2026-10-29_105f5e221891f6eef68b66e00a241920_icedid_njrat

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-29_105f5e221891f6eef68b66e00a241920_icedid_njrat
Size 10.5MB
Sample261029-vv7fqs1vhw
SHA256 76427b96dbf40ca18f912518e823532b44a454eab37c1e60465998f8814bd48c
MD5 105f5e221891f6eef68b66e00a241920
SHA1 94ca7d5d75674a26e78c2583a71a1c4289c14299
SHA512 12e208626af1b54739626da675e6925686039e665b8e7df5d22f1709f30fefba0be049a3fe52ab40eab38e376c947e6a22aac94c1410efd42806f7d75666d118
SSDEEP 49152:AFpIJ6DCL4bUKG6eYkkA2EuKFfKfmWo9NNLHWyJBC9F2KZc0+ni+c3ivaR1NiJlx:18cSHKCHnQEpW+
TLSH
T15EB6756D72AA5191D2A9C079E943876BDC60308A533D94FFD141D9C8AF207FCAE3CB52
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-29_105f5e221891f6eef68b66e00a241920_icedid_njrat

File Explorer

2026-10-29_105f5e221891f6eef68b66e00a241920_icedid_njrat

.exe 10.5MB

2026-10-29_105f5e221891f6eef68b66e00a241920_icedid_njrat

IMPHASH 037e6bab5ff2e78319607deae4ddc72d
SHA256 76427b96dbf40ca18f912518e823532b44a454eab37c1e60465998f8814bd48c
MD5 105f5e221891f6eef68b66e00a241920
SHA1 94ca7d5d75674a26e78c2583a71a1c4289c14299
SHA512 12e208626af1b54739626da675e6925686039e665b8e7df5d22f1709f30fefba0be049a3fe52ab40eab38e376c947e6a22aac94c1410efd42806f7d75666d118
SSDEEP 49152:AFpIJ6DCL4bUKG6eYkkA2EuKFfKfmWo9NNLHWyJBC9F2KZc0+ni+c3ivaR1NiJlx:18cSHKCHnQEpW+
TLSH
T15EB6756D72AA5191D2A9C079E943876BDC60308A533D94FFD141D9C8AF207FCAE3CB52
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4033943

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\Daddy\source\repos\Network_capture\x64\Debug\netcap.pdb

kernel32

MoveFileExW GetFileSizeEx ReadFile SetFilePointer SetFilePointerEx FindClose FindFirstFileW FindNextFileW WriteFile VirtualAlloc VirtualFree VirtualQueryEx K32GetMappedFileNameW K32QueryWorkingSetEx RemoveDirectoryW GetTempPathW CreateNamedPipeW GetSystemDirectoryW VirtualProtect FreeLibrary LoadLibraryW WTSGetActiveConsoleSessionId GetSystemTimePreciseAsFileTime MultiByteToWideChar WideCharToMultiByte SetEndOfFile FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP CreateProcessW GetFullPathNameW GetWindowsDirectoryW QueryDosDeviceW GetLogicalDrives FileTimeToSystemTime CompareFileTime Process32NextW Process32FirstW CreateToolhelp32Snapshot GetSystemWindowsDirectoryW CopyFileW QueryFullProcessImageNameW LocalFree GetProcAddress GetModuleHandleW GetModuleFileNameW IsWow64Process ExitProcess ReadProcessMemory GetTickCount64 GetLocalTime OpenProcess ResumeThread GetExitCodeProcess GetCurrentProcessId GetProcessTimes Sleep CreateEventW CreateMutexW WaitForSingleObject ResetEvent SetEvent GetACP IsValidCodePage GetStringTypeW HeapQueryInformation HeapReAlloc ReadConsoleW GetConsoleOutputCP FlushFileBuffers OutputDebugStringW EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW IsThreadAFiber FlsFree FlsSetValue FlsGetValue FlsAlloc GetCurrentThread GetCommandLineW GetCommandLineA GetCPInfo GetSystemInfo HeapValidate HeapSize SetStdHandle FreeLibraryAndExitThread ExitThread CreateThread WriteConsoleW DeleteFileW GetEnvironmentVariableW UpdateProcThreadAttribute CreateFileMappingW GetLastError DuplicateHandle GetFileAttributesExW GetFileAttributesW CreateFileW CreateDirectoryW GetCurrentDirectoryW SetEnvironmentVariableW SetConsoleOutputCP SetConsoleCtrlHandler SetConsoleMode GetConsoleMode GetCurrentProcess GetStdHandle CloseHandle InitializeProcThreadAttributeList GetFileType GetModuleHandleExW TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount EncodePointer SetLastError LoadLibraryExW InterlockedFlushSList InterlockedPushEntrySList RtlUnwindEx VirtualQuery GetProcessHeap HeapFree HeapAlloc InitializeSListHead GetStartupInfoW IsProcessorFeaturePresent TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext IsDebuggerPresent CloseThreadpoolWait SetThreadpoolWait CreateThreadpoolWait CloseThreadpoolTimer WaitForThreadpoolTimerCallbacks SetThreadpoolTimer CreateThreadpoolTimer FreeLibraryWhenCallbackReturns GetSystemTimeAsFileTime GetCurrentProcessorNumber FlushProcessWriteBuffers CreateSemaphoreExW CreateEventExW InitOnceExecuteOnce DeleteCriticalSection InitializeCriticalSectionEx LeaveCriticalSection EnterCriticalSection CreateSymbolicLinkW QueryPerformanceCounter QueryPerformanceFrequency WaitForSingleObjectEx SwitchToThread GetCurrentThreadId GetExitCodeThread GetNativeSystemInfo ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive WakeConditionVariable WakeAllConditionVariable SleepConditionVariableSRW ReleaseSRWLockShared AcquireSRWLockShared TryAcquireSRWLockShared FormatMessageA RtlPcToFileHeader RaiseException GetLocaleInfoEx SetCurrentDirectoryW FindFirstFileExW GetDiskFreeSpaceExW GetFileInformationByHandle GetFinalPathNameByHandleW SetFileAttributesW SetFileInformationByHandle SetFileTime AreFileApisANSI DeviceIoControl CreateDirectoryExW CreateHardLinkW GetFileInformationByHandleEx RtlUnwind

