2026-10-10_c343ce41be320e90684a88d40ae0f986_icedid_njrat

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-10_c343ce41be320e90684a88d40ae0f986_icedid_njrat
Size 3.4MB
Sample261011-dn95lsds8m
SHA256 8dd772c29f511057c37684dcbcd74d845a2d90f10ab529d4a23dfd57035b6bc3
MD5 c343ce41be320e90684a88d40ae0f986
SHA1 d51b38a7c272fad2c2f84543bde1ac6e4beb75be
SHA512 2164709d24bf3abbdf8b91e8f8bc2f1778fd52254268133fc180b23ff0dff779b9fe62f7e57d9b4d99c5d716b7cc65e76eda65c1d68b844804117fd1248e1919
SSDEEP 49152:Qiw6DXuS/Vw68U9Zx/Y3pkU/1TgzFCK5kJZPMarSj8RoTCCmWoRGw7uOMkBjxFTS:cyU/veTJTKWbwqOMkJxFuf
TLSH
T10FF5CF5BABA841F4C1BAC17CC983894AF6B178154F719BDF01A1426E1F735E28E3E721
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-10_c343ce41be320e90684a88d40ae0f986_icedid_njrat

File Explorer

2026-10-10_c343ce41be320e90684a88d40ae0f986_icedid_njrat

.exe 3.4MB

2026-10-10_c343ce41be320e90684a88d40ae0f986_icedid_njrat

IMPHASH bd29e11d03682b147c760c5c5f5c9532
SHA256 8dd772c29f511057c37684dcbcd74d845a2d90f10ab529d4a23dfd57035b6bc3
MD5 c343ce41be320e90684a88d40ae0f986
SHA1 d51b38a7c272fad2c2f84543bde1ac6e4beb75be
SHA512 2164709d24bf3abbdf8b91e8f8bc2f1778fd52254268133fc180b23ff0dff779b9fe62f7e57d9b4d99c5d716b7cc65e76eda65c1d68b844804117fd1248e1919
SSDEEP 49152:Qiw6DXuS/Vw68U9Zx/Y3pkU/1TgzFCK5kJZPMarSj8RoTCCmWoRGw7uOMkBjxFTS:cyU/veTJTKWbwqOMkJxFuf
TLSH
T10FF5CF5BABA841F4C1BAC17CC983894AF6B178154F719BDF01A1426E1F735E28E3E721
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1016464

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\qba1\workspace\7113\SSE_Storage_Middleware\RstMwService\output\Release\x64\RstMwService.pdb

api-ms-win-core-synch-l1-1-0

ReleaseSemaphore ReleaseMutex CreateMutexW InitializeCriticalSectionAndSpinCount WaitForSingleObject WaitForSingleObjectEx InitializeCriticalSection CreateMutexA CreateEventA EnterCriticalSection LeaveCriticalSection DeleteCriticalSection CreateEventW ResetEvent TryEnterCriticalSection SetEvent OpenEventA

api-ms-win-core-processthreads-l1-1-0

TlsAlloc GetExitCodeThread TlsSetValue TlsFree SwitchToThread ExitProcess GetCurrentThreadId CreateThread ExitThread TlsGetValue GetCurrentProcess TerminateProcess GetThreadPriority GetCurrentThread GetCurrentProcessId GetStartupInfoW SetThreadPriority

api-ms-win-core-errorhandling-l1-1-0

SetUnhandledExceptionFilter UnhandledExceptionFilter GetLastError SetLastError RaiseException

api-ms-win-core-handle-l1-1-0

CloseHandle DuplicateHandle

api-ms-win-service-core-l1-1-0

StartServiceCtrlDispatcherW SetServiceStatus

api-ms-win-eventing-classicprovider-l1-1-0

GetTraceLoggerHandle GetTraceEnableLevel RegisterTraceGuidsW GetTraceEnableFlags UnregisterTraceGuids TraceMessage

