2026-10-25_80e86d1b393b9266b77796716785c116_icedid_njrat_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-25_80e86d1b393b9266b77796716785c116_icedid_njrat_stealc
Size 1.0MB
Sample261026-14m2cagy7w
SHA256 7eac9dd74cddb46c495ad5003f2d49a36e81f6f70a20d503b1e25d7273cb5105
MD5 80e86d1b393b9266b77796716785c116
SHA1 37d1f2443dfe759662dab0ba7d85f6a70a1ec125
SHA512 c77461fd292f22600fe8b34e790df45b4a332be9d6329540963a038347c10f16b42f18c8ca76e9da6db297ed735ebdd04511a86111a0e220226d00e56c67d294
SSDEEP 24576:0wU3xLk+/3rtc+Km+yn+532Zl2zJVrZY/LoSxgwKME0n19YZV+Z+Owg1l6AIu1Jo:LUhLk++punC2ZE
TLSH
T1E0359E0EA1A501F9D067D0B9CA93960BF632744B03319AEB37EC96551FA36E09F3B711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-25_80e86d1b393b9266b77796716785c116_icedid_njrat_stealc

File Explorer

2026-10-25_80e86d1b393b9266b77796716785c116_icedid_njrat_stealc

.exe 1.0MB

2026-10-25_80e86d1b393b9266b77796716785c116_icedid_njrat_stealc

IMPHASH 294020d252c64b7e63d0029acbe93cdf
SHA256 7eac9dd74cddb46c495ad5003f2d49a36e81f6f70a20d503b1e25d7273cb5105
MD5 80e86d1b393b9266b77796716785c116
SHA1 37d1f2443dfe759662dab0ba7d85f6a70a1ec125
SHA512 c77461fd292f22600fe8b34e790df45b4a332be9d6329540963a038347c10f16b42f18c8ca76e9da6db297ed735ebdd04511a86111a0e220226d00e56c67d294
SSDEEP 24576:0wU3xLk+/3rtc+Km+yn+532Zl2zJVrZY/LoSxgwKME0n19YZV+Z+Owg1l6AIu1Jo:LUhLk++punC2ZE
TLSH
T1E0359E0EA1A501F9D067D0B9CA93960BF632744B03319AEB37EC96551FA36E09F3B711
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

529140

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

ws2_32

setsockopt accept WSACleanup freeaddrinfo getaddrinfo ntohl closesocket listen htons recv socket send WSAStartup bind

d3d11

D3D11CreateDeviceAndSwapChain

dwmapi

DwmExtendFrameIntoClientArea

winhttp

WinHttpOpen WinHttpReceiveResponse WinHttpQueryDataAvailable WinHttpQueryHeaders WinHttpConnect WinHttpSendRequest WinHttpCloseHandle WinHttpOpenRequest WinHttpReadData

bcrypt

BCryptGetProperty BCryptHashData BCryptDestroyHash BCryptCloseAlgorithmProvider BCryptFinishHash BCryptGenRandom BCryptOpenAlgorithmProvider BCryptCreateHash

crypt32

CryptBinaryToStringA CryptStringToBinaryA

shell32

ShellExecuteW

advapi32

CryptDestroyHash CryptReleaseContext CryptGetHashParam CryptAcquireContextW ConvertSidToStringSidA CryptCreateHash CryptHashData OpenProcessToken GetTokenInformation

kernel32

HeapReAlloc GetFileAttributesExW CreateProcessW GetExitCodeProcess ReadConsoleW GetConsoleMode GetConsoleOutputCP FlushFileBuffers SetFilePointerEx GetFileSizeEx GetFileType EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW VirtualProtect GetACP GetOEMCP GetCommandLineA HeapFree HeapAlloc GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetProcessHeap SetStdHandle CreateFileW HeapSize WriteConsoleW OutputDebugStringA CreateMutexA ReleaseMutex Sleep GetTickCount64 GetLastError CloseHandle WideCharToMultiByte SwitchToThread GetTickCount CreateDirectoryW WriteProcessMemory GetEnvironmentVariableW GetTempPathW WaitForSingleObject DeleteFileW GetProcAddress VirtualAllocEx ReadProcessMemory GetModuleHandleW CreateRemoteThread VirtualFreeEx VirtualQueryEx GetModuleHandleA CreateToolhelp32Snapshot Process32NextW Process32FirstW SizeofResource SetEndOfFile GetModuleHandleExW TerminateProcess LockResource LoadResource FindResourceW GetModuleFileNameA GetTimeZoneInformation GetConsoleWindow CreateProcessA FormatMessageA AllocConsole IsDebuggerPresent CheckRemoteDebuggerPresent MultiByteToWideChar GlobalAlloc GlobalFree GlobalLock GlobalUnlock GetLocaleInfoA LoadLibraryA QueryPerformanceFrequency FreeLibrary QueryPerformanceCounter WriteFile GetStdHandle GetModuleFileNameW ExitProcess ReadFile FreeLibraryAndExitThread ExitThread CreateThread LoadLibraryExW TlsFree TlsSetValue FlsAlloc TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount SetLastError RaiseException RtlPcToFileHeader RtlUnwindEx InitializeSListHead GetCurrentProcessId GetStartupInfoW IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext GetCPInfo GetStringTypeW GetSystemTimeAsFileTime LCMapStringEx DecodePointer EncodePointer FlsFree FlsSetValue FlsGetValue FindClose FindFirstFileExW FindNextFileW IsValidCodePage LocalFree GetCurrentProcess RtlUnwind ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive GetCurrentThreadId ReleaseSRWLockShared AcquireSRWLockShared SleepConditionVariableSRW GetLocaleInfoEx WakeAllConditionVariable EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection

user32

ScreenToClient GetCapture TrackMouseEvent GetKeyboardLayout LoadCursorW SetCapture SetCursor IsWindowUnicode ReleaseCapture SetCursorPos OpenClipboard CloseClipboard EmptyClipboard GetClipboardData SetClipboardData GetWindowThreadProcessId SetProcessDpiAwarenessContext DispatchMessageA GetWindowRect DestroyWindow SetWindowPos EqualRect GetSystemMetrics GetClassNameA ShowWindow ClientToScreen GetWindowTextA SetWindowDisplayAffinity EnumWindows DefWindowProcA CreateWindowExA SetLayeredWindowAttributes TranslateMessage GetClientRect PeekMessageA PostQuitMessage SetProcessDPIAware RegisterClassExA UpdateWindow IsIconic IsWindow GetForegroundWindow GetCursorPos IsWindowVisible GetAsyncKeyState GetCursorInfo MessageBoxA GetMessageExtraInfo EnumChildWindows GetKeyState UnregisterClassA

winmm

timeBeginPeriod timeEndPeriod

imm32

ImmReleaseContext ImmSetCompositionWindow ImmSetCandidateWindow ImmGetContext

d3dcompiler_47

D3DCompile

Name

.text

Size

730KB

Virtual Size

730KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

166KB

Virtual Size

165KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

7KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

29KB

Virtual Size

28KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

131KB

Virtual Size

131KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-25_80e86d1b393b9266b77796716785c116_icedid_njrat_stealc

ws2_32

d3d11

dwmapi

winhttp

bcrypt

crypt32

shell32

advapi32

kernel32

user32

winmm

imm32

d3dcompiler_47

generic