2026-10-26_9967265814867a2e7395ab85a8952b32_icedid_quasar-rat

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-26_9967265814867a2e7395ab85a8952b32_icedid_quasar-rat
Size 20.8MB
Sample261027-narq8attft
SHA256 6a561b7a019e481605ed936fa02cc15d3b5735f4a5490600b379d77a3c83d9b3
MD5 9967265814867a2e7395ab85a8952b32
SHA1 56eb890b08b3a7a9a74c7251bc95a1c46b5e9dea
SHA512 aaefaaa3801550a65ca226830efd94cccc365a96487028981821ae653f55456cf374804b2cfeb3897288b816d11f819b5f742170782a67905cdc194f806d1f5d
SSDEEP 98304:lHvyIcPHKfyvVo2FXJzGHUvosx80O3dt54nreOCwDRhlAm6GyjyihWAMZzYaTica:Jp3h4nreOCwDRhfEMZzYa9jiAOT
TLSH
T1CB277D26BBA558DCD16BC0B483478B226A2174DA0B357BFB05D482792F39EF81E3D714
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects executables containing possible sandbox analysis VM usernames 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-26_9967265814867a2e7395ab85a8952b32_icedid_quasar-rat

File Explorer

2026-10-26_9967265814867a2e7395ab85a8952b32_icedid_quasar-rat

.exe 20.8MB

2026-10-26_9967265814867a2e7395ab85a8952b32_icedid_quasar-rat

IMPHASH b8f7433af9232f12c57c3ebb20cefb40
SHA256 6a561b7a019e481605ed936fa02cc15d3b5735f4a5490600b379d77a3c83d9b3
MD5 9967265814867a2e7395ab85a8952b32
SHA1 56eb890b08b3a7a9a74c7251bc95a1c46b5e9dea
SHA512 aaefaaa3801550a65ca226830efd94cccc365a96487028981821ae653f55456cf374804b2cfeb3897288b816d11f819b5f742170782a67905cdc194f806d1f5d
SSDEEP 98304:lHvyIcPHKfyvVo2FXJzGHUvosx80O3dt54nreOCwDRhlAm6GyjyihWAMZzYaTica:Jp3h4nreOCwDRhfEMZzYa9jiAOT
TLSH
T1CB277D26BBA558DCD16BC0B483478B226A2174DA0B357BFB05D482792F39EF81E3D714
MD5 SHA1 SHA512 SSDEEP TLSH

Detects executables containing possible sandbox analysis VM usernames
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

12845260

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

wdictx.pdb

kernel32

GlobalLock GlobalAlloc QueryPerformanceFrequency GetModuleHandleA GetSystemTimeAsFileTime GetModuleHandleExW IsValidCodePage GetACP GetOEMCP PowerClearRequest GetCPInfo SetStdHandle GetLastError GetStringTypeW GlobalUnlock PowerSetRequest PowerCreateRequest GetProcAddress LoadLibraryA GetModuleHandleW CompareStringW LCMapStringW IsDebuggerPresent GetStartupInfoW CreateMutexW IsProcessorFeaturePresent GetCurrentPackageFullName RtlPcToFileHeader RaiseException EncodePointer TlsAlloc TlsGetValue SetThreadPriority GetCurrentThread TlsSetValue TlsFree TrySubmitThreadpoolCallback LoadLibraryExW SetThreadpoolTimer CreateThreadpoolTimer WriteFile GetCurrentThreadId FlsGetValue CloseThreadpoolTimer HeapSize GetBinaryTypeW GetTimeZoneInformationForYear HeapFree Sleep WideCharToMultiByte HeapAlloc GetProcessHeap lstrlenW GlobalSize LocaleNameToLCID GetUserDefaultLocaleName GlobalFree CreateMutexA FreeLibrary CloseHandle SetConsoleTextAttribute GetConsoleScreenBufferInfo SetConsoleMode GetCurrentProcessId WaitForSingleObjectEx RtlVirtualUnwind SetEvent CreateEventW WaitForSingleObject GetConsoleMode LoadLibraryExA RtlLookupFunctionEntry RtlCaptureContext ReleaseMutex FormatMessageW MapViewOfFile GetCurrentProcess UnmapViewOfFile SetFilePointerEx GetFileAttributesW AddVectoredExceptionHandler SetThreadStackGuarantee InitializeCriticalSectionEx GetCurrentDirectoryW GetCommandLineA InitializeCriticalSectionAndSpinCount DeleteCriticalSection FlsFree LeaveCriticalSection FlsAlloc EnterCriticalSection SetWaitableTimer FlsSetValue GetCommandLineW CreateWaitableTimerExW RtlUnwindEx SetUnhandledExceptionFilter UnhandledExceptionFilter FindFirstFileExW FindClose IsThreadAFiber GetFileType FindNextFileW GetConsoleOutputCP ExitProcess SwitchToThread WriteConsoleW MultiByteToWideChar GetModuleFileNameW InitializeSListHead SetEnvironmentVariableW GetSystemInfo VirtualProtect CreateFileMappingW DuplicateHandle FlushFileBuffers CompareStringOrdinal GetFinalPathNameByHandleW FreeEnvironmentStringsW SetLastError GetFullPathNameW SetFileInformationByHandle CreateFileW GetStdHandle HeapReAlloc GetEnvironmentVariableW QueryPerformanceCounter CreateThread ReadFileEx SleepEx WriteFileEx GetSystemTimePreciseAsFileTime SetFileTime GetFileInformationByHandle GetFileInformationByHandleEx GetSystemDirectoryW GetWindowsDirectoryW CreateProcessW TerminateProcess GetEnvironmentStringsW CreateDirectoryW

