2026-10-11_4f08f9eb37a5729ac52604bf12f2fa3d_icedid_njrat

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-11_4f08f9eb37a5729ac52604bf12f2fa3d_icedid_njrat
Size 2.7MB
Sample261012-1v7dmaxx6p
SHA256 3aa0fa9f3e9bae64b4d9533eece9428535b87b7e796be77ebb42e6289c99b8c3
MD5 4f08f9eb37a5729ac52604bf12f2fa3d
SHA1 acbae993b98cb8157ea7464eda9b657bb3fd10a0
SHA512 3180a3f8ac2dfcf6f491b6e9ba40e4460ab53572449e7bb4d93cc967236adba6643088a250e4c5bfc4292553a742d56fac5cf9b62c3f9f3b9a4e21a595c9858c
SSDEEP 24576:iVXNjE5nL3hXjM0Y9EVGh6WpROMD+J89ukVLxuISvx8RR90j:AXRE5hpVGh5Rj+bkVexGRuj
TLSH
T197D5F90BF7B621D4E1BAC138D553222AFD7134A6833897DB66C19E061B61BE4ED3E740
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects executables containing commands for clearing Windows Event Logs 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_ClearWinLogs

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-11_4f08f9eb37a5729ac52604bf12f2fa3d_icedid_njrat

File Explorer

2026-10-11_4f08f9eb37a5729ac52604bf12f2fa3d_icedid_njrat

.exe 2.7MB

2026-10-11_4f08f9eb37a5729ac52604bf12f2fa3d_icedid_njrat

IMPHASH f8150461a34ed5769aeee6277137155d
SHA256 3aa0fa9f3e9bae64b4d9533eece9428535b87b7e796be77ebb42e6289c99b8c3
MD5 4f08f9eb37a5729ac52604bf12f2fa3d
SHA1 acbae993b98cb8157ea7464eda9b657bb3fd10a0
SHA512 3180a3f8ac2dfcf6f491b6e9ba40e4460ab53572449e7bb4d93cc967236adba6643088a250e4c5bfc4292553a742d56fac5cf9b62c3f9f3b9a4e21a595c9858c
SSDEEP 24576:iVXNjE5nL3hXjM0Y9EVGh6WpROMD+J89ukVLxuISvx8RR90j:AXRE5hpVGh5Rj+bkVexGRuj
TLSH
T197D5F90BF7B621D4E1BAC138D553222AFD7134A6833897DB66C19E061B61BE4ED3E740
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects executables containing commands for clearing Windows Event Logs
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

19271

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\User\Desktop\SOURCES MY PROJECTS FOR GAMES\412421414\WintorezCPP\x64\Debug\WintorezLoader.pdb

winhttp

WinHttpCloseHandle WinHttpQueryHeaders WinHttpConnect WinHttpReadData WinHttpQueryDataAvailable WinHttpQueryOption WinHttpSetOption WinHttpOpenRequest WinHttpAddRequestHeaders WinHttpSendRequest WinHttpOpen WinHttpReceiveResponse

bcrypt

BCryptOpenAlgorithmProvider BCryptCloseAlgorithmProvider BCryptCreateHash BCryptHashData BCryptFinishHash BCryptDestroyHash

advapi32

RegSetValueExA SetSecurityDescriptorDacl InitializeSecurityDescriptor FreeSid CheckTokenMembership AllocateAndInitializeSid RegDeleteKeyA RegDeleteValueA RegEnumKeyExA RegEnumValueA RegOpenKeyExA RegQueryValueExA RegCloseKey

comctl32

ord17

comdlg32

GetOpenFileNameA

shell32

SHGetFolderPathA SHBrowseForFolderA SHGetPathFromIDListA ShellExecuteW ShellExecuteA

