2026-09-24_3c737574927e80d32379e6ae127ddb5d_icedid_njrat_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-24_3c737574927e80d32379e6ae127ddb5d_icedid_njrat_stealc
Size 4.0MB
Sample260925-nsqa4sdg56
SHA256 00bd7c016ee4253078e4c712824848349b7c152f07a439cc185817a95ee866e2
MD5 3c737574927e80d32379e6ae127ddb5d
SHA1 7328891c67f45e9842937127b0df5ee25d2c2bb9
SHA512 cbab37b1a906f486e89b8329184da2ee7dcdb2a1dec5310773b75fb87ee23641f06c7f7c5a7da113a1823ddab7149f0194187ec259817f55f3978c0cd91e1c75
SSDEEP 49152:f5pyDO0lJQfeNiQIug+q+fCy18jq2oyLuB+GtqgfPSI181VcFc1BOfOgi+2RWg8v:qnlJ/Ueaq2oyLuB+GtqgfPSGW
TLSH
T13316AE26F65041E4C0B25075E91B6A03EB753C68072086C396B4735D2FBBBA07F7EB96
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-24_3c737574927e80d32379e6ae127ddb5d_icedid_njrat_stealc

File Explorer

2026-09-24_3c737574927e80d32379e6ae127ddb5d_icedid_njrat_stealc

.exe 4.0MB

2026-09-24_3c737574927e80d32379e6ae127ddb5d_icedid_njrat_stealc

IMPHASH 2ae5b05e4c1e7037f3cb1799d4651b06
SHA256 00bd7c016ee4253078e4c712824848349b7c152f07a439cc185817a95ee866e2
MD5 3c737574927e80d32379e6ae127ddb5d
SHA1 7328891c67f45e9842937127b0df5ee25d2c2bb9
SHA512 cbab37b1a906f486e89b8329184da2ee7dcdb2a1dec5310773b75fb87ee23641f06c7f7c5a7da113a1823ddab7149f0194187ec259817f55f3978c0cd91e1c75
SSDEEP 49152:f5pyDO0lJQfeNiQIug+q+fCy18jq2oyLuB+GtqgfPSI181VcFc1BOfOgi+2RWg8v:qnlJ/Ueaq2oyLuB+GtqgfPSGW
TLSH
T13316AE26F65041E4C0B25075E91B6A03EB753C68072086C396B4735D2FBBBA07F7EB96
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1470704

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\KaBoS\Desktop\Nova\developer\obj\Nova\Release\Nova.pdb

d3d11

D3D11CreateDevice

dcomp

DCompositionCreateDevice

dwmapi

DwmSetWindowAttribute DwmGetWindowAttribute

advapi32

RevertToSelf CreateServiceW DeleteService ControlService EnumServicesStatusExW QueryServiceConfigW LookupPrivilegeValueW AdjustTokenPrivileges RegCloseKey RegQueryValueExW QueryServiceStatusEx DuplicateTokenEx OpenServiceW ChangeServiceConfigW RegOpenKeyExW StartServiceW OpenProcessToken RegSetValueExW ImpersonateLoggedOnUser RegCreateKeyExW OpenSCManagerW CloseServiceHandle QueryServiceStatus

windowscodecs

WICConvertBitmapSource

ole32

CoUninitialize CoCreateInstance CoInitializeEx CoTaskMemFree

kernel32

GetCurrentProcess GetModuleFileNameW SetEnvironmentVariableW GetEnvironmentVariableW GetTempPathW WaitForSingleObject OpenProcess SetFileAttributesW Sleep GetProcAddress CreateProcessW GetModuleHandleW QueryFullProcessImageNameW GetExitCodeProcess CreateDirectoryW FindFirstFileW SetPriorityClass FindNextFileW DeviceIoControl SetThreadPriority CreateMutexW FindClose GetCurrentThreadId CreateToolhelp32Snapshot MultiByteToWideChar FormatMessageW GetTickCount64 Process32NextW GetCurrentThread WaitForSingleObjectEx GetThreadPriority Process32FirstW LocalFree WideCharToMultiByte GetThreadTimes QueryPerformanceCounter MulDiv K32EnumDeviceDrivers K32GetDeviceDriverFileNameW GetSystemDirectoryW UnmapViewOfFile LoadLibraryW GetWindowsDirectoryW FreeLibrary CreateFileMappingW MapViewOfFile GetTickCount SetFileInformationByHandle SizeofResource LockResource LoadResource FindResourceW GetSystemInfo OutputDebugStringA GlobalAlloc GlobalFree GlobalLock GlobalUnlock GetModuleHandleA GetLocaleInfoA LoadLibraryA QueryPerformanceFrequency IsDBCSLeadByte VerSetConditionMask ReadConsoleW GetConsoleMode GetConsoleOutputCP EnumSystemLocalesW SetLastError IsValidLocale GetLocaleInfoW LCMapStringW VirtualProtect FlsFree FlsSetValue FlsGetValue FlsAlloc GetFileType HeapAlloc HeapFree GetStdHandle ExitProcess GetModuleHandleExW FreeLibraryAndExitThread ExitThread CreateThread LoadLibraryExW TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount RaiseException RtlPcToFileHeader RtlUnwindEx InitializeSListHead GetStartupInfoW IsDebuggerPresent IsProcessorFeaturePresent TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext GetCPInfo GetStringTypeW LCMapStringEx DecodePointer EncodePointer DeleteCriticalSection LeaveCriticalSection EnterCriticalSection GetSystemTimeAsFileTime InitializeCriticalSectionEx GetFileInformationByHandleEx FlushFileBuffers GetCurrentProcessId MoveFileExW SetFilePointerEx CloseHandle DeleteFileW RtlUnwind GetLastError GetFileAttributesW CreateFileW WriteFile GetFileSizeEx ReadFile HeapReAlloc IsValidCodePage GetACP GetOEMCP GetCommandLineA GetFileAttributesExW FindFirstFileExW GetExitCodeThread TryAcquireSRWLockExclusive AcquireSRWLockExclusive ReleaseSRWLockExclusive SleepConditionVariableSRW WakeAllConditionVariable WakeConditionVariable GetCommandLineW GetEnvironmentStringsW GetFullPathNameW FreeEnvironmentStringsW GetProcessHeap SetStdHandle HeapSize WriteConsoleW SetEndOfFile GetUserDefaultLCID

