2026-10-17_9bf54864d3c1f186ff434d05d0a81164_amadey_elex_icedid_njrat

General

Target
2026-10-17_9bf54864d3c1f186ff434d05d0a81164_amadey_elex_icedid_njrat
Size 1.0MB
Sample261018-25exssty5j
SHA256 d558648b49e4a37938fb20bb554dc37059b1db8884c495c8b8d48ca9dad812d1
MD5 9bf54864d3c1f186ff434d05d0a81164
SHA1 8585e2ba9b1478350b4f167cdd5f15491a024bc8
SHA512 0da634276b3642c4c02060362fac54c269857b422629a3b8d4865197e70f4222384eaffb3b52f71ff790883560b8da7ad6a1a536385e04fe8bb822880d14176f
SSDEEP 24576:aVkVnVwp/A7ibnQ/7WlyTfVw5jcAkSYqyE:aeJQoGbnQ/7WUT9mpYq
TLSH
T16D254901F7A88675E4B39579C9E2969AEE7238410B30DACF1289927C2F277D1CE35731
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-17_9bf54864d3c1f186ff434d05d0a81164_amadey_elex_icedid_njrat

File Explorer

2026-10-17_9bf54864d3c1f186ff434d05d0a81164_amadey_elex_icedid_njrat

.exe 1.0MB

2026-10-17_9bf54864d3c1f186ff434d05d0a81164_amadey_elex_icedid_njrat

IMPHASH dfa9688f813f4c110f82c55feca8f01c
SHA256 d558648b49e4a37938fb20bb554dc37059b1db8884c495c8b8d48ca9dad812d1
MD5 9bf54864d3c1f186ff434d05d0a81164
SHA1 8585e2ba9b1478350b4f167cdd5f15491a024bc8
SHA512 0da634276b3642c4c02060362fac54c269857b422629a3b8d4865197e70f4222384eaffb3b52f71ff790883560b8da7ad6a1a536385e04fe8bb822880d14176f
SSDEEP 24576:aVkVnVwp/A7ibnQ/7WlyTfVw5jcAkSYqyE:aeJQoGbnQ/7WUT9mpYq
TLSH
T16D254901F7A88675E4B39579C9E2969AEE7238410B30DACF1289927C2F277D1CE35731
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

7394

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

RegQueryValueExW SetSecurityDescriptorGroup SetSecurityDescriptorOwner SetSecurityDescriptorDacl InitializeSecurityDescriptor GetTokenInformation OpenProcessToken OpenThreadToken SetServiceStatus RegisterServiceCtrlHandlerW RegCloseKey RegOpenKeyExW StartServiceCtrlDispatcherW

kernel32

HeapFree GetLastError WideCharToMultiByte lstrlenW GetCurrentProcess GetCurrentThread HeapAlloc LoadLibraryExW LeaveCriticalSection lstrcmpW EnterCriticalSection LCMapStringW lstrcpyW ExpandEnvironmentStringsW lstrcmpiW ExitProcess GetCommandLineW InitializeCriticalSection GetProcessHeap SetErrorMode SetUnhandledExceptionFilter FreeLibrary InterlockedCompareExchange LoadLibraryA LocalFree GetProcAddress DelayLoadFailureHook LocalAlloc

ntdll

NtQuerySecurityObject RtlFreeHeap NtOpenKey wcscat wcscpy RtlAllocateHeap RtlCompareUnicodeString RtlInitUnicodeString RtlInitializeSid RtlLengthRequiredSid RtlSubAuthoritySid RtlCopySid RtlSubAuthorityCountSid NtClose RtlGetDaclSecurityDescriptor RtlQueryInformationAcl RtlGetAce RtlUnhandledExceptionFilter wcslen RtlImageNtHeader

rpcrt4

RpcMgmtSetServerStackSize RpcMgmtWaitServerListen RpcMgmtStopServerListening RpcServerUnregisterIf RpcServerUnregisterIfEx RpcServerListen RpcServerUseProtseqEpW RpcServerRegisterIf I_RpcMapWin32Status

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-17_9bf54864d3c1f186ff434d05d0a81164_amadey_elex_icedid_njrat

advapi32

kernel32

ntdll

rpcrt4

generic