kernel32

EnumSystemLocalesW GetConsoleOutputCP GetConsoleMode GetFileSizeEx SetFilePointerEx ReadConsoleW GetTimeZoneInformation FindFirstFileExW IsValidCodePage GetACP GetOEMCP GetCommandLineA CompareStringW GetTimeFormatW GetDateFormatW FlsFree FlsSetValue FlsGetValue GetEnvironmentVariableA CreateDirectoryA CreateFileA DeleteFileA DeleteFileW FindClose FindFirstFileA FindFirstFileW FindNextFileA FindNextFileW FlushFileBuffers GetFileAttributesA GetFileSize GetVolumeInformationW ReadFile RemoveDirectoryA SetFileAttributesA SetFilePointer WriteFile GetVolumeInformationA IsDebuggerPresent CheckRemoteDebuggerPresent CloseHandle DuplicateHandle GetLastError QueryPerformanceCounter QueryPerformanceFrequency SetEvent WaitForSingleObject CreateEventA Sleep GetCurrentProcess GetCurrentProcessId ExitProcess TerminateProcess GetExitCodeProcess CreateThread GetCommandLineW OpenThread GetExitCodeThread ResumeThread CreateProcessA CreateProcessW OpenProcess GetTickCount VirtualAllocEx VirtualProtectEx ReadProcessMemory WriteProcessMemory MapViewOfFile VirtualFreeEx UnmapViewOfFile GetModuleFileNameA GetModuleFileNameW GetModuleHandleA GetModuleHandleExA GetProcAddress LoadLibraryA GlobalAlloc GlobalUnlock GlobalLock LocalFree CreateFileMappingA CopyFileA MoveFileA GetComputerNameA MultiByteToWideChar CreateToolhelp32Snapshot Process32FirstW Process32NextW Thread32First Thread32Next Module32FirstW Module32NextW FlsAlloc SetConsoleCtrlHandler WriteConsoleW OutputDebugStringW GetFileType GetProcessHeap HeapQueryInformation HeapReAlloc HeapFree GetFileAttributesExW GetCurrentThread GetStdHandle FreeLibraryAndExitThread LCMapStringW ExitThread GetModuleHandleExW GetSystemInfo HeapValidate HeapSize HeapAlloc LoadLibraryExW FreeLibrary TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount SetLastError InterlockedFlushSList InterlockedPushEntrySList RtlUnwindEx RaiseException RtlPcToFileHeader InitializeSListHead GetStartupInfoW IsProcessorFeaturePresent SetUnhandledExceptionFilter GetUserDefaultLCID GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle CreateFileW SetEndOfFile CreateRemoteThread RtlUnwind IsValidLocale GetLocaleInfoW UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext GetCPInfo CompareStringEx GetStringTypeW WaitForSingleObjectEx SwitchToThread GetCurrentThreadId GetNativeSystemInfo FormatMessageA WideCharToMultiByte EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive WakeConditionVariable WakeAllConditionVariable SleepConditionVariableSRW GetLocaleInfoEx EncodePointer DecodePointer LCMapStringEx SetFileInformationByHandle GetTempPathW InitOnceExecuteOnce CreateEventExW CreateSemaphoreExW FlushProcessWriteBuffers GetCurrentProcessorNumber GetSystemTimeAsFileTime GetTickCount64 FreeLibraryWhenCallbackReturns CreateThreadpoolTimer SetThreadpoolTimer WaitForThreadpoolTimerCallbacks CloseThreadpoolTimer CreateThreadpoolWait SetThreadpoolWait CloseThreadpoolWait GetModuleHandleW GetFileInformationByHandleEx CreateSymbolicLinkW

user32

UpdateWindow DrawTextA GetSystemMetrics EnableWindow KillTimer SetTimer EmptyClipboard SetClipboardData CloseClipboard OpenClipboard SetWindowTextA GetDlgItemTextA SetDlgItemTextA GetDlgItem IsWindowVisible SetWindowDisplayAffinity DestroyWindow CreateWindowExA RegisterClassA PostQuitMessage DefWindowProcA PostMessageW SendMessageW UnregisterHotKey RegisterHotKey DispatchMessageW TranslateMessage GetMessageW MessageBoxA InvalidateRect FillRect EnumWindows GetWindowThreadProcessId LoadCursorW GetDlgCtrlID ShowWindow

gdi32

SetBkMode CreateFontA CreateSolidBrush DeleteObject SelectObject SetBkColor SetTextColor

ole32

CoTaskMemFree

setupapi

SetupDiSetClassInstallParamsA SetupDiGetDeviceRegistryPropertyA SetupDiCallClassInstaller SetupDiGetClassDevsA SetupDiDestroyDeviceInfoList SetupDiEnumDeviceInfo

Name

.text

Size

2.2MB

Virtual Size

2.2MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

468KB

Virtual Size

467KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

11KB

Virtual Size

23KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

86KB

Virtual Size

85KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

13KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

1024B

Virtual Size

777B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.00cfg

Size

512B

Virtual Size

373B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

12KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-11_4f08f9eb37a5729ac52604bf12f2fa3d_icedid_njrat

winhttp

bcrypt

advapi32

comctl32

comdlg32

shell32

kernel32

user32

gdi32

ole32

setupapi

generic