2026-09-10_920ad5de4e1e6e0a80cf6cb53569ef1b_icedid_njrat

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-10_920ad5de4e1e6e0a80cf6cb53569ef1b_icedid_njrat
Size 1.2MB
Sample260910-qv486athma
SHA256 76851f0eca4ed7cb2f033e308538fa9b218ddfbd10633a512245b706f35e4c10
MD5 920ad5de4e1e6e0a80cf6cb53569ef1b
SHA1 79c7fa52ace780264877c01a50a99d1f3e341a24
SHA512 e29c702ea21bc1208662b7ba77c1a42d42c49b6cf2180143f5a9bd4872b39af4792fb1cfbe0f8ed9567cad482ee73bf338eb97f5fc27762c3fe2046e8ca01ed6
SSDEEP 12288:V1Ed+rm7Fq86rsd9WJ81MRundVp3HGgbpkdIJr2o8ZyiXhqjvw+8n0Td:UZ6rsd8JfdmKo8Z4j490h
TLSH
T16945A54BFBB611D1F5BAC1399562322AFC7234A5873897D752859A0E4B30FE4AD3E700
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-10_920ad5de4e1e6e0a80cf6cb53569ef1b_icedid_njrat

File Explorer

2026-09-10_920ad5de4e1e6e0a80cf6cb53569ef1b_icedid_njrat

.exe 1.2MB

2026-09-10_920ad5de4e1e6e0a80cf6cb53569ef1b_icedid_njrat

IMPHASH 5a4bc79180265195381e3ac264429a23
SHA256 76851f0eca4ed7cb2f033e308538fa9b218ddfbd10633a512245b706f35e4c10
MD5 920ad5de4e1e6e0a80cf6cb53569ef1b
SHA1 79c7fa52ace780264877c01a50a99d1f3e341a24
SHA512 e29c702ea21bc1208662b7ba77c1a42d42c49b6cf2180143f5a9bd4872b39af4792fb1cfbe0f8ed9567cad482ee73bf338eb97f5fc27762c3fe2046e8ca01ed6
SSDEEP 12288:V1Ed+rm7Fq86rsd9WJ81MRundVp3HGgbpkdIJr2o8ZyiXhqjvw+8n0Td:UZ6rsd8JfdmKo8Z4j490h
TLSH
T16945A54BFBB611D1F5BAC1399562322AFC7234A5873897D752859A0E4B30FE4AD3E700
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

486866

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\SibSoft\R-gulum\x64\Debug\R-gulum.pdb

kernel32

GetCurrentDirectoryW CreateFileW LockFileEx UnlockFile WriteFile CloseHandle RaiseException GetLastError HeapCreate HeapDestroy HeapAlloc CreateIoCompletionPort GetQueuedCompletionStatus PostQueuedCompletionStatus InitializeCriticalSection EnterCriticalSection LeaveCriticalSection DeleteCriticalSection SetEvent ResetEvent WaitForSingleObject CreateEventW GetCurrentProcessId CreateThread GetCurrentThread GetCurrentThreadId SetThreadPriority TlsAlloc TlsGetValue TlsSetValue GetSystemInfo GetSystemTime GetTimeZoneInformation MultiByteToWideChar HeapFree GetModuleHandleW ReadConsoleW ReadFile GetConsoleMode GetConsoleOutputCP FlushFileBuffers SetFilePointerEx GetFileSizeEx HeapQueryInformation HeapReAlloc LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW IsDebuggerPresent WideCharToMultiByte QueryPerformanceCounter GetSystemTimeAsFileTime InitializeSListHead SetUnhandledExceptionFilter GetStartupInfoW GetProcessHeap VirtualQuery FreeLibrary GetProcAddress RtlUnwindEx RtlLookupFunctionEntry InterlockedPushEntrySList InterlockedFlushSList GetModuleFileNameW LoadLibraryExW SetLastError FlsAlloc FlsGetValue FlsSetValue FlsFree EncodePointer InitializeCriticalSectionEx RtlPcToFileHeader RtlCaptureContext RtlVirtualUnwind UnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent GetModuleHandleExW GetStdHandle ExitProcess HeapSize HeapValidate GetFileType OutputDebugStringW WriteConsoleW SetConsoleCtrlHandler FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle GetStringTypeW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetTempPathW IsThreadAFiber VirtualProtect RtlUnwind

user32

UnregisterClassW PostQuitMessage DefWindowProcW DispatchMessageW RegisterClassExW GetMessageW MessageBoxW UpdateWindow ShowWindow CreateWindowExW TranslateMessage

Name

.textbss

Size

Virtual Size

457KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.text

Size

972KB

Virtual Size

972KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

207KB

Virtual Size

207KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

30KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

44KB

Virtual Size

44KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.msvcjmc

Size

1024B

Virtual Size

595B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.00cfg

Size

512B

Virtual Size

373B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

1024B

Virtual Size

563B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

7KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-10_920ad5de4e1e6e0a80cf6cb53569ef1b_icedid_njrat

kernel32

user32

generic