ole32

OleUninitialize RevokeDragDrop OleInitialize CoCreateInstance CoUninitialize CoInitializeEx ReleaseStgMedium PropVariantClear RegisterDragDrop

shell32

SHGetKnownFolderPath SHCreateItemFromParsingName Shell_NotifyIconW DragQueryFileW SetCurrentProcessExplicitAppUserModelID SHOpenFolderAndSelectItems ShellExecuteW SHGetDesktopFolder

combase

CoTaskMemFree CoCreateFreeThreadedMarshaler CoIncrementMTAUsage

icuuc

u_strlen

advapi32

RegCreateKeyTransactedW RegCreateKeyExW CredDeleteW CredWriteW RegOpenKeyTransactedW RegOpenKeyExW CredFree CredReadW RegQueryValueExW RegCloseKey RegSetValueExW RegDeleteValueW

api-ms-win-core-synch-l1-2-0

WakeByAddressAll WaitOnAddress WakeByAddressSingle

winmm

timeBeginPeriod timeEndPeriod

user32

ClientToScreen RegisterClipboardFormatW GetClipboardFormatNameW GetClipboardData EnumClipboardFormats CountClipboardFormats EmptyClipboard OpenClipboard ToUnicode GetKeyboardState MapVirtualKeyW SystemParametersInfoW GetKeyboardLayoutNameW SetClipboardData CreatePopupMenu SetWindowTextW GetForegroundWindow MessageBeep WindowFromPoint GetClientRect GetWindowPlacement BringWindowToTop EnumDisplayMonitors MonitorFromPoint GetDoubleClickTime GetSystemMetrics RegisterClassExW SetWindowsHookExW UnhookWindowsHookEx AllowSetForegroundWindow GetWindowThreadProcessId AppendMenuW GetPointerType GetMonitorInfoW SetCapture TrackMouseEvent ReleaseCapture IsZoomed GetSystemMetricsForDpi GetDpiForSystem EnableWindow TrackPopupMenu MonitorFromWindow GetFocus ValidateRect ScreenToClient GetCursorPos SetForegroundWindow SendInput SetFocus SetActiveWindow SetWindowPlacement FlashWindowEx FindWindowW SetProcessDpiAwarenessContext SetWindowPos SetPropW RemovePropW GetWindowRect RegisterWindowMessageW DestroyWindow UnregisterSuspendResumeNotification ShowWindowAsync KillTimer IsIconic IsWindowVisible GetKeyState CloseClipboard GetMessageW SetCursor RegisterSuspendResumeNotification LoadImageW GetDC DispatchMessageW TranslateMessage PeekMessageW PostQuitMessage DefWindowProcW SetWindowLongPtrW CreateWindowExW RegisterClassW LoadIconW GetActiveWindow GetWindowLongPtrW SendMessageW RedrawWindow ReleaseDC EnumThreadWindows PostMessageW GetClassNameW SetTimer RegisterHotKey CallNextHookEx IsWindowEnabled GetAsyncKeyState UnregisterHotKey ShowWindow DestroyMenu GetDpiForWindow GetAncestor

comctl32

TaskDialogIndirect

d3dcompiler_47

D3DCompileFromFile

bcryptprimitives

ProcessPrng

imm32

ImmAssociateContextEx ImmGetContext ImmNotifyIME ImmSetCompositionWindow ImmSetCandidateWindow ImmGetCompositionStringW ImmReleaseContext

gdi32

DeleteDC GetDIBits CreateSolidBrush DeleteObject CreateCompatibleBitmap SelectObject CreateCompatibleDC BitBlt

dwmapi

DwmFlush DwmGetCompositionTimingInfo DwmSetWindowAttribute

api-ms-win-shcore-scaling-l1-1-1

GetDpiForMonitor

ntdll

RtlNtStatusToDosError NtWriteFile NtOpenFile NtCreateNamedPipeFile NtReadFile RtlGetVersion

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory RoInitialize

dwrite

DWriteCreateFactory

dxgi

DXGIGetDebugInterface1 CreateDXGIFactory2

d3d11

D3D11CreateDevice

dcomp

DCompositionCreateDevice

uiautomationcore

UiaGetReservedMixedAttributeValue UiaGetReservedNotSupportedValue UiaHostProviderFromHwnd UiaLookupId UiaRaiseAutomationEvent UiaReturnRawElementProvider UiaRaiseAutomationPropertyChangedEvent

oleaut32

SysAllocStringLen SafeArrayCreateVector SafeArrayPutElement VariantClear SysFreeString SysStringLen

userenv

GetUserProfileDirectoryW

Name

.text

Size

12.6MB

Virtual Size

12.6MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

7.5MB

Virtual Size

7.5MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

6KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

678KB

Virtual Size

678KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

17KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

80KB

Virtual Size

79KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-26_9967265814867a2e7395ab85a8952b32_icedid_quasar-rat

kernel32

ole32

shell32

combase

icuuc

advapi32

api-ms-win-core-synch-l1-2-0

winmm

user32

comctl32

d3dcompiler_47

bcryptprimitives

imm32

gdi32

dwmapi

api-ms-win-shcore-scaling-l1-1-1

ntdll

api-ms-win-core-winrt-l1-1-0

dwrite

dxgi

d3d11

dcomp

uiautomationcore

oleaut32

userenv

generic