2026-09-28_eb6b0cd52679750f3c3268caed16607c_icedid_njrat

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-28_eb6b0cd52679750f3c3268caed16607c_icedid_njrat
Size 1.1MB
Sample260928-2ec1hsverc
SHA256 fb59d1627b21819c1383da47e8f616d347ae63d09cfa799231e61ba2b53ecbd5
MD5 eb6b0cd52679750f3c3268caed16607c
SHA1 a8bcbf96b0d8fac6107bf6f77422451d5d4ed906
SHA512 9fb0035c7a137a3720b8f376378fbfa14460e6dbc2badb33a01af7cbf5a97d55f8f924bb7121fd3b8639bd149da5d9ad9e92b1db8c4f89bbd9128d317b10a239
SSDEEP 12288:S4EIrqS6abBct5K4RTKG/Zn35y7RJhL6mRZt5naitN2lsZsyITdgUHXKxa:qIrqbMWpORJhXRZD7VZbITdXH
TLSH
T1A4359E26679492A8F176823D8951C489D6A57C10EBA5CBCF83D0CE570F73AD08E7A3F1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-28_eb6b0cd52679750f3c3268caed16607c_icedid_njrat

File Explorer

2026-09-28_eb6b0cd52679750f3c3268caed16607c_icedid_njrat

.exe 1.1MB

2026-09-28_eb6b0cd52679750f3c3268caed16607c_icedid_njrat

IMPHASH 4f7331f6fa74ee1abab6cca8e0f61b97
SHA256 fb59d1627b21819c1383da47e8f616d347ae63d09cfa799231e61ba2b53ecbd5
MD5 eb6b0cd52679750f3c3268caed16607c
SHA1 a8bcbf96b0d8fac6107bf6f77422451d5d4ed906
SHA512 9fb0035c7a137a3720b8f376378fbfa14460e6dbc2badb33a01af7cbf5a97d55f8f924bb7121fd3b8639bd149da5d9ad9e92b1db8c4f89bbd9128d317b10a239
SSDEEP 12288:S4EIrqS6abBct5K4RTKG/Zn35y7RJhL6mRZt5naitN2lsZsyITdgUHXKxa:qIrqbMWpORJhXRZD7VZbITdXH
TLSH
T1A4359E26679492A8F176823D8951C489D6A57C10EBA5CBCF83D0CE570F73AD08E7A3F1
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

929000

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

FreeLibrary CreateFileMappingW MapViewOfFile LoadLibraryExW QueryDosDeviceW FindFirstFileW FindNextFileW DeviceIoControl FindClose GetFileAttributesExW GetWindowsDirectoryW LocalFree ReadFile GetFileSizeEx ResumeThread RtlAddFunctionTable LoadLibraryA VirtualAllocEx CreateRemoteThread VirtualFreeEx GetExitCodeProcess QueryFullProcessImageNameW GetVolumeInformationW GetModuleHandleA GetTickCount64 VirtualFree VirtualAlloc UnmapViewOfFile SetConsoleCtrlHandler ExitProcess SetFileAttributesW GetConsoleMode MoveFileExW GetTempFileNameW GetSystemTimeAsFileTime WriteConsoleW GetSystemDirectoryW FlushFileBuffers GetTickCount Process32FirstW Process32NextW CreateToolhelp32Snapshot CreateFileW SetFilePointer SetFileTime WriteFile ReadProcessMemory VirtualProtectEx LoadLibraryW Sleep OpenProcess WriteProcessMemory CreateProcessW GetCurrentProcessId WaitForSingleObject GetModuleFileNameW GetStdHandle SetConsoleTextAttribute GetConsoleScreenBufferInfo WideCharToMultiByte DeleteFileW GetLastError MultiByteToWideChar GetFileAttributesW GetTempPathW CheckRemoteDebuggerPresent IsDebuggerPresent GetModuleHandleW GetProcAddress HeapSize ReadConsoleW GetProcessHeap SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP RtlUnwind GetACP IsValidCodePage SetFilePointerEx SetStdHandle HeapReAlloc GetConsoleOutputCP EnumSystemLocalesW GetUserDefaultLCID IsValidLocale CloseHandle TerminateProcess GetCurrentProcess RaiseException GetSystemInfo VirtualProtect VirtualQuery LoadLibraryExA FormatMessageA GetLocaleInfoEx CreateDirectoryW FindFirstFileExW AreFileApisANSI GetFileInformationByHandleEx QueryPerformanceCounter QueryPerformanceFrequency GetStringTypeW GetCurrentThreadId EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer LCMapStringEx CompareStringEx GetCPInfo ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent InitializeSListHead RtlUnwindEx RtlPcToFileHeader SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree GetModuleHandleExW GetCommandLineA GetCommandLineW HeapFree HeapAlloc GetFileType FlsAlloc FlsGetValue FlsSetValue FlsFree CompareStringW LCMapStringW GetLocaleInfoW

advapi32

StartServiceW OpenProcessToken CreateWellKnownSid EqualSid GetSidSubAuthorityCount GetSidSubAuthority CreateProcessAsUserW DuplicateTokenEx ConvertSidToStringSidW RegSetKeySecurity ConvertStringSecurityDescriptorToSecurityDescriptorW AllocateAndInitializeSid SetEntriesInAclW SetNamedSecurityInfoW GetNamedSecurityInfoW FreeSid CreateServiceW GetTokenInformation OpenServiceW LookupPrivilegeValueW AdjustTokenPrivileges RegCloseKey RegDeleteKeyW RegCreateKeyExW RegEnumKeyExW RegSetValueExW RegOpenKeyExW RegQueryValueExW QueryServiceStatus CloseServiceHandle OpenSCManagerW RegDeleteTreeW

shell32

ShellExecuteExW

user32

WaitForInputIdle

ntdll

RtlLookupFunctionEntry RtlVirtualUnwind RtlCaptureContext

winhttp

WinHttpSetOption WinHttpAddRequestHeaders WinHttpSendRequest WinHttpSetTimeouts WinHttpOpenRequest WinHttpReadData WinHttpOpen WinHttpReceiveResponse WinHttpCloseHandle WinHttpConnect

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-28_eb6b0cd52679750f3c3268caed16607c_icedid_njrat

kernel32

advapi32

shell32

user32

ntdll

winhttp

generic