api-ms-win-service-winsvc-l1-1-0

RegisterServiceCtrlHandlerW

setupapi

CM_Reenumerate_DevNode CM_Locate_DevNodeA CM_Locate_DevNodeW CM_Get_Device_ID_List_SizeW CM_Get_Device_ID_ListW CM_Get_DevNode_Status SetupDiRemoveDevice SetupDiGetDeviceInterfaceDetailA SetupDiEnumDeviceInterfaces SetupDiGetDeviceRegistryPropertyA SetupDiDestroyDeviceInfoList SetupDiEnumDeviceInfo SetupDiGetClassDevsA

advapi32

RegDeleteTreeW RegSetValueExW CloseServiceHandle OpenSCManagerW DeregisterEventSource RegisterEventSourceW ReportEventW ControlService EnumDependentServicesW StartServiceW ChangeServiceConfigW OpenServiceW QueryServiceStatusEx InitiateSystemShutdownA RegSetKeyValueW RegCreateKeyExW LookupPrivilegeValueA AdjustTokenPrivileges OpenProcessToken RegDeleteValueA RegCreateKeyExA RegSetValueExA RegQueryValueExA RegOpenKeyExA RegQueryValueExW RegOpenKeyExW RegCloseKey IsValidSid InitializeSid GetTokenInformation AllocateAndInitializeSid FreeSid InitializeSecurityDescriptor SetSecurityDescriptorDacl SetEntriesInAclW OpenThreadToken CopySid EqualSid GetLengthSid GetSidLengthRequired GetSidSubAuthority GetSidSubAuthorityCount

ole32

CoInitializeEx CoReleaseMarshalData CoCreateInstance CoMarshalInterThreadInterfaceInStream CoGetInterfaceAndReleaseStream CoTaskMemFree CoCreateGuid CoUninitialize StringFromGUID2

oleaut32

VariantClear SysAllocString SysFreeString VariantInit

userenv

UnloadUserProfile

api-ms-win-security-base-l1-2-2

DeriveCapabilitySidsFromName

api-ms-win-core-heap-l2-1-0

LocalAlloc LocalFree

rpcrt4

RpcRaiseException NdrServerCall2 RpcBindingVectorFree RpcImpersonateClient RpcServerInqBindings RpcRevertToSelf RpcServerListen RpcServerRegisterIf3 RpcServerUnregisterIf RpcServerUseProtseqEpW I_RpcGetCurrentCallHandle I_RpcBindingInqLocalClientPID RpcMgmtStopServerListening RpcBindingFromStringBindingW RpcStringBindingComposeW RpcEpRegisterW RpcStringFreeW RpcStringFreeA UuidToStringA RpcEpUnregister NdrClientCall3 RpcRevertToSelfEx I_RpcGetBuffer NdrServerInitializeNew NdrConvert NdrComplexStructFree NdrComplexStructBufferSize NdrCorrelationFree NdrCorrelationPass NdrCorrelationInitialize NdrComplexStructMarshall

api-ms-win-core-util-l1-1-0

EncodePointer DecodePointer

api-ms-win-core-heap-l1-1-0

GetProcessHeap HeapDestroy HeapFree HeapReAlloc HeapAlloc HeapSize

api-ms-win-core-timezone-l1-1-0

GetTimeZoneInformation SystemTimeToFileTime FileTimeToSystemTime

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime GetLogicalProcessorInformation GetSystemInfo GetVersionExW GetTickCount GetSystemTime

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleExW FreeLibrary FreeLibraryAndExitThread GetModuleFileNameW GetModuleHandleA LoadLibraryExW GetModuleHandleW GetProcAddress

api-ms-win-core-localization-l1-2-0

FormatMessageW IsValidLocale IsValidCodePage GetACP GetLocaleInfoW GetCPInfo GetOEMCP EnumSystemLocalesW LCMapStringW GetUserDefaultLCID

api-ms-win-core-datetime-l1-1-1

GetTimeFormatEx GetDateFormatEx

api-ms-win-core-synch-l1-2-0

SignalObjectAndWait Sleep

api-ms-win-core-string-obsolete-l1-1-0

lstrlenA

api-ms-win-core-processthreads-l1-1-1

GetThreadTimes OpenProcess IsProcessorFeaturePresent

api-ms-win-appmodel-runtime-l1-1-0

GetPackageId GetPackagePath

api-ms-win-core-path-l1-1-0

PathCchAppend

api-ms-win-core-psapi-l1-1-0

K32GetModuleBaseNameW K32GetModuleFileNameExW

wintrust

WinVerifyTrust

api-ms-win-core-file-l1-1-0

WriteFile FindClose FindNextFileW ReadFile CreateFileW FindFirstFileExW GetDiskFreeSpaceExA GetFinalPathNameByHandleW GetFileType DeleteFileW SetFilePointerEx FlushFileBuffers CreateFileA

