ms-win-core-io-l1-1-0

api-ms-win-ntuser-sysparams-l1-1-0

api-ms-win-core-sysinfo-l1-2-0

api-ms-win-core-kernel32-legacy-l1-1-2

api-ms-win-devices-config-l1-1-1

api-ms-win-core-synch-ansi-l1-1-0

api-ms-win-core-synch-l1-2-1

api-ms-win-core-file-l2-1-1

api-ms-win-core-processenvironment-l1-1-0

api-ms-win-core-file-ansi-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-rtlsupport-l1-1-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-interlocked-l1-1-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-threadpool-legacy-l1-1-0

api-ms-win-core-systemtopology-l1-1-0

api-ms-win-core-processtopology-obsolete-l1-1-0

api-ms-win-core-kernel32-legacy-l1-1-0

api-ms-win-core-memory-l1-1-0

api-ms-win-core-libraryloader-l1-2-1

api-ms-win-core-console-l1-1-0

generic