2026-09-16_506b51ee53eaef05b67e9eb18d80b288_icedid_njrat_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-16_506b51ee53eaef05b67e9eb18d80b288_icedid_njrat_stealc
Size 3.1MB
Sample260916-1js2vstvbz
SHA256 2f81556a1b118f970105481e2aff6400186ff2d7effa1c183b12a9f98d8e3552
MD5 506b51ee53eaef05b67e9eb18d80b288
SHA1 86644d1c57e30f1062491689ab492f38e396b38f
SHA512 a3ccc8d2ea09b871f34e619f995239733fb3048f2d531bd26070ae8408c9ccc5f1bb1379bf96d41524dff675e438439150d1478ac9337ecb491d5585e68f95f0
SSDEEP 49152:I0Eke07BzpcGx4qDKq2KL2mJa4V1z9Klz2/N/j2U4FH:I8D3J/v9Klz2Bj2jF
TLSH
T14AE56B16A1F84064E0B2817C9A7AC4F1E2657FC74760498B32FC3D1FBF766990A7A634
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-16_506b51ee53eaef05b67e9eb18d80b288_icedid_njrat_stealc

File Explorer

2026-09-16_506b51ee53eaef05b67e9eb18d80b288_icedid_njrat_stealc

.exe 3.1MB

2026-09-16_506b51ee53eaef05b67e9eb18d80b288_icedid_njrat_stealc

IMPHASH d7e3b6aad27f618c5ef9824ec7f429d7
SHA256 2f81556a1b118f970105481e2aff6400186ff2d7effa1c183b12a9f98d8e3552
MD5 506b51ee53eaef05b67e9eb18d80b288
SHA1 86644d1c57e30f1062491689ab492f38e396b38f
SHA512 a3ccc8d2ea09b871f34e619f995239733fb3048f2d531bd26070ae8408c9ccc5f1bb1379bf96d41524dff675e438439150d1478ac9337ecb491d5585e68f95f0
SSDEEP 49152:I0Eke07BzpcGx4qDKq2KL2mJa4V1z9Klz2/N/j2U4FH:I8D3J/v9Klz2Bj2jF
TLSH
T14AE56B16A1F84064E0B2817C9A7AC4F1E2657FC74760498B32FC3D1FBF766990A7A634
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

605968

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\constructicon\builds\gfx\six\26.10\install\Neoma\cmake_build\InstallNeoma\IN_Apps\src\Apps\AMDCleanupUtility\Release\AMDCleanupUtility.pdb

setupapi

SetupDiSetDeviceInstallParamsW CM_Get_Child CM_Get_Parent SetupOpenInfFileW SetupDiCallClassInstaller CM_Get_Device_IDW SetupGetStringFieldW CM_Get_DevNode_Registry_PropertyW SetupGetInfDriverStoreLocationW SetupDiBuildDriverInfoList SetupDiSetClassInstallParamsW CM_Get_Sibling SetupDiGetDriverInfoDetailW SetupDiSetSelectedDriverW SetupDiEnumDriverInfoW SetupDiGetDeviceInstallParamsW SetupFindNextLine CM_Get_Device_ID_Size SetupCloseFileQueue SetupUninstallOEMInfW SetupDiDestroyDriverInfoList SetupCloseInfFile SetupOpenFileQueue CM_Get_DevNode_Status SetupScanFileQueueW SetupDiRemoveDevice SetupDiGetDeviceInstanceIdW SetupDiGetClassDevsW SetupDiEnumDeviceInfo SetupDiDestroyDeviceInfoList SetupDiGetDeviceRegistryPropertyW CM_Locate_DevNodeW CM_Reenumerate_DevNode SetupFindFirstLineW

newdev

DiUninstallDevice

version

GetFileVersionInfoSizeW VerQueryValueW GetFileVersionInfoW

api-ms-win-core-heap-l1-1-0

HeapFree HeapReAlloc HeapDestroy HeapAlloc HeapSize GetProcessHeap

api-ms-win-core-synch-l1-1-0

LeaveCriticalSection WaitForSingleObject DeleteCriticalSection InitializeCriticalSectionEx TryAcquireSRWLockExclusive WaitForSingleObjectEx EnterCriticalSection AcquireSRWLockExclusive ReleaseSRWLockExclusive InitializeCriticalSectionAndSpinCount CreateMutexW

api-ms-win-core-errorhandling-l1-1-0

SetUnhandledExceptionFilter RaiseException GetLastError UnhandledExceptionFilter SetLastError

api-ms-win-core-util-l1-1-0

DecodePointer EncodePointer

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleExW GetProcAddress LoadResource GetModuleFileNameW SetDefaultDllDirectories FindResourceExW SizeofResource GetModuleHandleW FreeLibrary LoadLibraryExW LoadStringW FreeLibraryAndExitThread LockResource

