2026-09-24_ed6b084a67813913c92ffce5a861747b_icedid_njrat

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-24_ed6b084a67813913c92ffce5a861747b_icedid_njrat
Size 2.6MB
Sample260924-wwmndsys9j
SHA256 48c14c8df6edcb22bcce5401e237de6ea4345d3681224dc8b397ff3dd7fe9fe0
MD5 ed6b084a67813913c92ffce5a861747b
SHA1 82844f2c19d700400c228fbc407364d55f36b7a5
SHA512 9c0a48785abb7f338fedecba27c1d8dc7f01c2d56e8d286b95281737fc8d42afbaf9070e1a8c09378165b15797f379b6f46266627186b2a6de0ef880b246de30
SSDEEP 49152:sPrtHMd4IdbSVAeuR2E+PKkdpJOtk0F/5ZyaqF49aK4aS7ND4o4Nq8niT:+Md4INuA1KK5kE/ryf8aH7p4omHiT
TLSH
T150C52303FE418DC9D8A7497CCC1006516F129D510BE29F8E639FCA2E7F5A4468F7AA1E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-24_ed6b084a67813913c92ffce5a861747b_icedid_njrat

File Explorer

2026-09-24_ed6b084a67813913c92ffce5a861747b_icedid_njrat

.exe 2.6MB

2026-09-24_ed6b084a67813913c92ffce5a861747b_icedid_njrat

IMPHASH d00af9fff8d0b640ca543045c4cf548e
SHA256 48c14c8df6edcb22bcce5401e237de6ea4345d3681224dc8b397ff3dd7fe9fe0
MD5 ed6b084a67813913c92ffce5a861747b
SHA1 82844f2c19d700400c228fbc407364d55f36b7a5
SHA512 9c0a48785abb7f338fedecba27c1d8dc7f01c2d56e8d286b95281737fc8d42afbaf9070e1a8c09378165b15797f379b6f46266627186b2a6de0ef880b246de30
SSDEEP 49152:sPrtHMd4IdbSVAeuR2E+PKkdpJOtk0F/5ZyaqF49aK4aS7ND4o4Nq8niT:+Md4INuA1KK5kE/ryf8aH7p4omHiT
TLSH
T150C52303FE418DC9D8A7497CCC1006516F129D510BE29F8E639FCA2E7F5A4468F7AA1E
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2744320

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

OutputDebugStringA LockFile SetFilePointer GetFullPathNameA SetEndOfFile UnlockFileEx GetTempPathW CreateMutexW WaitForSingleObject CreateFileW GetFileAttributesW UnmapViewOfFile HeapValidate HeapSize MultiByteToWideChar Sleep GetTempPathA FormatMessageW GetDiskFreeSpaceA GetLastError GetFileAttributesA GetFileAttributesExW OutputDebugStringW FlushViewOfFile CreateFileA WaitForSingleObjectEx DeleteFileA DeleteFileW HeapReAlloc CloseHandle GetNativeSystemInfo RaiseException GetSystemInfo HeapAlloc HeapCompact HeapDestroy UnlockFile LocalFree LockFileEx GetFileSize GetCurrentProcessId GetProcessHeap SystemTimeToFileTime GetModuleHandleW WideCharToMultiByte GetSystemTimeAsFileTime GetSystemTime FormatMessageA CreateFileMappingW MapViewOfFile QueryPerformanceCounter GetTickCount FlushFileBuffers GetFileSizeEx GetDiskFreeSpaceW SetEnvironmentVariableW GetEnvironmentVariableW GetSystemDirectoryW GetTickCount64 LoadLibraryW ExitProcess VirtualAlloc TerminateProcess CreateThread QueueUserAPC GetThreadId FlushInstructionCache GetVolumeInformationW GetComputerNameW GetModuleHandleA LoadLibraryA lstrcatW GetProcAddress lstrcpyW lstrcmpiW GetCommandLineW WaitForMultipleObjects GetTempFileNameW FreeLibrary SetDllDirectoryW LoadLibraryExW FindFirstFileW FindNextFileW FindClose QueryFullProcessImageNameW GetLocaleInfoEx GetTimeZoneInformation GetLogicalProcessorInformation GlobalMemoryStatusEx EnterCriticalSection LeaveCriticalSection InitializeCriticalSection GlobalLock GlobalUnlock WriteConsoleW SetStdHandle FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetOEMCP GetACP IsValidCodePage EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW WriteFile GetFullPathNameW AreFileApisANSI HeapFree HeapCreate ReadFile GetCurrentProcess LCMapStringW CompareStringW FlsFree FlsSetValue FlsGetValue FlsAlloc GetConsoleMode GetConsoleOutputCP SetFilePointerEx GetFileType GetStdHandle GetModuleFileNameW GetModuleHandleExW TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount SetLastError RtlPcToFileHeader RtlUnwindEx GetStringTypeW GetCPInfo CompareStringEx DecodePointer EncodePointer DeleteCriticalSection InitializeCriticalSectionEx RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW IsDebuggerPresent GetStartupInfoW GetCurrentThreadId InitializeSListHead FindFirstFileExW GetFileInformationByHandleEx LCMapStringEx

user32

DefWindowProcW GetMessageW DestroyWindow CreateWindowExW RemoveClipboardFormatListener AddClipboardFormatListener PostQuitMessage GetSystemMetrics DispatchMessageW RegisterClassExW TranslateMessage

advapi32

RegCloseKey RegOpenKeyExW RegQueryValueExW ImpersonateSelf GetUserNameW RevertToSelf

shell32

SHGetKnownFolderPath SHGetFolderPathW

ole32

CoUninitialize CoCreateInstance CoSetProxyBlanket CoInitializeEx CoTaskMemFree

oleaut32

SysAllocStringByteLen SysStringByteLen SysFreeString

bcrypt

BCryptDestroyKey BCryptImportKeyPair BCryptCloseAlgorithmProvider BCryptSecretAgreement BCryptEncrypt BCryptGetProperty BCryptOpenAlgorithmProvider BCryptGenRandom BCryptFinishHash BCryptDestroyHash BCryptHashData BCryptDeriveKey BCryptSetProperty BCryptCreateHash BCryptGenerateSymmetricKey BCryptFinalizeKeyPair BCryptGenerateKeyPair BCryptDestroySecret BCryptExportKey

Name

.text

Size

2.2MB

Virtual Size

2.2MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

293KB

Virtual Size

296KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.data

Size

19KB

Virtual Size

60KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

76KB

Virtual Size

80KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.init

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

5KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-24_ed6b084a67813913c92ffce5a861747b_icedid_njrat

kernel32

user32

advapi32

shell32

ole32

oleaut32

bcrypt

generic