user32

GetShellWindow GetWindowThreadProcessId

advapi32

SetThreadToken GetTokenInformation AdjustTokenPrivileges DuplicateTokenEx GetSidSubAuthority GetSidSubAuthorityCount IsValidSid RevertToSelf LookupAccountSidW LookupPrivilegeValueW RegCloseKey RegOpenKeyExW RegQueryValueExW ConvertSidToStringSidW StartTraceW ControlTraceW RegGetValueA RegDeleteTreeW RegSetKeyValueW RegOpenKeyExA RegSetValueExA RegDeleteKeyW RegCreateKeyExW RegGetValueW RegEnumValueW RegEnumKeyExW CloseTrace ProcessTrace OpenTraceW EnableTraceEx2 QueryAllTracesW OpenProcessToken

shell32

SHGetKnownFolderPath

ole32

StringFromGUID2 CoTaskMemFree

ws2_32

InetPtonW inet_ntop inet_pton WSAIoctl WSAGetLastError getsockname accept WSAStartup bind closesocket htonl ntohs recv setsockopt listen select connect __WSAFDIsSet sendto send ioctlsocket getnameinfo freeaddrinfo getaddrinfo socket

netapi32

NetApiBufferFree NetGetJoinInformation

iphlpapi

GetExtendedUdpTable GetExtendedTcpTable GetAdaptersAddresses

crypt32

CryptFindOIDInfo CertOpenStore CertCloseStore CertCreateCertificateContext CertFreeCertificateContext CertGetCertificateContextProperty CryptDecodeObjectEx CertGetPublicKeyLength CertFindExtension CertNameToStrW CertGetCertificateChain CertFreeCertificateChain CertVerifyCertificateChainPolicy CertGetNameStringW CertAddEncodedCertificateToStore

tdh

TdhGetProperty TdhGetPropertySize TdhEnumerateProviders

wintrust

CryptCATAdminCalcHashFromFileHandle2 WTHelperGetProvSignerFromChain WTHelperGetProvCertFromChain WTHelperProvDataFromStateData CryptCATAdminAcquireContext2 CryptCATAdminReleaseContext CryptCATAdminReleaseCatalogContext CryptCATAdminEnumCatalogFromHash CryptCATCatalogInfoFromContext WinVerifyTrust

version

VerQueryValueW GetFileVersionInfoSizeW GetFileVersionInfoW

bcrypt

BCryptHash BCryptDestroyHash BCryptFinishHash BCryptHashData BCryptOpenAlgorithmProvider BCryptCloseAlgorithmProvider BCryptCreateHash

dbghelp

SymCleanup SymSetOptions SymInitializeW SymFromAddrW SymUnloadModule64 SymGetModuleInfoW64 SymLoadModuleExW SymSetSearchPathW

winhttp

WinHttpReadData WinHttpSendRequest WinHttpReceiveResponse WinHttpQueryHeaders WinHttpConnect WinHttpCloseHandle WinHttpOpenRequest WinHttpSetTimeouts WinHttpOpen

Name

.textbss

Size

Virtual Size

3.8MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.text

Size

7.9MB

Virtual Size

7.9MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

2.1MB

Virtual Size

2.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

13KB

Virtual Size

22KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

514KB

Virtual Size

514KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

16KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.msvcjmc

Size

8KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

1024B

Virtual Size

791B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.00cfg

Size

512B

Virtual Size

373B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

1024B

Virtual Size

563B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

68KB

Virtual Size

68KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-29_105f5e221891f6eef68b66e00a241920_icedid_njrat

kernel32

user32

advapi32

shell32

ole32

ws2_32

netapi32

iphlpapi

crypt32

tdh

wintrust

version

bcrypt

dbghelp

winhttp

generic