oleaut32

VariantClear GetErrorInfo SysAllocString SysFreeString SetErrorInfo SysStringLen

api-ms-win-core-file-l1-1-0

CreateDirectoryW SetFilePointerEx GetFinalPathNameByHandleW GetFullPathNameW FlushFileBuffers GetDriveTypeW DeleteFileW SetFileInformationByHandle GetFileInformationByHandle GetFileType GetFileSizeEx FindFirstFileW FindFirstFileExW FindNextFileW ReadFile GetFileAttributesExW WriteFile SetFileAttributesW FindClose CreateFileW GetFileAttributesW SetEndOfFile

api-ms-win-core-registry-l1-1-0

RegQueryInfoKeyW RegCloseKey RegSetValueExW RegDeleteTreeW RegDeleteValueW RegEnumValueW RegQueryValueExW RegGetValueW RegOpenKeyExW RegCreateKeyExW RegEnumKeyExW

api-ms-win-core-registry-l2-1-0

RegDeleteKeyW RegOpenKeyW

api-ms-win-core-processthreads-l1-1-0

ExitProcess ExitThread GetStartupInfoW CreateThread TlsFree OpenProcessToken TlsSetValue CreateProcessW GetCurrentProcessId GetExitCodeThread GetCurrentThreadId TerminateProcess GetCurrentProcess TlsAlloc TlsGetValue GetExitCodeProcess

api-ms-win-core-string-obsolete-l1-1-0

lstrlenW

api-ms-win-core-com-l1-1-0

CoSetProxyBlanket CoInitializeSecurity IIDFromString CoInitializeEx CoUninitialize CoCreateInstance

api-ms-win-core-sysinfo-l1-1-0

GetTickCount GetWindowsDirectoryW GetSystemTimeAsFileTime GetSystemDirectoryW

api-ms-win-core-memory-l1-1-0

CreateFileMappingW MapViewOfFile UnmapViewOfFile VirtualProtect

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent

api-ms-win-core-synch-l1-2-0

WakeAllConditionVariable SleepConditionVariableSRW InitOnceComplete Sleep InitOnceBeginInitialize

api-ms-win-core-localization-l1-2-0

FormatMessageA GetUserDefaultLocaleName GetOEMCP IsValidCodePage LCMapStringW GetACP GetLocaleInfoEx GetLocaleInfoW IsValidLocale LCMapStringEx EnumSystemLocalesW GetCPInfo GetUserDefaultLCID FormatMessageW

api-ms-win-security-provider-l1-1-0

SetNamedSecurityInfoW SetEntriesInAclW GetNamedSecurityInfoW

api-ms-win-core-registry-l1-1-1

RegDeleteKeyValueW

api-ms-win-core-handle-l1-1-0

CloseHandle SetHandleInformation

api-ms-win-core-libraryloader-l1-2-1

FindResourceW

api-ms-win-service-management-l1-1-0

OpenSCManagerW

api-ms-win-core-heap-l2-1-0

LocalFree

api-ms-win-core-file-l2-1-0

MoveFileExW GetFileInformationByHandleEx

api-ms-win-core-sysinfo-l1-2-0

VerSetConditionMask

api-ms-win-core-kernel32-legacy-l1-1-1

VerifyVersionInfoW

api-ms-win-security-base-l1-1-0

SetSecurityDescriptorOwner CreateWellKnownSid InitializeSecurityDescriptor SetSecurityDescriptorGroup SetSecurityDescriptorDacl AdjustTokenPrivileges

api-ms-win-security-lsalookup-l2-1-0

LookupPrivilegeValueW

api-ms-win-core-debug-l1-1-0

IsDebuggerPresent OutputDebugStringW

api-ms-win-core-processenvironment-l1-1-0

GetCurrentDirectoryW GetEnvironmentVariableW SetStdHandle GetCommandLineW GetStdHandle SetEnvironmentVariableW GetEnvironmentStringsW GetCommandLineA FreeEnvironmentStringsW

api-ms-win-core-localization-obsolete-l1-2-0

GetUserDefaultUILanguage

api-ms-win-core-namedpipe-l1-1-0

CreatePipe PeekNamedPipe

api-ms-win-shcore-obsolete-l1-1-0

CommandLineToArgvW

api-ms-win-core-string-l1-1-0

MultiByteToWideChar CompareStringEx CompareStringW WideCharToMultiByte GetStringTypeW

