2026-10-26_7b3bc73737309652efb2f4820bfdfa9a_icedid

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-26_7b3bc73737309652efb2f4820bfdfa9a_icedid
Size 3.8MB
Sample261027-q7rtlat1fv
SHA256 a6ce7a39d573450d4ffe753baa4e6a48dae11846f903105ab9d531f058a53103
MD5 7b3bc73737309652efb2f4820bfdfa9a
SHA1 e53c85f7c258cb1f0e472d148bd958950d312e22
SHA512 ae2ee67f8ae223c6a5c94cf547507943082461a5ac4d886f0a1155f83d799197b095aa378fb4eb495f18edbec20fd801d9e189c779ecce3836be83f9fc35e386
SSDEEP 49152:f2pIaGq0bX0j7SnT1p6M3JIeYaQAic1YcU5ZUdc2Tvt/KK28tGsEbXoH/VsUZ07r:Rkin+MZzYaTic/3GD7WK
TLSH
T1EE069D20E7244ECCD61643F7674140126A6064CA877277EF48580B7E2F95EBC2BBE7B6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects executables containing possible sandbox analysis VM usernames 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-26_7b3bc73737309652efb2f4820bfdfa9a_icedid

File Explorer

2026-10-26_7b3bc73737309652efb2f4820bfdfa9a_icedid

.exe 3.8MB

2026-10-26_7b3bc73737309652efb2f4820bfdfa9a_icedid

IMPHASH 5cd0d54699cd34ec4b77f4ec3354b7c1
SHA256 a6ce7a39d573450d4ffe753baa4e6a48dae11846f903105ab9d531f058a53103
MD5 7b3bc73737309652efb2f4820bfdfa9a
SHA1 e53c85f7c258cb1f0e472d148bd958950d312e22
SHA512 ae2ee67f8ae223c6a5c94cf547507943082461a5ac4d886f0a1155f83d799197b095aa378fb4eb495f18edbec20fd801d9e189c779ecce3836be83f9fc35e386
SSDEEP 49152:f2pIaGq0bX0j7SnT1p6M3JIeYaQAic1YcU5ZUdc2Tvt/KK28tGsEbXoH/VsUZ07r:Rkin+MZzYaTic/3GD7WK
TLSH
T1EE069D20E7244ECCD61643F7674140126A6064CA877277EF48580B7E2F95EBC2BBE7B6
MD5 SHA1 SHA512 SSDEEP TLSH

Detects executables containing possible sandbox analysis VM usernames
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

733040

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

wd_dict-8afbca96b6cf6bbe.pdb

api-ms-win-core-synch-l1-2-0

WakeByAddressSingle WaitOnAddress WakeByAddressAll

bcryptprimitives

ProcessPrng

kernel32

FlsFree HeapSize LCMapStringW CompareStringW CloseHandle GetStdHandle SetConsoleTextAttribute GetConsoleScreenBufferInfo CompareStringOrdinal GetLastError FreeEnvironmentStringsW WaitForSingleObject SetLastError GetFullPathNameW GetCurrentThreadId SetFileInformationByHandle CreateFileW GetCurrentProcess DuplicateHandle GetProcessHeap HeapFree HeapReAlloc QueryPerformanceCounter CreateThread CreateEventW GetCurrentProcessId ReadFileEx SleepEx WriteFileEx ReadFile GetOverlappedResult FlushFileBuffers RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind GetSystemTimePreciseAsFileTime CancelIo SetFileTime GetFileInformationByHandle GetFileInformationByHandleEx GetSystemDirectoryW GetWindowsDirectoryW CreateProcessW TerminateProcess GetEnvironmentStringsW GetExitCodeProcess SetFilePointerEx AddVectoredExceptionHandler SetThreadStackGuarantee GetCurrentThread GetCurrentDirectoryW GetCommandLineW lstrlenW FindFirstFileExW FindClose ExitProcess GetSystemInfo SwitchToThread GetProcAddress WideCharToMultiByte WaitForSingleObjectEx LoadLibraryA CreateMutexA ReleaseMutex GetEnvironmentVariableW SetEnvironmentVariableW HeapAlloc GetModuleFileNameW MultiByteToWideChar WriteConsoleW GetConsoleMode GetConsoleOutputCP GetFileAttributesW FlsAlloc GetModuleHandleExW GetModuleHandleW FlsSetValue IsThreadAFiber GetFileType FormatMessageW WaitForMultipleObjects GetModuleHandleA QueryPerformanceFrequency FindNextFileW VirtualProtect InitializeCriticalSectionEx FlsGetValue GetStringTypeW SetStdHandle GetCPInfo GetOEMCP GetACP IsValidCodePage GetCommandLineA WriteFile LoadLibraryExW FreeLibrary TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount DeleteCriticalSection LeaveCriticalSection EnterCriticalSection EncodePointer RaiseException RtlPcToFileHeader RtlUnwindEx IsProcessorFeaturePresent GetStartupInfoW SetUnhandledExceptionFilter UnhandledExceptionFilter GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent

ntdll

NtWriteFile NtReadFile RtlNtStatusToDosError NtOpenFile NtCreateNamedPipeFile

userenv

GetUserProfileDirectoryW

Name

.text

Size

785KB

Virtual Size

784KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

3.0MB

Virtual Size

3.0MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

46KB

Virtual Size

45KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

7KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-26_7b3bc73737309652efb2f4820bfdfa9a_icedid

api-ms-win-core-synch-l1-2-0

bcryptprimitives

kernel32

ntdll

userenv

generic