2026-10-06_64f508afbd2d58200638225018ecabc9_icedid_njrat

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-06_64f508afbd2d58200638225018ecabc9_icedid_njrat
Size 2.7MB
Sample261006-p4z55agy6x
SHA256 797812815d0b76ad2150455168a3b43e7f4c88a0476dfabe7d330abea80ac84c
MD5 64f508afbd2d58200638225018ecabc9
SHA1 955fe3a2f8d49613d3b10e7e57fe2688406a09db
SHA512 4899728748c1fa10ad403c7d6c237aeacba331df656dcf46dc4283b564a260ef833b0412712173db9951fce4887e45a80b9fc9e5dc56a0ba8b39fd2a59d23e8c
SSDEEP 24576:iVXNjE5nL3hXjM0Y9EVGh6WpROMD+J89ukVLxuISvx8RR90t:AXRE5hpVGh5Rj+bkVexGRut
TLSH
T14DD5F90BF7B621D4E1BAC138D553222AFD7134A6833897DB66C19E061B61BE4ED3E740
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects executables containing commands for clearing Windows Event Logs 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_ClearWinLogs

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-06_64f508afbd2d58200638225018ecabc9_icedid_njrat

File Explorer

2026-10-06_64f508afbd2d58200638225018ecabc9_icedid_njrat

.exe 2.7MB

2026-10-06_64f508afbd2d58200638225018ecabc9_icedid_njrat

IMPHASH f8150461a34ed5769aeee6277137155d
SHA256 797812815d0b76ad2150455168a3b43e7f4c88a0476dfabe7d330abea80ac84c
MD5 64f508afbd2d58200638225018ecabc9
SHA1 955fe3a2f8d49613d3b10e7e57fe2688406a09db
SHA512 4899728748c1fa10ad403c7d6c237aeacba331df656dcf46dc4283b564a260ef833b0412712173db9951fce4887e45a80b9fc9e5dc56a0ba8b39fd2a59d23e8c
SSDEEP 24576:iVXNjE5nL3hXjM0Y9EVGh6WpROMD+J89ukVLxuISvx8RR90t:AXRE5hpVGh5Rj+bkVexGRut
TLSH
T14DD5F90BF7B621D4E1BAC138D553222AFD7134A6833897DB66C19E061B61BE4ED3E740
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects executables containing commands for clearing Windows Event Logs
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

19271

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\User\Desktop\SOURCES MY PROJECTS FOR GAMES\412421414\WintorezCPP\x64\Debug\WintorezLoader.pdb

winhttp

WinHttpCloseHandle WinHttpQueryHeaders WinHttpConnect WinHttpReadData WinHttpQueryDataAvailable WinHttpQueryOption WinHttpSetOption WinHttpOpenRequest WinHttpAddRequestHeaders WinHttpSendRequest WinHttpOpen WinHttpReceiveResponse

bcrypt

BCryptOpenAlgorithmProvider BCryptCloseAlgorithmProvider BCryptCreateHash BCryptHashData BCryptFinishHash BCryptDestroyHash

advapi32

RegSetValueExA SetSecurityDescriptorDacl InitializeSecurityDescriptor FreeSid CheckTokenMembership AllocateAndInitializeSid RegDeleteKeyA RegDeleteValueA RegEnumKeyExA RegEnumValueA RegOpenKeyExA RegQueryValueExA RegCloseKey

comctl32

ord17

comdlg32

GetOpenFileNameA

shell32

SHGetFolderPathA SHBrowseForFolderA SHGetPathFromIDListA ShellExecuteW ShellExecuteA

