2026-09-16_ef9b6b045eb4161643d8fb3f580f8c80_icedid_njrat

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-16_ef9b6b045eb4161643d8fb3f580f8c80_icedid_njrat
Size 13.1MB
Sample260916-s2ctlacq8y
SHA256 568a25c4e01f49c9ad60593b494d98464c38e323773e14f96b461197aab945bc
MD5 ef9b6b045eb4161643d8fb3f580f8c80
SHA1 3d3fd48a625a7f235fde8d5ab457d515795a3754
SHA512 d57d7519f9a1e06e16d5560edbf54df87279c83976c4e602314b165a4d7645fc519d322d1674841c0d096aae1f2f0b4eec0bcd5b2b346254c8b66eaa5d93d654
SSDEEP 393216:qcKv76NsntUEeW7BLCsshc0odotoG6TIS:qDv76NstHeWsIGw
TLSH
T14CD68C070496446CD3BF2BBD87FA1009EE9234D40B6463EBEDA493B55E63EDC05B9B18
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-16_ef9b6b045eb4161643d8fb3f580f8c80_icedid_njrat

File Explorer

2026-09-16_ef9b6b045eb4161643d8fb3f580f8c80_icedid_njrat

.exe 13.1MB

2026-09-16_ef9b6b045eb4161643d8fb3f580f8c80_icedid_njrat

IMPHASH 84ce18c0e2a66150421deccc7c8b13c3
SHA256 568a25c4e01f49c9ad60593b494d98464c38e323773e14f96b461197aab945bc
MD5 ef9b6b045eb4161643d8fb3f580f8c80
SHA1 3d3fd48a625a7f235fde8d5ab457d515795a3754
SHA512 d57d7519f9a1e06e16d5560edbf54df87279c83976c4e602314b165a4d7645fc519d322d1674841c0d096aae1f2f0b4eec0bcd5b2b346254c8b66eaa5d93d654
SSDEEP 393216:qcKv76NsntUEeW7BLCsshc0odotoG6TIS:qDv76NstHeWsIGw
TLSH
T14CD68C070496446CD3BF2BBD87FA1009EE9234D40B6463EBEDA493B55E63EDC05B9B18
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

3072000

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

CloseHandle LoadResource SetFileAttributesA GetProcAddress GlobalLock LocalFree GetFileSize ExitProcess lstrcpynA GetCurrentProcessId FreeLibrary GetConsoleWindow CreateDirectoryA QueryPerformanceCounter GlobalUnlock IsDebuggerPresent GetComputerNameA CheckRemoteDebuggerPresent FlushFileBuffers GetExitCodeProcess WriteConsoleW CreateFileW GetConsoleMode GetConsoleOutputCP HeapReAlloc HeapSize SetFilePointerEx GlobalAlloc SetStdHandle GetProcessHeap ResumeThread LoadLibraryExW VirtualProtect FreeEnvironmentStringsW GetEnvironmentStringsW WideCharToMultiByte MultiByteToWideChar GetCommandLineW GetCommandLineA GetCPInfo GetOEMCP GetACP IsValidCodePage FindNextFileW DeleteFileA LockResource GetSystemDirectoryA GetCurrentThread CreateFileA GetFileAttributesA GetTickCount64 Sleep GetSystemWindowsDirectoryA GetStringTypeW GetModuleHandleA WaitForSingleObject GetVolumeInformationA GetEnvironmentVariableA FindResourceA SetFilePointer SetThreadPriority GetProcessId WriteFile FindFirstFileExW GetCurrentProcess GetFileSizeEx SizeofResource FindClose GetFileType HeapAlloc HeapFree UnhandledExceptionFilter RtlVirtualUnwind RtlCaptureContext IsProcessorFeaturePresent GetStdHandle GetModuleFileNameW GetModuleHandleExW TerminateProcess DeleteCriticalSection InitializeCriticalSectionEx LeaveCriticalSection EnterCriticalSection LCMapStringW ReadFile ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW SetUnhandledExceptionFilter GetStartupInfoW GetModuleHandleW GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead RtlLookupFunctionEntry RtlUnwindEx RtlPcToFileHeader RaiseException GetLastError SetLastError FlsAlloc FlsGetValue FlsSetValue FlsFree EncodePointer

user32

EnableWindow EndPaint GetNextDlgTabItem BeginPaint InvalidateRect UpdateWindow RegisterClassExA PtInRect GetParent PostQuitMessage KillTimer GetClientRect LoadIconA SendMessageA GetMessageA DispatchMessageA GetWindowRect LoadCursorA DestroyWindow FillRect GetSystemMetrics ShowWindow SetTimer DrawTextA GetWindowTextA MapWindowPoints TrackMouseEvent FrameRect SetWindowTextA IsWindowEnabled DefWindowProcA CreateWindowExA SetFocus TranslateMessage

gdi32

CreateFontA SelectObject SetTextColor SetBkMode LineTo CreatePen MoveToEx SetBkColor DeleteObject CreateSolidBrush

advapi32

CryptGenRandom CryptGetHashParam CryptDestroyHash CryptHashData CryptCreateHash CryptAcquireContextA CryptReleaseContext

ole32

CreateStreamOnHGlobal

comctl32

ord410 ord413

gdiplus

GdiplusStartup GdipLoadImageFromStream GdipDeleteGraphics GdipCreateFromHDC GdipFree GdipSetPixelOffsetMode GdipSetInterpolationMode GdipDisposeImage GdipDrawImageRectI GdipAlloc GdipCloneImage GdiplusShutdown

shlwapi

StrStrIA

crypt32

CryptProtectData

Name

.text

Size

171KB

Virtual Size

171KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

2.6MB

Virtual Size

2.6MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

7KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

89KB

Virtual Size

89KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.data1

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.voltbl

Size

10.0MB

Virtual Size

10.0MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.pdata1

Size

222KB

Virtual Size

222KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-16_ef9b6b045eb4161643d8fb3f580f8c80_icedid_njrat

kernel32

user32

gdi32

advapi32

ole32

comctl32

gdiplus

shlwapi

crypt32

generic