api-ms-win-core-io-l1-1-0

DeviceIoControl

api-ms-win-ntuser-sysparams-l1-1-0

GetSystemMetrics

api-ms-win-core-sysinfo-l1-2-0

VerSetConditionMask

api-ms-win-core-kernel32-legacy-l1-1-2

VerifyVersionInfoA

api-ms-win-devices-config-l1-1-1

CM_Get_DevNode_PropertyW

api-ms-win-core-synch-ansi-l1-1-0

OpenMutexA CreateSemaphoreA

api-ms-win-core-synch-l1-2-1

WaitForMultipleObjects

api-ms-win-core-file-l2-1-1

OpenFileById

api-ms-win-core-processenvironment-l1-1-0

SetStdHandle GetStdHandle GetCommandLineA GetEnvironmentStringsW SetEnvironmentVariableW GetCommandLineW FreeEnvironmentStringsW SetEnvironmentVariableA

api-ms-win-core-file-ansi-l1-1-0

QueryDosDeviceA

api-ms-win-core-string-l1-1-0

MultiByteToWideChar GetStringTypeW CompareStringW WideCharToMultiByte

api-ms-win-core-rtlsupport-l1-1-0

RtlVirtualUnwind RtlPcToFileHeader RtlCaptureContext RtlLookupFunctionEntry RtlUnwindEx

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-interlocked-l1-1-0

InterlockedPushEntrySList InterlockedPopEntrySList InterlockedFlushSList InitializeSListHead QueryDepthSList

api-ms-win-core-debug-l1-1-0

IsDebuggerPresent

api-ms-win-core-threadpool-legacy-l1-1-0

ChangeTimerQueueTimer UnregisterWaitEx DeleteTimerQueueTimer CreateTimerQueue CreateTimerQueueTimer