kernel32

EnumSystemLocalesW GetConsoleOutputCP GetConsoleMode GetFileSizeEx SetFilePointerEx ReadConsoleW GetTimeZoneInformation FindFirstFileExW IsValidCodePage GetACP GetOEMCP GetCommandLineA CompareStringW GetTimeFormatW GetDateFormatW FlsFree FlsSetValue FlsGetValue GetEnvironmentVariableA CreateDirectoryA CreateFileA DeleteFileA DeleteFileW FindClose FindFirstFileA FindFirstFileW FindNextFileA FindNextFileW FlushFileBuffers GetFileAttributesA GetFileSize GetVolumeInformationW ReadFile RemoveDirectoryA SetFileAttributesA SetFilePointer WriteFile GetVolumeInformationA IsDebuggerPresent CheckRemoteDebuggerPresent CloseHandle DuplicateHandle GetLastError QueryPerformanceCounter QueryPerformanceFrequency SetEvent WaitForSingleObject CreateEventA Sleep GetCurrentProcess GetCurrentProcessId ExitProcess TerminateProcess GetExitCodeProcess CreateThread GetCommandLineW OpenThread GetExitCodeThread ResumeThread CreateProcessA CreateProcessW OpenProcess GetTickCount VirtualAllocEx VirtualProtectEx ReadProcessMemory WriteProcessMemory MapViewOfFile VirtualFreeEx UnmapViewOfFile GetModuleFileNameA GetModuleFileNameW GetModuleHandleA GetModuleHandleExA GetProcAddress LoadLibraryA GlobalAlloc GlobalUnlock GlobalLock LocalFree CreateFileMappingA CopyFileA MoveFileA GetComputerNameA MultiByteToWideChar CreateToolhelp32Snapshot Process32FirstW Process32NextW Thread32First Thread32Next Module32FirstW Module32NextW FlsAlloc SetConsoleCtrlHandler WriteConsoleW OutputDebugStringW GetFileType GetProcessHeap HeapQueryInformation HeapReAlloc HeapFree GetFileAttributesExW GetCurrentThread GetStdHandle FreeLibraryAndExitThread LCMapStringW ExitThread GetModuleHandleExW GetSystemInfo HeapValidate HeapSize HeapAlloc LoadLibraryExW FreeLibrary TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount SetLastError InterlockedFlushSList InterlockedPushEntrySList RtlUnwindEx RaiseException RtlPcToFileHeader InitializeSListHead GetStartupInfoW IsProcessorFeaturePresent SetUnhandledExceptionFilter GetUserDefaultLCID GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle CreateFileW SetEndOfFile CreateRemoteThread RtlUnwind IsValidLocale GetLocaleInfoW UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext GetCPInfo CompareStringEx GetStringTypeW WaitForSingleObjectEx SwitchToThread GetCurrentThreadId GetNativeSystemInfo FormatMessageA WideCharToMultiByte EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive WakeConditionVariable WakeAllConditionVariable SleepConditionVariableSRW GetLocaleInfoEx EncodePointer DecodePointer LCMapStringEx SetFileInformationByHandle GetTempPathW InitOnceExecuteOnce CreateEventExW CreateSemaphoreExW FlushProcessWriteBuffers GetCurrentProcessorNumber GetSystemTimeAsFileTime GetTickCount64 FreeLibraryWhenCallbackReturns CreateThreadpoolTimer SetThreadpoolTimer WaitForThreadpoolTimerCallbacks CloseThreadpoolTimer CreateThreadpoolWait SetThreadpoolWait CloseThreadpoolWait GetModuleHandleW GetFileInformationByHandleEx CreateSymbolicLinkW

user32

UpdateWindow DrawTextA GetSystemMetrics EnableWindow KillTimer SetTimer EmptyClipboard SetClipboardData CloseClipboard OpenClipboard SetWindowTextA GetDlgItemTextA SetDlgItemTextA GetDlgItem IsWindowVisible SetWindowDisplayAffinity DestroyWindow CreateWindowExA RegisterClassA PostQuitMessage DefWindowProcA PostMessageW SendMessageW UnregisterHotKey RegisterHotKey DispatchMessageW TranslateMessage GetMessageW MessageBoxA InvalidateRect FillRect EnumWindows GetWindowThreadProcessId LoadCursorW GetDlgCtrlID ShowWindow

gdi32

SetBkMode CreateFontA CreateSolidBrush DeleteObject SelectObject SetBkColor SetTextColor

ole32

CoTaskMemFree

setupapi

SetupDiSetClassInstallParamsA SetupDiGetDeviceRegistryPropertyA SetupDiCallClassInstaller SetupDiGetClassDevsA SetupDiDestroyDeviceInfoList SetupDiEnumDeviceInfo

Name

.text

Size

2.2MB

Virtual Size

2.2MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

468KB

Virtual Size

467KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

11KB

Virtual Size

23KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

86KB

Virtual Size

85KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

13KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

1024B

Virtual Size

777B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.00cfg

Size

512B

Virtual Size

373B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

12KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-06_64f508afbd2d58200638225018ecabc9_icedid_njrat

winhttp

bcrypt

advapi32

comctl32

comdlg32

shell32

kernel32

user32

gdi32

ole32

setupapi

generic