2026-08-23_04118a4abcc7acca2d9307990cb6963b_icedid_njrat

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-23_04118a4abcc7acca2d9307990cb6963b_icedid_njrat
Size 2.7MB
Sample260824-wpvenaed67
SHA256 747cf0bd0db270adfd1c2fac9a6991f92212dc8922e5092a6ec28d9353d37ab5
MD5 04118a4abcc7acca2d9307990cb6963b
SHA1 9bbee3248cc52b8557c2a0859e449ca59bb14fcb
SHA512 8ac49657790135bbf544379a511fb6cc97e1ab8e4f507384fb3f7141ae7273327b7eaeca3fd0d43db7e763e8835ac6657c21a305a7a9c7bca33d113d9cfcb42e
SSDEEP 24576:iVXNjE5nL3hXjM0Y9EVGh6WpROMD+J89ukVLxuISvx8RR90y:AXRE5hpVGh5Rj+bkVexGRuy
TLSH
T140D5F90BF7B621D4E1BAC138D553222AFD7134A6833897DB66C19E061B61BE4ED3E740
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects executables containing commands for clearing Windows Event Logs 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_ClearWinLogs

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-23_04118a4abcc7acca2d9307990cb6963b_icedid_njrat

File Explorer

2026-08-23_04118a4abcc7acca2d9307990cb6963b_icedid_njrat

.exe 2.7MB

2026-08-23_04118a4abcc7acca2d9307990cb6963b_icedid_njrat

IMPHASH f8150461a34ed5769aeee6277137155d
SHA256 747cf0bd0db270adfd1c2fac9a6991f92212dc8922e5092a6ec28d9353d37ab5
MD5 04118a4abcc7acca2d9307990cb6963b
SHA1 9bbee3248cc52b8557c2a0859e449ca59bb14fcb
SHA512 8ac49657790135bbf544379a511fb6cc97e1ab8e4f507384fb3f7141ae7273327b7eaeca3fd0d43db7e763e8835ac6657c21a305a7a9c7bca33d113d9cfcb42e
SSDEEP 24576:iVXNjE5nL3hXjM0Y9EVGh6WpROMD+J89ukVLxuISvx8RR90y:AXRE5hpVGh5Rj+bkVexGRuy
TLSH
T140D5F90BF7B621D4E1BAC138D553222AFD7134A6833897DB66C19E061B61BE4ED3E740
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects executables containing commands for clearing Windows Event Logs
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

19271

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\User\Desktop\SOURCES MY PROJECTS FOR GAMES\412421414\WintorezCPP\x64\Debug\WintorezLoader.pdb

winhttp

WinHttpCloseHandle WinHttpQueryHeaders WinHttpConnect WinHttpReadData WinHttpQueryDataAvailable WinHttpQueryOption WinHttpSetOption WinHttpOpenRequest WinHttpAddRequestHeaders WinHttpSendRequest WinHttpOpen WinHttpReceiveResponse

bcrypt

BCryptOpenAlgorithmProvider BCryptCloseAlgorithmProvider BCryptCreateHash BCryptHashData BCryptFinishHash BCryptDestroyHash

advapi32

RegSetValueExA SetSecurityDescriptorDacl InitializeSecurityDescriptor FreeSid CheckTokenMembership AllocateAndInitializeSid RegDeleteKeyA RegDeleteValueA RegEnumKeyExA RegEnumValueA RegOpenKeyExA RegQueryValueExA RegCloseKey

comctl32

ord17

comdlg32

GetOpenFileNameA

shell32

SHGetFolderPathA SHBrowseForFolderA SHGetPathFromIDListA ShellExecuteW ShellExecuteA