api-ms-win-core-systemtopology-l1-1-0

GetNumaHighestNodeNumber

api-ms-win-core-processtopology-obsolete-l1-1-0

SetThreadAffinityMask GetProcessAffinityMask

api-ms-win-core-kernel32-legacy-l1-1-0

RegisterWaitForSingleObject UnregisterWait

api-ms-win-core-memory-l1-1-0

VirtualFree VirtualProtect VirtualAlloc VirtualQuery

api-ms-win-core-libraryloader-l1-2-1

LoadLibraryW

api-ms-win-core-console-l1-1-0

GetConsoleMode ReadConsoleW GetConsoleCP WriteConsoleW

??0CConsolidatedError@@QEAA@AEBV0@@Z ??0CConsolidatedError@@QEAA@W4ISDI2_ERRORS@CConsolidatedErrorGenerated@@@Z ??0CConsolidatedError@@QEAA@XZ ??0GlobalLogger@@AEAA@XZ ??0ISIAccelerateAction@@QEAA@XZ ??0scoped_c_thread_locale@details@utility@@QEAA@XZ ??0value@json@web@@QEAA@$$QEAV012@@Z ??0value@json@web@@QEAA@AEBV012@@Z ??0value@json@web@@QEAA@H@Z ??0value@json@web@@QEAA@I@Z ??0value@json@web@@QEAA@N@Z ??0value@json@web@@QEAA@PEB_W@Z ??0value@json@web@@QEAA@PEB_W_N@Z ??0value@json@web@@QEAA@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z ??0value@json@web@@QEAA@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@_N@Z ??0value@json@web@@QEAA@XZ ??0value@json@web@@QEAA@_J@Z ??0value@json@web@@QEAA@_K@Z ??0value@json@web@@QEAA@_N@Z ??1CConsolidatedError@@QEAA@XZ ??1GlobalLogger@@QEAA@XZ ??1ISIAccelerateAction@@QEAA@XZ ??1scoped_c_thread_locale@details@utility@@QEAA@XZ ??4CConsolidatedError@@QEAAAEAV0@AEBV0@@Z ??4CConsolidatedErrorGenerated@@QEAAAEAV0@$$QEAV0@@Z ??4CConsolidatedErrorGenerated@@QEAAAEAV0@AEBV0@@Z ??4GlobalLogger@@AEAAAEAV0@$$QEAV0@@Z ??4value@json@web@@QEAAAEAV012@$$QEAV012@@Z ??4value@json@web@@QEAAAEAV012@AEBV012@@Z ??5json@web@@YAAEAV?$basic_istream@_WU?$char_traits@_W@std@@@std@@AEAV23@AEAVvalue@01@@Z ??6json@web@@YAAEAV?$basic_ostream@_WU?$char_traits@_W@std@@@std@@AEAV23@AEBVvalue@01@@Z ??8value@json@web@@QEBA_NAEBV012@@Z ??Avalue@json@web@@AEAAAEAV012@AEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z ??Avalue@json@web@@QEAAAEAV012@AEBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z ??Avalue@json@web@@QEAAAEAV012@_K@Z ??BCConsolidatedError@@QEBA?AU_ISI_Error@@XZ ?AddDebugInformation@CConsolidatedError@@QEAAXPEBDZZ ?AddDebugInformation@CConsolidatedError@@QEAAXPEB_WZZ ?AddErrorMessage@CConsolidatedError@@QEAAXPEBDZZ ?AddErrorMessage@CConsolidatedError@@QEAAXPEB_WZZ ?CleanupIsiError@@YAXI@Z ?CleanupIsiError@@YAXPEAU_ISI_Error@@@Z ?ClearError@CConsolidatedError@@QEAAXXZ ?FreeStringResources@CConsolidatedError@@AEAAXXZ ?GetDebugInformation@CConsolidatedError@@QEBAKPEADH@Z ?GetDebugInformation@CConsolidatedError@@QEBAKPEA_WH@Z ?GetDebugInformation@CConsolidatedError@@QEBAPEBDXZ ?GetErrorCodeString@CConsolidatedError@@QEBAKPEADH@Z ?GetErrorCodeString@CConsolidatedError@@QEBAKPEA_WH@Z ?GetErrorCodeString@CConsolidatedError@@QEBAPEBDXZ ?GetErrorMessage@CConsolidatedError@@QEBAKPEADH@Z ?GetErrorMessage@CConsolidatedError@@QEBAKPEA_WH@Z ?GetErrorMessage@CConsolidatedError@@QEBAPEBDXZ ?GetSrtEolError@CConsolidatedError@@SA?AV1@XZ ?InternalAddDebugInformation@CConsolidatedError@@AEAAXPEBDPEAD@Z ?InternalAddErrorMessage@CConsolidatedError@@AEAAXPEBDPEAD@Z ?IsBusy@CConsolidatedError@@QEBA_NXZ ?IsError@CConsolidatedError@@QEBA_NXZ ?IsPending@CConsolidatedError@@QEBA_NXZ ?IsSuccessful@CConsolidatedError@@QEBA_NXZ ?MAX_ERROR_STRING_SIZE@CConsolidatedError@@2HB ?MapIsiStatus@CConsolidatedError@@AEBA?AW4ISDI2_ERRORS@CConsolidatedErrorGenerated@@W4_ISI_Status@@@Z ?NO_ID@GlobalLogger@@2_KB ?SMALL_STRING_SIZE@CConsolidatedError@@2HB ?SetError@CConsolidatedError@@QEAAXV1@@Z ?SetError@CConsolidatedError@@QEAAXW4ISDI2_ERRORS@CConsolidatedErrorGenerated@@PEBD1@Z ?SetError@CConsolidatedError@@QEAAXW4ISDI2_ERRORS@CConsolidatedErrorGenerated@@PEBD@Z ?SetError@CConsolidatedError@@QEAAXW4ISDI2_ERRORS@CConsolidatedErrorGenerated@@PEB_W1@Z ?SetError@CConsolidatedError@@QEAAXW4ISDI2_ERRORS@CConsolidatedErrorGenerated@@PEB_W@Z ?SetError@CConsolidatedError@@QEAAXW4ISDI2_ERROR_TYPE@1@KPEBD@Z ?SetError@CConsolidatedError@@QEAAXW4ISDI2_ERROR_TYPE@1@KPEB_W@Z ?SetError@CConsolidatedError@@QEAAXW4_ISI_Status@@PEBD1@Z ?SetError@CConsolidatedError@@QEAAXW4_ISI_Status@@PEB_W1@Z ?SetErrorCodeString@CConsolidatedError@@AEAAXXZ ?SetLoggingOff@GlobalLogger@@SAXXZ ?SetLoggingOn@GlobalLogger@@SAXXZ ?