user32

MapVirtualKeyW GetWindowRect MessageBoxW IsIconic GetAncestor SetForegroundWindow UpdateWindow PostQuitMessage GetClientRect LoadCursorW DestroyWindow TranslateMessage SetLayeredWindowAttributes EnumWindows GetForegroundWindow MsgWaitForMultipleObjectsEx PeekMessageW EnumDisplaySettingsExW ClientToScreen AdjustWindowRectEx DefWindowProcW GetWindowThreadProcessId GetWindowLongPtrW IsWindowVisible SetWindowPos EqualRect MonitorFromWindow SetWindowRgn GetWindow LoadIconW OpenClipboard EndPaint BeginPaint InvalidateRect GetDpiForSystem SystemParametersInfoW KillTimer DrawTextW SetTimer SendMessageW FillRect SetWindowLongPtrW PostMessageW GetMonitorInfoW DispatchMessageW GetCapture GetAsyncKeyState GetKeyNameTextA IsWindow ShowWindow RegisterClassExW UnregisterClassW GetMessageW GetKeyState GetMessageExtraInfo ScreenToClient TrackMouseEvent GetKeyboardLayout SetCapture SetCursor SetProcessDPIAware IsWindowUnicode ReleaseCapture SetCursorPos GetCursorPos SetClipboardData CloseClipboard EmptyClipboard GetClipboardData CreateWindowExW

gdi32

RoundRect CreateRoundRectRgn CreateSolidBrush CreatePen Ellipse BitBlt CreateCompatibleBitmap SelectObject CreateCompatibleDC CreateFontW GetStockObject DeleteDC SetTextColor SetBkMode LineTo MoveToEx DeleteObject

dbghelp

SymUnloadModule64 ImageRvaToVa SymLoadModuleExW SymSetOptions SymFromNameW SymInitializeW SymGetOptions SymCleanup

winhttp

WinHttpConnect WinHttpSetTimeouts WinHttpSendRequest WinHttpCloseHandle WinHttpSetOption WinHttpOpenRequest WinHttpReadData WinHttpQueryHeaders WinHttpOpen WinHttpReceiveResponse WinHttpCrackUrl

shlwapi

PathIsDirectoryW PathFileExistsW

shell32

SHCreateDirectoryExW SHFileOperationW ShellExecuteW SHGetKnownFolderPath

cabinet

ord22 ord23 ord20

bcrypt

BCryptFinishHash BCryptGenRandom BCryptOpenAlgorithmProvider BCryptGetProperty BCryptGenerateSymmetricKey BCryptSetProperty BCryptDecrypt BCryptDestroyKey BCryptCreateHash BCryptHashData BCryptDestroyHash BCryptCloseAlgorithmProvider

gdiplus

GdipSetPenLineJoin GdipCreateFromHDC GdiplusStartup GdipDrawEllipse GdipSetPixelOffsetMode GdipDeletePen GdipCreatePen1 GdipSetPenEndCap GdipDrawLine GdipCreatePath GdipSetSmoothingMode GdipDeletePath GdipAddPathLine2 GdipSetPenStartCap GdipDrawPath GdipSetCompositingQuality GdipDeleteGraphics GdiplusShutdown

imm32

ImmSetCompositionWindow ImmReleaseContext ImmGetContext ImmSetCandidateWindow

d3dcompiler_47

D3DCompile

Name

.text

Size

1.6MB

Virtual Size

1.6MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.2MB

Virtual Size

1.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

19KB

Virtual Size

346KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

60KB

Virtual Size

59KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1.0MB

Virtual Size

1.0MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

35KB

Virtual Size

34KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-24_3c737574927e80d32379e6ae127ddb5d_icedid_njrat_stealc

d3d11

dcomp

dwmapi

advapi32

windowscodecs

ole32

kernel32

user32

gdi32

dbghelp

winhttp

shlwapi

shell32

cabinet

bcrypt

gdiplus

imm32

d3dcompiler_47

generic