2026-08-22_b3814bbc99396f9500aa18fe5f4d919c_icedid_njrat_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-22_b3814bbc99396f9500aa18fe5f4d919c_icedid_njrat_stealc
Size 6.4MB
Sample260823-clfmjsdn2y
SHA256 002525b741d9f8eba256939c843ade852621d1f6c7f2432def9d78914e7a6375
MD5 b3814bbc99396f9500aa18fe5f4d919c
SHA1 8c74c1e608f5b707544250a974abcb87e050a59f
SHA512 0d5ce2e0bcdca01ffbee143ca4d0c1caada479832137feadabe701b90e0ef64630db3de2e7ccd19a0678c80f7e63abc43a8deeae404e973100b3e5df88d8c26b
SSDEEP 98304:ne85OjV/xT4GTZ3D8cu5rro0DLR58cu5rro0DLR5:V4V5T4GBDQ5rkuQ5rku
TLSH
T157660206A2970668EFB36738C9A06627C2F17CC547B0C3DB1BDD49629F676308DADB11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects executables Discord URL observed in first stage droppers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_DiscordURL

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-22_b3814bbc99396f9500aa18fe5f4d919c_icedid_njrat_stealc

File Explorer

2026-08-22_b3814bbc99396f9500aa18fe5f4d919c_icedid_njrat_stealc

.exe 6.4MB

2026-08-22_b3814bbc99396f9500aa18fe5f4d919c_icedid_njrat_stealc

IMPHASH 449740b3ac893b9b18c4830afcf9fce6
SHA256 002525b741d9f8eba256939c843ade852621d1f6c7f2432def9d78914e7a6375
MD5 b3814bbc99396f9500aa18fe5f4d919c
SHA1 8c74c1e608f5b707544250a974abcb87e050a59f
SHA512 0d5ce2e0bcdca01ffbee143ca4d0c1caada479832137feadabe701b90e0ef64630db3de2e7ccd19a0678c80f7e63abc43a8deeae404e973100b3e5df88d8c26b
SSDEEP 98304:ne85OjV/xT4GTZ3D8cu5rro0DLR58cu5rro0DLR5:V4V5T4GBDQ5rkuQ5rku
TLSH
T157660206A2970668EFB36738C9A06627C2F17CC547B0C3DB1BDD49629F676308DADB11
MD5 SHA1 SHA512 SSDEEP TLSH

Detects executables Discord URL observed in first stage droppers
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

858380

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

d3d11

D3D11CreateDeviceAndSwapChain

d3dx11_43

D3DX11CreateShaderResourceViewFromFileA D3DX11GetImageInfoFromFileA D3DX11CreateShaderResourceViewFromMemory

wininet

HttpOpenRequestA InternetCrackUrlA InternetOpenA InternetOpenUrlA InternetGetConnectedState InternetReadFile InternetConnectA HttpSendRequestA InternetCloseHandle

iphlpapi

GetTcpTable2 GetAdaptersInfo

kernel32

CreateRemoteThreadEx WriteProcessMemory VirtualProtect VirtualAlloc TerminateProcess OpenProcess CreateThread VirtualAllocEx ReadProcessMemory GetModuleHandleW CreateRemoteThread CreateProcessA GetTickCount OpenThread IsDebuggerPresent CheckRemoteDebuggerPresent FindFirstFileA GetModuleFileNameW FindNextFileA FindClose WaitForSingleObject CreateFileW CreateFileA GetLocalTime UnmapViewOfFile GetLastError SetEvent CreateFileMappingA CreateEventA MapViewOfFile Module32FirstW Module32NextW GetExitCodeProcess CreateDirectoryW FindFirstFileW GetFileSizeEx FindNextFileW GetCurrentProcess WriteFile DeviceIoControl RemoveDirectoryW GetEnvironmentVariableW SetEndOfFile GetTempPathW GetFileAttributesW ExitThread DeleteFileW FreeConsole SetFilePointerEx MoveFileExW GetCurrentProcessId CreateProcessW MoveFileW FlushFileBuffers GetModuleFileNameA CreateDirectoryA GetFileAttributesA EnumSystemLocalesW GetUserDefaultLCID IsValidLocale MultiByteToWideChar LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW FreeLibrary FlsSetValue FlsGetValue FlsAlloc HeapFree GetConsoleMode GetConsoleOutputCP HeapAlloc GetProcAddress WriteConsoleW GetFileType GetStdHandle GetModuleHandleExW FreeLibraryAndExitThread LoadLibraryExW TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount SetLastError RaiseException RtlPcToFileHeader RtlUnwindEx InitializeSListHead GetStartupInfoW IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext GetStringTypeW GetCPInfo CompareStringEx WakeAllConditionVariable LCMapStringEx DecodePointer EncodePointer DeleteCriticalSection LeaveCriticalSection EnterCriticalSection GetSystemTimeAsFileTime QueryPerformanceFrequency LoadLibraryA GetLocaleInfoA GetModuleHandleA GetTickCount64 Sleep GetComputerNameA WideCharToMultiByte ExitProcess CloseHandle Process32FirstW DeleteFileA RtlUnwind GetVersionExA Process32NextW GetTempPathA CreateToolhelp32Snapshot GetVolumeInformationA QueryPerformanceCounter FlsFree GetTimeZoneInformation ReadConsoleW OutputDebugStringW HeapReAlloc IsValidCodePage GetACP GetOEMCP GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetProcessHeap SetStdHandle InitializeCriticalSectionEx GetFileInformationByHandleEx GlobalUnlock GlobalLock GlobalFree ReadFile GlobalAlloc HeapSize GetLocaleInfoW AreFileApisANSI GetFileAttributesExW FindFirstFileExW GetLocaleInfoEx LocalFree SleepConditionVariableSRW GetCurrentThreadId TryAcquireSRWLockExclusive AcquireSRWLockExclusive ReleaseSRWLockExclusive FormatMessageA