__autoclassinit2@CConsolidatedError@@QEAAX_K@Z ?__autoclassinit2@GlobalLogger@@QEAAX_K@Z ?_disableLogging@GlobalLogger@@0_NA ?array@value@json@web@@SA?AV123@V?$vector@Vvalue@json@web@@V?$allocator@Vvalue@json@web@@@std@@@std@@@Z ?array@value@json@web@@SA?AV123@XZ ?array@value@json@web@@SA?AV123@_K@Z ?as_array@value@json@web@@QEAAAEAVarray@23@XZ ?as_array@value@json@web@@QEBAAEBVarray@23@XZ ?as_bool@value@json@web@@QEBA_NXZ ?as_double@value@json@web@@QEBANXZ ?as_integer@value@json@web@@QEBAHXZ ?as_number@value@json@web@@QEBAAEBVnumber@23@XZ ?as_object@value@json@web@@QEAAAEAVobject@23@XZ ?as_object@value@json@web@@QEBAAEBVobject@23@XZ ?as_string@value@json@web@@QEBAAEBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@XZ ?at@value@json@web@@QEAAAEAV123@AEBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z ?at@value@json@web@@QEAAAEAV123@_K@Z ?at@value@json@web@@QEBAAEBV123@AEBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z ?at@value@json@web@@QEBAAEBV123@_K@Z ?boolean@value@json@web@@SA?AV123@_N@Z ?c_locale@scoped_c_thread_locale@details@utility@@SAPEAU__crt_locale_pointers@@XZ ?checkIfDiskPairValid@ISIAccelerateAction@@UEAA?AU_ISI_Error@@IIAEAW4_ISI_NgsaDiskPairStatus@@@Z ?checkIfDiskValid@ISIAccelerateAction@@UEAA?AU_ISI_Error@@IW4_ISI_NgsaDiskConcatenationMember@@AEAW4_ISI_NgsaDiskValidForConcatenationStatus@@@Z ?clean@GlobalLogger@@QEAAX_K@Z ?configDiskAcceleration@ISIAccelerateAction@@UEAA?AU_ISI_Error@@IW4_ISI_NvcMode@@@Z ?configVolumeAcceleration@ISIAccelerateAction@@UEAA?AU_ISI_Error@@IW4_ISI_NvcMode@@@Z ?default_error_condition@windows_category_impl@details@utility@@UEBA?AVerror_condition@std@@H@Z ?doClearBlockCache@ISIAccelerateAction@@UEAA?AU_ISI_Error@@XZ ?doCreateCacheVolumeTask@ISIAccelerateAction@@UEAA?AU_ISI_Error@@I@Z ?doDisassociate@ISIAccelerateAction@@UEAA?AU_ISI_Error@@AEBU_ISI_VolumeInfo@@@Z ?doNgsaAutomation@ISIAccelerateAction@@UEAA?AU_ISI_Error@@AEAI@Z ?doNgsaDisableOneStep@ISIAccelerateAction@@UEAA?AU_ISI_Error@@XZ ?doNgsaEnableOneStep@ISIAccelerateAction@@UEAA?AU_ISI_Error@@XZ ?doNgsaStartTools@ISIAccelerateAction@@UEAA?AU_ISI_Error@@XZ ?doResetVolportPerformanceCounters@ISIAccelerateAction@@UEAA?AU_ISI_Error@@XZ ?doSeparateConcatenation@ISIAccelerateAction@@UEAA?AU_ISI_Error@@I@Z ?doSeparateConcatenation@ISIAccelerateAction@@UEAA?AU_ISI_Error@@XZ ?doSeparateConcatenationNoSync@ISIAccelerateAction@@QEAA?AU_ISI_Error@@XZ ?erase@value@json@web@@QEAAXAEBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z ?erase@value@json@web@@QEAAX_K@Z ?format@value@json@web@@AEBAXAEAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z ?format@value@json@web@@AEBAXAEAV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z ?from_string@datetime@utility@@SA?AV12@AEBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@W4date_format@12@@Z ?generate@nonce_generator@utility@@QEAA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@XZ ?get@GlobalLogger@@SAAEAV1@XZ ?getError@GlobalLogger@@QEAA?AVCConsolidatedError@@_K_N@Z ?getLastError@GlobalLogger@@QEAA?AVCConsolidatedError@@_N@Z ?getLastId@GlobalLogger@@QEAA_KXZ ?getMaxCacheSize@ISIAccelerateAction@@SA_K_N@Z ?getMinCacheSize@ISIAccelerateAction@@SA_K_N@Z ?has_array_field@value@json@web@@QEBA_NAEBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z ?has_boolean_field@value@json@web@@QEBA_NAEBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z ?has_double_field@value@json@web@@QEBA_NAEBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z ?has_integer_field@value@json@web@@QEBA_NAEBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z ?has_number_field@value@json@web@@QEBA_NAEBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z ?has_object_field@value@json@web@@QEBA_NAEBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z ?has_string_field@value@json@web@@QEBA_NAEBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z ?is_double@value@json@web@@QEBA_NXZ ?is_int32@number@json@web@@QEBA_NXZ ?is_int64@number@json@web@@QEBA_NXZ ?is_integer@value@json@web@@QEBA_NXZ ?is_uint32@number@json@web@@QEBA_NXZ ?keep_object_element_order@json@web@@YAX_N@Z ?latin1_to_utf16@conversions@utility@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@AEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@4@@Z ?latin1_to_utf8@conversions@utility@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AEBV34@@Z ?message@windows_category_impl@details@utility@@UEBA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@H@Z ?null@value@json@web@@SA?AV123@XZ ?number@value@json@web@@SA?AV123@H@Z ?number@value@json@web@@SA?AV123@I@Z ?number@value@json@web@@SA?AV123@N@Z ?number@value@json@web@@SA?AV123@_J@Z ?number@value@json@web@@SA?AV123@_K@Z ?object@value@json@web@@SA?AV123@V?$vector@U?$pair@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@Vvalue@json@web@@@std@@V?$allocator@U?$pair@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@Vvalue@json@web@@@std@@@2@@std@@_N@Z ?object@value@json@web@@SA?AV123@_N@Z ?parse@value@json@web@@SA?AV123@AEAV?$basic_istream@DU?$char_traits@D@std@@@std@@@Z ?parse@value@json@web@@SA?AV123@AEAV?$basic_istream@DU?$char_traits@D@std@@@std@@AEAVerror_code@5@@Z ?parse@value@json@web@@SA?AV123@AEAV?$basic_istream@_WU?$char_traits@_W@std@@@std@@@Z ?parse@value@json@web@@SA?AV123@AEAV?$basic_istream@_WU?$char_traits@_W@std@@@std@@AEAVerror_code@5@@Z ?parse@value@json@web@@SA?AV123@AEBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z ?parse@value@json@web@@SA?AV123@AEBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@AEAVerror_code@5@@Z ?platform_category@details@utility@@YAAEBVerror_category@std@@XZ ?resetCacheToAvailable@ISIAccelerateAction@@UEAA?AU_ISI_Error@@I@Z ?seconds_to_xml_duration@timespan@utility@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@V?$duration@_JU?$ratio@$00$00@std@@@chrono@4@@Z ?serialize@value@json@web@@QEBA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@XZ ?serialize@value@json@web@@QEBAXAEAV?$basic_ostream@DU?$char_traits@D@std@@@std@@@Z ?serialize@value@json@web@@QEBAXAEAV?$basic_ostream@_WU?$char_traits@_W@std@@@std@@@Z ?setCacheVolSize@ISIAccelerateAction@@UEAAX_K@Z ?setError@GlobalLogger@@QEAA_KAEBVCConsolidatedError@@@Z ?setError@GlobalLogger@@QEAA_KAEBVCConsolidatedError@@AEAU_ISI_Error@@@Z ?setFastDisk@ISIAccelerateAction@@UEAAXI@Z ?setFcMode@ISIAccelerateAction@@UEAAXW4_ISI_NgsaFileCacheMode@@@Z ?setFileCacheSize@ISIAccelerateAction@@UEAAXI@Z ?setMigrationStart@ISIAccelerateAction@@UEAAX_K@Z ?setPreservePinningData@ISIAccelerateAction@@UEAAX_N@Z ?setSeparationSafe@ISIAccelerateAction@@UEAAX_N@Z ?setSlowDisk@ISIAccelerateAction@@UEAAXI@Z ?string@value@json@web@@CA?AV123@AEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z ?string@value@json@web@@SA?AV123@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z ?string@value@json@web@@SA?AV123@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@_N@Z ?system_type_to_datetime@datetime@utility@@CA_NPEAX_KPEAV12@@Z ?to_string@datetime@utility@@QEBA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@W4date_format@12@@Z ?to_string@value@json@web@@QEBA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@XZ ?to_string_t@conversions@utility@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@$$QEAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@4@@Z ?to_string_t@conversions@utility@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@AEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@4@@Z ?to_utf16string@conversions@utility@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@AEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@4@@Z ?to_utf8string@conversions@utility@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AEBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@4@@Z ?turnOffVolumeOrDiskAcceleration@ISIAccelerateAction@@UEAA?AU_ISI_Error@@I@Z ?type@value@json@web@@QEBA?AW4value_type@123@XZ ?usascii_to_utf16@conversions@utility@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@AEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@4@@Z ?utc_now@datetime@utility@@SA?AV12@XZ ?utf16_to_utf8@conversions@utility@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AEBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@4@@Z ?utf8_to_utf16@conversions@utility@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@AEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@4@@Z ?waitForNvcMode@ISIAccelerateAction@@UEAA?AU_ISI_Error@@IW4_ISI_NvcMode@@@Z ?windows_category@details@utility@@YAAEBVerror_category@std@@XZ ?xml_duration_to_seconds@timespan@utility@@YA?AV?$duration@_JU?$ratio@$00$00@std@@@chrono@std@@AEBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@5@@Z GetLPCId ISI_NgsaDiskPairStatusToDescription ISI_NgsaDiskValidForConcatenationStatusToDescription ISI_NgsaOperationStatusToDescription IsiAddDisksToArray IsiArraySetWriteCacheState IsiCacheVolumeCreateFromArray IsiCacheVolumeCreateFromDisks IsiDiskAssignStoragePool IsiDiskClaim IsiDiskClearMetadata IsiDiskDestroyCache IsiDiskGetPartitionTableInfos IsiDiskMarkAsFailed IsiDiskMarkAsNormal IsiDiskMarkAsSpare IsiDiskMarkOffline IsiDiskMarkOnline IsiDiskResetSmartEvent IsiDiskSetCacheBufferFlushSetting IsiDiskSetCacheMode IsiDiskSetCacheSpindownPolicy IsiDiskSetSmartEvent IsiDiskSetWriteCachingPolicySetting IsiDiskUnlock IsiDiskUnmarkAsSpare IsiEventClose IsiEventSetUpForAllWithHandle IsiEventWaitWithHandle IsiExpandVolume IsiFinalize IsiGetArrayHandles IsiGetArrayHandlesByControllerHandle IsiGetArrayInfo IsiGetControllerHandles IsiGetControllerInfo IsiGetDiskIdentifyData IsiGetEndDeviceHandles IsiGetEndDeviceInfo IsiGetErrorDebugMessage IsiGetErrorMessage IsiGetIsRTD3HotEnabled IsiGetIsmArrays IsiGetIsmEndDevices IsiGetIsmVolumes IsiGetLastErrorDebugMessage IsiGetLastErrorMessage IsiGetMiddlewareVersionInfo IsiGetNgsaDiskPairHandles IsiGetNgsaDiskPairInfo IsiGetNgsaHandles IsiGetNgsaInfo IsiGetNgsaInfoEx IsiGetNvCachePolicyStatInfo IsiGetNvCacheStat2Info IsiGetNvCacheStatInfo IsiGetNvCacheUnifiedStats IsiGetNvcInfo IsiGetOptaneOptimizationInfo IsiGetPhyHandles IsiGetPhyInfo IsiGetRaidInfo IsiGetRaidInfoHandles IsiGetRaidLevelInfo IsiGetRdpDictEndDevices IsiGetSystemInfo IsiGetVolportPerformanceCounters IsiGetVolumeHandles IsiGetVolumeInfo IsiGetVolumeMigrationRange IsiGetZpoddInfo IsiInitialize IsiNvcDisassociate IsiROHISetState IsiRaidLevelModify IsiReadPatrolSetState IsiRefreshPartitionInfo IsiRescan IsiSessionClose IsiSessionOpen IsiSetIntelHybridDiskSubClassCode IsiSetLpmStatus IsiSetReadPatrolUnit IsiToggleCoalescerPolicy IsiUpdatePmInterfaceFields IsiVdsHandlerMakeSpaceForMetadataOnSystemDisk IsiVolumeCancelVerify IsiVolumeConvertIrrtToRaid1 IsiVolumeConvertRaid1ToIrrt IsiVolumeCreate IsiVolumeCreateFromDisks IsiVolumeDelete IsiVolumeDestroyCache IsiVolumeInitialize IsiVolumeIrrtCreate IsiVolumeIrrtMountPartner IsiVolumeIrrtSetAutomaticSync IsiVolumeIrrtSetManualSync IsiVolumeIrrtSwapDisks IsiVolumeIrrtSync IsiVolumeIrrtUnMountPartner IsiVolumeMarkAsNormal IsiVolumeRebuild IsiVolumeRename IsiVolumeSetBufferFlush IsiVolumeSetCacheMode IsiVolumeSetCachePolicy IsiVolumeSetCacheSpindownPolicy IsiVolumeSetExportPolicy IsiVolumeVerify

