2026-09-09_e38e2d1688fc55de8e3705b0dfa8e01a_icedid_njrat

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-09_e38e2d1688fc55de8e3705b0dfa8e01a_icedid_njrat
Size 3.2MB
Sample260910-2bmesaxajg
SHA256 534b1e1dad76d06f275406aaad78a442f8d1abbd3affb82ed5efb7af0b291696
MD5 e38e2d1688fc55de8e3705b0dfa8e01a
SHA1 9e990082bd9f62ab90b1d634970259381118c575
SHA512 0346f259e7f53ac600090ec49d90b529ed72daa5bb60330f44e89898023ccb2140ab72df94522561c50406d102cddeecebe1e852bab088520f0dc7e4ab3f9f69
SSDEEP 24576:Hu6ln7obqwbtpa7SBXYVImj+3VCb/yFPOB1l3OSq2PEIdADeU9jz:HpYK7SBXGpcIKF+1USqHIdADeU
TLSH
T1DBF51A17EBB651D5D0BAC038D553222AFC7134A6833897EBA6C19E461B60BF4EE3D740
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-09_e38e2d1688fc55de8e3705b0dfa8e01a_icedid_njrat

File Explorer

2026-09-09_e38e2d1688fc55de8e3705b0dfa8e01a_icedid_njrat

.exe 3.2MB

2026-09-09_e38e2d1688fc55de8e3705b0dfa8e01a_icedid_njrat

IMPHASH 527fdbae1fe8b2fa24674c04568523b0
SHA256 534b1e1dad76d06f275406aaad78a442f8d1abbd3affb82ed5efb7af0b291696
MD5 e38e2d1688fc55de8e3705b0dfa8e01a
SHA1 9e990082bd9f62ab90b1d634970259381118c575
SHA512 0346f259e7f53ac600090ec49d90b529ed72daa5bb60330f44e89898023ccb2140ab72df94522561c50406d102cddeecebe1e852bab088520f0dc7e4ab3f9f69
SSDEEP 24576:Hu6ln7obqwbtpa7SBXYVImj+3VCb/yFPOB1l3OSq2PEIdADeU9jz:HpYK7SBXGpcIKF+1USqHIdADeU
TLSH
T1DBF51A17EBB651D5D0BAC038D553222AFC7134A6833897EBA6C19E461B60BF4EE3D740
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1067808

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\dev\DISMTools\Helpers\extps1\PE_Helper\tools\DIM\src\x64\Debug\DT-DIM.pdb

kernel32

CreateFileW SetStdHandle SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP GetACP IsValidCodePage FindFirstFileExW GetTimeZoneInformation ReadConsoleW ReadFile GetConsoleMode GetConsoleOutputCP FlushFileBuffers SetFilePointerEx GetFileSizeEx SetEndOfFile GetUserDefaultLCID WaitForSingleObject GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW VirtualProtect IsThreadAFiber GetTempPathW SetConsoleCtrlHandler WriteConsoleW OutputDebugStringW GetFileType HeapQueryInformation GetCurrentThread HeapReAlloc UnhandledExceptionFilter RtlVirtualUnwind FormatMessageW LocalFree GetModuleHandleW CreateProcessW GetSystemDirectoryW EnumSystemLocalesW GetExitCodeProcess GetLastError CloseHandle FindNextFileW FindFirstFileW RtlCaptureContext ExitProcess WriteFile GetStdHandle IsProcessorFeaturePresent IsValidLocale FindClose WaitForSingleObjectEx Sleep SwitchToThread GetCurrentThreadId GetExitCodeThread GetLogicalProcessorInformationEx FormatMessageA WideCharToMultiByte MultiByteToWideChar GetStringTypeW EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection QueryPerformanceCounter QueryPerformanceFrequency GetSystemTimePreciseAsFileTime ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive WakeConditionVariable WakeAllConditionVariable SleepConditionVariableSRW GetLocaleInfoEx EncodePointer DecodePointer LCMapStringEx CompareStringEx GetCPInfo IsDebuggerPresent RaiseException GetCurrentProcessId GetSystemTimeAsFileTime InitializeSListHead SetUnhandledExceptionFilter GetStartupInfoW HeapAlloc HeapFree GetProcessHeap VirtualQuery FreeLibrary GetProcAddress RtlPcToFileHeader RtlLookupFunctionEntry RtlUnwindEx InterlockedPushEntrySList InterlockedFlushSList GetModuleFileNameW LoadLibraryExW SetLastError FlsAlloc FlsGetValue FlsSetValue FlsFree HeapSize HeapValidate GetSystemInfo GetCurrentProcess TerminateProcess GetModuleHandleExW CreateThread ExitThread ResumeThread FreeLibraryAndExitThread RtlUnwind

user32

GetMessageW SetProcessDpiAwarenessContext GetDpiForWindow SetProcessDPIAware GetMonitorInfoW MonitorFromPoint LoadIconW LoadCursorW GetParent GetWindowLongW FillRect MapWindowPoints GetCursorPos SetCursor MessageBoxW AdjustWindowRectEx GetWindowRect GetClientRect SetWindowTextW InvalidateRect UpdateWindow TrackPopupMenu AppendMenuW EnableMenuItem DestroyMenu CreatePopupMenu GetSystemMenu EnableWindow GetDlgItem SetWindowPos ShowWindow CreateWindowExW RegisterClassW PostQuitMessage DefWindowProcW SendMessageW DispatchMessageW TranslateMessage

gdi32

GetStockObject DeleteObject CreateSolidBrush SetBkMode

comdlg32

GetOpenFileNameW

advapi32

RegOpenKeyExW RegQueryValueExW RegCloseKey

shell32

SHBrowseForFolderW SHGetPathFromIDListW

ole32

CoTaskMemFree

comctl32

ord17

Name

.textbss

Size

Virtual Size

1.0MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.text

Size

2.1MB

Virtual Size

2.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

362KB

Virtual Size

362KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

11KB

Virtual Size

21KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

98KB

Virtual Size

98KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

9KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.msvcjmc

Size

1024B

Virtual Size

617B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.00cfg

Size

512B

Virtual Size

373B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

1024B

Virtual Size

563B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

20KB

Virtual Size

20KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

580KB

Virtual Size

584KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-09_e38e2d1688fc55de8e3705b0dfa8e01a_icedid_njrat

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ole32

comctl32

generic