2026-10-19_6a277a10bbc6c6976b3893a280cbc39f_icedid_njrat

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-19_6a277a10bbc6c6976b3893a280cbc39f_icedid_njrat
Size 1.7MB
Sample261020-v397lat13p
SHA256 01d962214c4c85756067198a1a0f186c557f3c4aa5c44e688ecdd06473b63976
MD5 6a277a10bbc6c6976b3893a280cbc39f
SHA1 6ef529dcef3df0534de7084fbbaebedd03a2629f
SHA512 9e325a2cb3efc657fa3009d644f4d7b342797727862d4c6cee7717d675264d38f2ff8ba7cfa9bf4db84128797aa74e2135cef3d7bb6cca3829b9f7c8ef194b23
SSDEEP 49152:nfd7jr2tkBWoRGw7uOMkBjxFT6fzarSj8RoTCCW:fp7WbwqOMkJxFufzJTy
TLSH
T15E85021BE7D800F8E167C238C9938805EA727C494761D6CF07D459AA5F77AE09E3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-19_6a277a10bbc6c6976b3893a280cbc39f_icedid_njrat

File Explorer

2026-10-19_6a277a10bbc6c6976b3893a280cbc39f_icedid_njrat

.exe 1.7MB

2026-10-19_6a277a10bbc6c6976b3893a280cbc39f_icedid_njrat

IMPHASH ba579758d993712b5576634ff897b018
SHA256 01d962214c4c85756067198a1a0f186c557f3c4aa5c44e688ecdd06473b63976
MD5 6a277a10bbc6c6976b3893a280cbc39f
SHA1 6ef529dcef3df0534de7084fbbaebedd03a2629f
SHA512 9e325a2cb3efc657fa3009d644f4d7b342797727862d4c6cee7717d675264d38f2ff8ba7cfa9bf4db84128797aa74e2135cef3d7bb6cca3829b9f7c8ef194b23
SSDEEP 49152:nfd7jr2tkBWoRGw7uOMkBjxFT6fzarSj8RoTCCW:fp7WbwqOMkJxFufzJTy
TLSH
T15E85021BE7D800F8E167C238C9938805EA727C494761D6CF07D459AA5F77AE09E3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

163856

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

E:\WS\tv_prel_dcr\build_cmake_win_HOOKS\Release\tv_x64exe.pdb

kernel32

SetLastError GetModuleFileNameW GetLastError GetWindowsDirectoryW LocalFree GetModuleFileNameA LoadLibraryA GetProcAddress FreeLibrary SetWaitableTimer CreateWaitableTimerW CloseHandle OpenMutexW CreateEventW SetEvent WriteFile SetFilePointer CreateMutexW WaitForSingleObject CreateFileW GetCurrentThreadId ReleaseMutex GetLocalTime GetCurrentProcessId GetCommandLineW GetCurrentProcess LoadLibraryExA GetModuleHandleA GetSystemDirectoryA DeviceIoControl LocalAlloc FormatMessageW EnterCriticalSection LeaveCriticalSection ReleaseSRWLockExclusive AcquireSRWLockExclusive WideCharToMultiByte FormatMessageA GetFileAttributesW GetSystemDirectoryW LoadLibraryExW VerSetConditionMask VerifyVersionInfoW SetSearchPathMode SetDllDirectoryW HeapSetInformation SetProcessDEPPolicy WriteConsoleW RaiseException GetSystemInfo VirtualProtect VirtualQuery GetModuleHandleW QueryPerformanceCounter QueryPerformanceFrequency SleepConditionVariableSRW Sleep MultiByteToWideChar GetStringTypeW InitOnceBeginInitialize InitOnceComplete InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer LCMapStringEx GetSystemTimeAsFileTime GetCPInfo RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent WakeAllConditionVariable IsDebuggerPresent GetStartupInfoW InitializeSListHead RtlUnwindEx RtlPcToFileHeader InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree ExitProcess GetModuleHandleExW GetStdHandle HeapFree HeapAlloc GetFileType FlsAlloc FlsGetValue FlsSetValue FlsFree LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW HeapReAlloc FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW GetProcessHeap SetStdHandle SetFilePointerEx HeapSize FlushFileBuffers GetConsoleOutputCP GetConsoleMode

Name

.text

Size

295KB

Virtual Size

295KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

112KB

Virtual Size

111KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

6KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

15KB

Virtual Size

14KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.didat

Size

512B

Virtual Size

456B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

UPX1

Size

1.3MB

Virtual Size

1.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-19_6a277a10bbc6c6976b3893a280cbc39f_icedid_njrat

kernel32

generic