2026-09-22_072f21941efa1b173cc58d1cc43c55fe_icedid_njrat

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-22_072f21941efa1b173cc58d1cc43c55fe_icedid_njrat
Size 2.6MB
Sample260922-2pp3tshb43
SHA256 58032a8d42487c94a2cd308681f3f01bbc4775be5b2969a4b771908165bbc27d
MD5 072f21941efa1b173cc58d1cc43c55fe
SHA1 f80b910d03d67bab76acda73d52ebe5e570c891d
SHA512 593dee72effe2a30a057222fd3166ec4533b729b5539b7a302c4f571a75f9d60949ff1a84409415f5bc7d52e5fb52cdce975dccc33c1f17861ceb41361156007
SSDEEP 49152:dbcD7qhLGckkgzQZXIBUpNvllSjOoJjV+P/wbUdauokRYilSaHD+txGFSUix:dbcCRGcxXIBOVllSpJjwP/kkRdlV6K0b
TLSH
T1A1C52342FE0189CADDA749BC8D000B546A11ED410F919F8E5B87C61A7F4784BCFAEA5F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-22_072f21941efa1b173cc58d1cc43c55fe_icedid_njrat

File Explorer

2026-09-22_072f21941efa1b173cc58d1cc43c55fe_icedid_njrat

.exe 2.6MB

2026-09-22_072f21941efa1b173cc58d1cc43c55fe_icedid_njrat

IMPHASH d00af9fff8d0b640ca543045c4cf548e
SHA256 58032a8d42487c94a2cd308681f3f01bbc4775be5b2969a4b771908165bbc27d
MD5 072f21941efa1b173cc58d1cc43c55fe
SHA1 f80b910d03d67bab76acda73d52ebe5e570c891d
SHA512 593dee72effe2a30a057222fd3166ec4533b729b5539b7a302c4f571a75f9d60949ff1a84409415f5bc7d52e5fb52cdce975dccc33c1f17861ceb41361156007
SSDEEP 49152:dbcD7qhLGckkgzQZXIBUpNvllSjOoJjV+P/wbUdauokRYilSaHD+txGFSUix:dbcCRGcxXIBOVllSpJjwP/kkRdlV6K0b
TLSH
T1A1C52342FE0189CADDA749BC8D000B546A11ED410F919F8E5B87C61A7F4784BCFAEA5F
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2744320

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

OutputDebugStringA LockFile SetFilePointer GetFullPathNameA SetEndOfFile UnlockFileEx GetTempPathW CreateMutexW WaitForSingleObject CreateFileW GetFileAttributesW UnmapViewOfFile HeapValidate HeapSize MultiByteToWideChar Sleep GetTempPathA FormatMessageW GetDiskFreeSpaceA GetLastError GetFileAttributesA GetFileAttributesExW OutputDebugStringW FlushViewOfFile CreateFileA WaitForSingleObjectEx DeleteFileA DeleteFileW HeapReAlloc CloseHandle GetNativeSystemInfo RaiseException GetSystemInfo HeapAlloc HeapCompact HeapDestroy UnlockFile LocalFree LockFileEx GetFileSize GetCurrentProcessId GetProcessHeap SystemTimeToFileTime GetModuleHandleW WideCharToMultiByte GetSystemTimeAsFileTime GetSystemTime FormatMessageA CreateFileMappingW MapViewOfFile QueryPerformanceCounter GetTickCount FlushFileBuffers GetFileSizeEx GetDiskFreeSpaceW SetEnvironmentVariableW GetEnvironmentVariableW GetSystemDirectoryW GetTickCount64 LoadLibraryW ExitProcess VirtualAlloc TerminateProcess CreateThread QueueUserAPC GetThreadId FlushInstructionCache GetVolumeInformationW GetComputerNameW GetModuleHandleA LoadLibraryA lstrcatW GetProcAddress lstrcpyW lstrcmpiW GetCommandLineW WaitForMultipleObjects GetTempFileNameW FreeLibrary SetDllDirectoryW LoadLibraryExW FindFirstFileW FindNextFileW FindClose QueryFullProcessImageNameW GetLocaleInfoEx GetTimeZoneInformation GetLogicalProcessorInformation GlobalMemoryStatusEx EnterCriticalSection LeaveCriticalSection InitializeCriticalSection GlobalLock GlobalUnlock WriteConsoleW SetStdHandle FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetOEMCP GetACP IsValidCodePage EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW WriteFile GetFullPathNameW AreFileApisANSI HeapFree HeapCreate ReadFile GetCurrentProcess LCMapStringW CompareStringW FlsFree FlsSetValue FlsGetValue FlsAlloc GetConsoleMode GetConsoleOutputCP SetFilePointerEx GetFileType GetStdHandle GetModuleFileNameW GetModuleHandleExW TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount SetLastError RtlPcToFileHeader RtlUnwindEx GetStringTypeW GetCPInfo CompareStringEx DecodePointer EncodePointer DeleteCriticalSection InitializeCriticalSectionEx RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW IsDebuggerPresent GetStartupInfoW GetCurrentThreadId InitializeSListHead FindFirstFileExW GetFileInformationByHandleEx LCMapStringEx

user32

DefWindowProcW GetMessageW DestroyWindow CreateWindowExW RemoveClipboardFormatListener AddClipboardFormatListener PostQuitMessage GetSystemMetrics DispatchMessageW RegisterClassExW TranslateMessage

advapi32

RegCloseKey RegOpenKeyExW RegQueryValueExW ImpersonateSelf GetUserNameW RevertToSelf

shell32

SHGetKnownFolderPath SHGetFolderPathW

ole32

CoUninitialize CoCreateInstance CoSetProxyBlanket CoInitializeEx CoTaskMemFree

oleaut32

SysAllocStringByteLen SysStringByteLen SysFreeString

bcrypt

BCryptDestroyKey BCryptImportKeyPair BCryptCloseAlgorithmProvider BCryptSecretAgreement BCryptEncrypt BCryptGetProperty BCryptOpenAlgorithmProvider BCryptGenRandom BCryptFinishHash BCryptDestroyHash BCryptHashData BCryptDeriveKey BCryptSetProperty BCryptCreateHash BCryptGenerateSymmetricKey BCryptFinalizeKeyPair BCryptGenerateKeyPair BCryptDestroySecret BCryptExportKey

Name

.text

Size

2.2MB

Virtual Size

2.2MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

293KB

Virtual Size

296KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.data

Size

19KB

Virtual Size

60KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

76KB

Virtual Size

80KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.init

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

5KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-22_072f21941efa1b173cc58d1cc43c55fe_icedid_njrat

kernel32

user32

advapi32

shell32

ole32

oleaut32

bcrypt

generic