api-ms-win-ntuser-sysparams-l1-1-0

GetSystemMetrics

api-ms-win-core-file-l2-1-2

CopyFileW

api-ms-win-core-console-l1-1-0

GetConsoleOutputCP GetConsoleMode ReadConsoleW WriteConsoleW

api-ms-win-core-largeinteger-l1-1-0

MulDiv

api-ms-win-core-datetime-l1-1-1

GetTimeFormatEx GetDateFormatEx

api-ms-win-core-timezone-l1-1-0

SystemTimeToTzSpecificLocalTime GetTimeZoneInformation FileTimeToSystemTime

user32

GetDC GetWindowRect SetWindowPos CreateWindowExW SendMessageW EndDialog SetWindowTextW RegisterClassExW LoadAcceleratorsW ShowWindow OffsetRect DispatchMessageW DefWindowProcW IsDialogMessageW CreateDialogParamW CopyRect ExitWindowsEx GetMessageW LoadBitmapW TranslateAcceleratorW TranslateMessage LoadIconW LoadCursorW SetCursor SetWindowLongW GetClientRect GetDlgItem PostThreadMessageW PostQuitMessage GetDesktopWindow GetParent DialogBoxParamW ReleaseCapture InvalidateRect ReleaseDC BeginPaint EndPaint MessageBoxW GetWindowLongW DestroyWindow PeekMessageW SetTimer

gdi32

DeleteObject GetStockObject SetBkMode SetTextColor GetDeviceCaps CreateFontW SelectObject StretchBlt CreateCompatibleDC GetObjectW

shell32

SHGetFolderPathW ShellExecuteExW SHGetPathFromIDListW SHGetFolderLocation ShellExecuteW SHGetSpecialFolderPathW FindExecutableW SHGetMalloc SHFileOperationW

ole32

CoInitialize

advapi32

QueryServiceStatusEx CloseServiceHandle ControlService OpenServiceW DeleteService

shlwapi

PathFindFileNameW PathFileExistsW PathGetDriveNumberW PathIsDirectoryW

msi

ord205 ord70 ord141 ord88

api-ms-win-core-rtlsupport-l1-1-0

RtlCaptureContext RtlPcToFileHeader RtlUnwindEx RtlVirtualUnwind RtlLookupFunctionEntry RtlUnwind

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-threadpool-l1-2-0

CreateThreadpoolWork CloseThreadpoolWork SubmitThreadpoolWork FreeLibraryWhenCallbackReturns

api-ms-win-core-file-l1-2-0

GetTempPathW

api-ms-win-core-file-l1-2-2

AreFileApisANSI

api-ms-win-core-interlocked-l1-1-0

InterlockedPushEntrySList InitializeSListHead

api-ms-win-core-fibers-l1-1-0

FlsSetValue FlsGetValue FlsAlloc FlsFree

api-ms-win-core-datetime-l1-1-0

GetDateFormatW GetTimeFormatW

api-ms-win-core-winrt-error-l1-1-1

RoOriginateLanguageException

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory

Name

.text

Size

817KB

Virtual Size

816KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

241KB

Virtual Size

240KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

18KB

Virtual Size

29KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

34KB

Virtual Size

34KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1.5MB

Virtual Size

1.5MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

572KB

Virtual Size

576KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-16_506b51ee53eaef05b67e9eb18d80b288_icedid_njrat_stealc

setupapi

newdev

version

api-ms-win-core-heap-l1-1-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-util-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

oleaut32

api-ms-win-core-file-l1-1-0

api-ms-win-core-registry-l1-1-0

api-ms-win-core-registry-l2-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-string-obsolete-l1-1-0

api-ms-win-core-com-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-memory-l1-1-0

api-ms-win-core-processthreads-l1-1-1

api-ms-win-core-synch-l1-2-0

api-ms-win-core-localization-l1-2-0

api-ms-win-security-provider-l1-1-0

api-ms-win-core-registry-l1-1-1

api-ms-win-core-handle-l1-1-0

api-ms-win-core-libraryloader-l1-2-1

api-ms-win-service-management-l1-1-0

api-ms-win-core-heap-l2-1-0

api-ms-win-core-file-l2-1-0

api-ms-win-core-sysinfo-l1-2-0

api-ms-win-core-kernel32-legacy-l1-1-1

api-ms-win-security-base-l1-1-0

api-ms-win-security-lsalookup-l2-1-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-processenvironment-l1-1-0

api-ms-win-core-localization-obsolete-l1-2-0

api-ms-win-core-namedpipe-l1-1-0

api-ms-win-shcore-obsolete-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-ntuser-sysparams-l1-1-0

api-ms-win-core-file-l2-1-2

api-ms-win-core-console-l1-1-0

api-ms-win-core-largeinteger-l1-1-0

api-ms-win-core-datetime-l1-1-1

api-ms-win-core-timezone-l1-1-0

user32

gdi32

shell32

ole32

advapi32

shlwapi

msi

api-ms-win-core-rtlsupport-l1-1-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-threadpool-l1-2-0

api-ms-win-core-file-l1-2-0

api-ms-win-core-file-l1-2-2

api-ms-win-core-interlocked-l1-1-0

api-ms-win-core-fibers-l1-1-0

api-ms-win-core-datetime-l1-1-0

api-ms-win-core-winrt-error-l1-1-1

api-ms-win-core-winrt-l1-1-0

generic