kernel32

EnumSystemLocalesW GetConsoleOutputCP GetConsoleMode GetFileSizeEx SetFilePointerEx ReadConsoleW GetTimeZoneInformation FindFirstFileExW IsValidCodePage GetACP GetOEMCP GetCommandLineA CompareStringW GetTimeFormatW GetDateFormatW FlsFree FlsSetValue FlsGetValue GetEnvironmentVariableA CreateDirectoryA CreateFileA DeleteFileA DeleteFileW FindClose FindFirstFileA FindFirstFileW FindNextFileA FindNextFileW FlushFileBuffers GetFileAttributesA GetFileSize GetVolumeInformationW ReadFile RemoveDirectoryA SetFileAttributesA SetFilePointer WriteFile GetVolumeInformationA IsDebuggerPresent CheckRemoteDebuggerPresent CloseHandle DuplicateHandle GetLastError QueryPerformanceCounter QueryPerformanceFrequency SetEvent WaitForSingleObject CreateEventA Sleep GetCurrentProcess GetCurrentProcessId ExitProcess TerminateProcess GetExitCodeProcess CreateThread GetCommandLineW OpenThread GetExitCodeThread ResumeThread CreateProcessA CreateProcessW OpenProcess GetTickCount VirtualAllocEx VirtualProtectEx ReadProcessMemory WriteProcessMemory MapViewOfFile VirtualFreeEx UnmapViewOfFile GetModuleFileNameA GetModuleFileNameW GetModuleHandleA GetModuleHandleExA GetProcAddress LoadLibraryA GlobalAlloc GlobalUnlock GlobalLock LocalFree CreateFileMappingA CopyFileA MoveFileA GetComputerNameA MultiByteToWideChar CreateToolhelp32Snapshot Process32FirstW Process32NextW Thread32First Thread32Next Module32FirstW Module32NextW FlsAlloc SetConsoleCtrlHandler WriteConsoleW OutputDebugStringW GetFileType GetProcessHeap HeapQueryInformation HeapReAlloc HeapFree GetFileAttributesExW GetCurrentThread GetStdHandle FreeLibraryAndExitThread LCMapStringW ExitThread GetModuleHandleExW GetSystemInfo HeapValidate HeapSize HeapAlloc LoadLibraryExW FreeLibrary TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount SetLastError InterlockedFlushSList InterlockedPushEntrySList RtlUnwindEx RaiseException RtlPcToFileHeader InitializeSListHead GetStartupInfoW IsProcessorFeaturePresent SetUnhandledExceptionFilter GetUserDefaultLCID GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle CreateFileW SetEndOfFile CreateRemoteThread RtlUnwind IsValidLocale GetLocaleInfoW UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext GetCPInfo CompareStringEx GetStringTypeW WaitForSingleObjectEx SwitchToThread GetCurrentThreadId GetNativeSystemInfo FormatMessageA WideCharToMultiByte EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive WakeConditionVariable WakeAllConditionVariable SleepConditionVariableSRW GetLocaleInfoEx EncodePointer DecodePointer LCMapStringEx SetFileInformationByHandle GetTempPathW InitOnceExecuteOnce CreateEventExW CreateSemaphoreExW FlushProcessWriteBuffers GetCurrentProcessorNumber GetSystemTimeAsFileTime GetTickCount64 FreeLibraryWhenCallbackReturns CreateThreadpoolTimer SetThreadpoolTimer WaitForThreadpoolTimerCallbacks CloseThreadpoolTimer CreateThreadpoolWait SetThreadpoolWait CloseThreadpoolWait GetModuleHandleW GetFileInformationByHandleEx CreateSymbolicLinkW

user32

UpdateWindow DrawTextA GetSystemMetrics EnableWindow KillTimer SetTimer EmptyClipboard SetClipboardData CloseClipboard OpenClipboard SetWindowTextA GetDlgItemTextA SetDlgItemTextA GetDlgItem IsWindowVisible SetWindowDisplayAffinity DestroyWindow CreateWindowExA RegisterClassA PostQuitMessage DefWindowProcA PostMessageW SendMessageW UnregisterHotKey RegisterHotKey DispatchMessageW TranslateMessage GetMessageW MessageBoxA InvalidateRect FillRect EnumWindows GetWindowThreadProcessId LoadCursorW GetDlgCtrlID ShowWindow

gdi32

SetBkMode CreateFontA CreateSolidBrush DeleteObject SelectObject SetBkColor SetTextColor

ole32

CoTaskMemFree

setupapi

SetupDiSetClassInstallParamsA SetupDiGetDeviceRegistryPropertyA SetupDiCallClassInstaller SetupDiGetClassDevsA SetupDiDestroyDeviceInfoList SetupDiEnumDeviceInfo

Name

.text

Size

2.2MB

Virtual Size

2.2MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

468KB

Virtual Size

467KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

11KB

Virtual Size

23KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

86KB

Virtual Size

85KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

13KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

1024B

Virtual Size

777B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.00cfg

Size

512B

Virtual Size

373B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

12KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-23_04118a4abcc7acca2d9307990cb6963b_icedid_njrat

winhttp

bcrypt

advapi32

comctl32

comdlg32

shell32

kernel32

user32

gdi32

ole32

setupapi

generic