2026-10-17_965b1095638343d5d5f3a5cad464bc3a_hijackloader_icedid_njrat

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-17_965b1095638343d5d5f3a5cad464bc3a_hijackloader_icedid_njrat
Size 5.0MB
Sample261018-3pspdst15j
SHA256 de39a2f18c88cc3c4c0959d884230bb443bdb71272a02fc6b065106e8fa48913
MD5 965b1095638343d5d5f3a5cad464bc3a
SHA1 5274aceeb969d0f1fece58551383c14a946b8eb5
SHA512 919adb716bbf04901cd5d332b649094230c34e4179808b092f439ef488ff75f4dbb73d69bf4a33ef3a551a9ef784699ae11322b20d033d4475915c8083232619
SSDEEP 98304:HK/i232b24202X2X2r232b222C2A2D2c232I2t2E2kHxKTH2w2Rsu2:qq232b24202X2X2r232b222C2A2D2c2T
TLSH
T144364A2670C2B099D4EB8A782D5674EA68AC3D019339D55E280BB77B06F3701DD2F727
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

2026-10-17_965b1095638343d5d5f3a5cad464bc3a_hijackloader_icedid_njrat

.exe 5.0MB

2026-10-17_965b1095638343d5d5f3a5cad464bc3a_hijackloader_icedid_njrat

IMPHASH 9d91610af4f67a19aa4e968cb1ab1ad8
SHA256 de39a2f18c88cc3c4c0959d884230bb443bdb71272a02fc6b065106e8fa48913
MD5 965b1095638343d5d5f3a5cad464bc3a
SHA1 5274aceeb969d0f1fece58551383c14a946b8eb5
SHA512 919adb716bbf04901cd5d332b649094230c34e4179808b092f439ef488ff75f4dbb73d69bf4a33ef3a551a9ef784699ae11322b20d033d4475915c8083232619
SSDEEP 98304:HK/i232b24202X2X2r232b222C2A2D2c232I2t2E2kHxKTH2w2Rsu2:qq232b24202X2X2r232b222C2A2D2c2T
TLSH
T144364A2670C2B099D4EB8A782D5674EA68AC3D019339D55E280BB77B06F3701DD2F727
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Digest

a5:56:bf:e5:28:7d:fa:f3:50:01:86:02:75:d6:6c:49:0c:09:fb:75:00:79:05:38:ef:f9:03:3d:cd:e1:5f:9c

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Apple Inc.,O=Apple Inc.,L=Cupertino,ST=California,C=US

Chains

Aug 10, 2022

CN=Apple Inc.,O=Apple Inc.,L=Cupertino,ST=California,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA256 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=Apple Inc.,O=Apple Inc.,L=Cupertino,ST=California,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA256 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Digest

f0:33:90:38:ce:39:a4:b5:09:5c:ec:70:96:da:06:35:16:1b:76:29

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

CN=Apple Inc.,O=Apple Inc.,L=Cupertino,ST=California,C=US

Chains

Aug 10, 2022

CN=Apple Inc.,O=Apple Inc.,L=Cupertino,ST=California,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA256 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=Apple Inc.,O=Apple Inc.,L=Cupertino,ST=California,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA256 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA256 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0e:4d:67:f6:43:16:c9:2a:3b:7a:17:cc:46:97:6a:8f

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 28, 2021 - Jul 27, 2036

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert\, Inc.,C=US

Serial Number

0a:7a:4a:88:9e:c9:99:42:90:06:63:38:4d:86:97:9d

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 29, 2022 - Mar 14, 2033

Subject

CN=Apple Inc.,O=Apple Inc.,L=Cupertino,ST=California,C=US

Serial Number

09:e4:11:e3:6b:54:f9:7b:a7:ca:f0:79:b4:34:b8:50

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA256 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 20, 2022 - Feb 21, 2023

Minor OS version

Major OS version

Entry point

49920

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\BWA\30226AF2-CB9A-0\BootCampPackageDataWin_Final-8093\srcroot\AppleBcUpdateWin\x64\Release\AppleBcInstaller.pdb

comctl32

CreatePropertySheetPageW PropertySheetW DestroyPropertySheetPage InitCommonControlsEx

newdev

DiInstallDriverW

kernel32

CreateProcessW CloseHandle WaitForSingleObject GetUserDefaultLangID GetCommandLineW GetModuleHandleW GetTempPathW GetWindowsDirectoryW GetCurrentDirectoryW GetSystemDirectoryW CreateFileW SetFilePointer WriteFile SetLastError CreateToolhelp32Snapshot Process32FirstW lstrcmpiW OpenProcess TerminateProcess Process32NextW lstrcpyW GetUserDefaultUILanguage GetFileAttributesW GetLastError FindResourceW lstrlenW LockResource SizeofResource FormatMessageW LocalAlloc LocalSize LocalFree GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW FindClose ReadConsoleW SetFilePointerEx GetConsoleMode GetConsoleCP FlushFileBuffers GetProcessHeap HeapQueryInformation HeapReAlloc HeapFree EnumSystemLocalesW GetUserDefaultLCID IsValidLocale WriteConsoleW OutputDebugStringW GetFileType LoadResource GetCurrentProcess FreeLibrary GetProcAddress LoadLibraryW GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle SetEndOfFile ReadFile RtlUnwind GetStdHandle ExitProcess GetSystemInfo HeapValidate HeapSize HeapAlloc GetModuleHandleExW GetModuleFileNameW LoadLibraryExW RaiseException RtlPcToFileHeader WideCharToMultiByte MultiByteToWideChar GetStringTypeW EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount SwitchToThread TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemTimeAsFileTime EncodePointer DecodePointer LCMapStringW GetLocaleInfoW GetCPInfo RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId InitializeSListHead RtlUnwindEx

user32

ShowWindow EnableWindow SetWindowLongW PostMessageW MoveWindow GetParent SetWindowLongPtrW GetWindowLongPtrW SendMessageW GetDlgItem MessageBoxW DestroyWindow IsDialogMessageW GetSystemMetrics SystemParametersInfoW GetWindowRect ExitWindowsEx SetDlgItemTextW LoadStringW DispatchMessageW TranslateMessage PeekMessageW

gdi32

GetObjectW CreateFontIndirectW

advapi32

ControlService RegSetValueExW RegCloseKey OpenSCManagerW CloseServiceHandle RegCreateKeyExW QueryServiceStatus OpenServiceW

shell32

SHGetKnownFolderPath CommandLineToArgvW

ole32

CoCreateInstance CoSetProxyBlanket CoInitializeEx CoInitializeSecurity

oleaut32

VariantClear VariantInit SysFreeString SysAllocString

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-17_965b1095638343d5d5f3a5cad464bc3a_hijackloader_icedid_njrat

comctl32

newdev

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

generic