Name

.text

Size

1.4MB

Virtual Size

1.4MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

617KB

Virtual Size

617KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

42KB

Virtual Size

71KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

77KB

Virtual Size

76KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

1024B

Virtual Size

617B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

UPX1

Size

1.3MB

Virtual Size

1.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-10_c343ce41be320e90684a88d40ae0f986_icedid_njrat

api-ms-win-core-synch-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-service-core-l1-1-0

api-ms-win-eventing-classicprovider-l1-1-0

api-ms-win-service-winsvc-l1-1-0

setupapi

advapi32

ole32

oleaut32

userenv

api-ms-win-security-base-l1-2-2

api-ms-win-core-heap-l2-1-0

rpcrt4

api-ms-win-core-util-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-timezone-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-datetime-l1-1-1

api-ms-win-core-synch-l1-2-0

api-ms-win-core-string-obsolete-l1-1-0

api-ms-win-core-processthreads-l1-1-1

api-ms-win-appmodel-runtime-l1-1-0

api-ms-win-core-path-l1-1-0

api-ms-win-core-psapi-l1-1-0

wintrust

api-ms-win-core-file-l1-1-0

api-ms-win-core-io-l1-1-0

api-ms-win-ntuser-sysparams-l1-1-0

api-ms-win-core-sysinfo-l1-2-0

api-ms-win-core-kernel32-legacy-l1-1-2

api-ms-win-devices-config-l1-1-1

api-ms-win-core-synch-ansi-l1-1-0

api-ms-win-core-synch-l1-2-1

api-ms-win-core-file-l2-1-1

api-ms-win-core-processenvironment-l1-1-0

api-ms-win-core-file-ansi-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-rtlsupport-l1-1-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-interlocked-l1-1-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-threadpool-legacy-l1-1-0

api-ms-win-core-systemtopology-l1-1-0

api-ms-win-core-processtopology-obsolete-l1-1-0

api-ms-win-core-kernel32-legacy-l1-1-0

api-ms-win-core-memory-l1-1-0

api-ms-win-core-libraryloader-l1-2-1

api-ms-win-core-console-l1-1-0

generic