user32

IsWindowUnicode SetCursor SetCapture LoadCursorW GetForegroundWindow GetKeyboardLayout TrackMouseEvent SetCursorPos GetWindowTextW SetForegroundWindow UpdateWindow GetClientRect ReleaseCapture TranslateMessage SetWindowDisplayAffinity PeekMessageW DispatchMessageW GetAsyncKeyState ShowWindow SetWindowPos EnumDisplayDevicesA SendInput SetClipboardData GetClipboardData ClientToScreen GetCapture EmptyClipboard CloseClipboard OpenClipboard FindWindowW SetWindowLongW MessageBoxA ScreenToClient GetWindowLongW SetWindowLongA GetWindowRect GetWindowThreadProcessId GetWindowTextLengthW DefWindowProcW DestroyWindow CreateWindowExW GetSystemMetrics UnregisterClassW RegisterClassExW MapWindowPoints MoveWindow SetLayeredWindowAttributes LoadIconW GetParent GetActiveWindow IsWindowVisible GetWindowTextA EnumWindows SetWindowsHookA GetWindowTextLengthA FindWindowA GetKeyState GetMessageExtraInfo GetCursorPos

comdlg32

GetOpenFileNameA

advapi32

CloseServiceHandle RegOpenKeyExA RegQueryValueExA RegCreateKeyExA RegSetValueExA RegDeleteValueA LookupPrivilegeValueW SetSecurityDescriptorDacl AdjustTokenPrivileges SetSecurityDescriptorOwner AllocateAndInitializeSid RegEnumKeyExW RegSetKeySecurity RegSetValueExW OpenProcessToken FreeSid InitializeSecurityDescriptor InitializeAcl RegOpenKeyExW RegDeleteValueW GetLengthSid AddAccessAllowedAce RegEnumValueW RegQueryValueExW QueryServiceStatus OpenSCManagerA ControlService OpenServiceA RegCloseKey

shell32

ShellExecuteA SHGetFolderPathA

ole32

CoCreateInstance CoInitialize

winmm

mciSendStringA

imm32

ImmSetCandidateWindow ImmSetCompositionWindow ImmReleaseContext ImmGetContext

d3dcompiler_43

D3DCompile

dwmapi

DwmFlush DwmExtendFrameIntoClientArea

gdiplus

GdipGetImageWidth GdipDeleteGraphics GdipGetImageGraphicsContext GdipImageGetFrameCount GdipBitmapLockBits GdipGetPropertyItemSize GdipFree GdipCreateBitmapFromScan0 GdipLoadImageFromFile GdipSetInterpolationMode GdipSetSmoothingMode GdipDisposeImage GdipDrawImageRectI GdipAlloc GdipGetPropertyItem GdipBitmapUnlockBits GdipCloneImage GdipGetImageHeight GdipSetPixelOffsetMode GdiplusStartup GdipImageSelectActiveFrame GdipGraphicsClear

Name

.text

Size

1.1MB

Virtual Size

1.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

4.0MB

Virtual Size

4.0MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

1.4MB

Virtual Size

1.4MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

32KB

Virtual Size

31KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

35KB

Virtual Size

35KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-22_b3814bbc99396f9500aa18fe5f4d919c_icedid_njrat_stealc

d3d11

d3dx11_43

wininet

iphlpapi

kernel32

user32

comdlg32

advapi32

shell32

ole32

winmm

imm32

d3dcompiler_43

dwmapi

gdiplus

generic