2026-10-28_cbf010695eea3dc4e1ad5384a79bf902_cryptbot_icedid_njrat_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-28_cbf010695eea3dc4e1ad5384a79bf902_cryptbot_icedid_njrat_stealc
Size 3.2MB
Sample261029-w3ew5assbv
SHA256 e63c5d8d95f509a02cbb836372453e937bbb4e2b16a717f2f2aeb0fe49190034
MD5 cbf010695eea3dc4e1ad5384a79bf902
SHA1 8fadbb97e271d0e8ba7135e70b868fe5fa13c1f9
SHA512 d2cb95183648df7ad0bb740526ebf3aa26bb850546b54a9179d90b786aca082de5f54589a3c35ed3e84f650863a0600fb6a4526a4481ea1e0815fe0624058364
SSDEEP 49152:HaAQVi45XgQfpyx0W743VnJ1XDio/qN5ydGucCZnj5J0V1JUeYD+XqPEx0YBH7jf:mUSf91D+aPEDBH7jf
TLSH
T150F5AE1A97E806BCD0E6C179CEC6C953E776780D07B1669F02A098A25FB7270DE39713
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-10-28_cbf010695eea3dc4e1ad5384a79bf902_cryptbot_icedid_njrat_stealc

File Explorer

2026-10-28_cbf010695eea3dc4e1ad5384a79bf902_cryptbot_icedid_njrat_stealc

.exe 3.2MB

2026-10-28_cbf010695eea3dc4e1ad5384a79bf902_cryptbot_icedid_njrat_stealc

IMPHASH 24f4677acb4d7bb93db4d719ce2b55fa
SHA256 e63c5d8d95f509a02cbb836372453e937bbb4e2b16a717f2f2aeb0fe49190034
MD5 cbf010695eea3dc4e1ad5384a79bf902
SHA1 8fadbb97e271d0e8ba7135e70b868fe5fa13c1f9
SHA512 d2cb95183648df7ad0bb740526ebf3aa26bb850546b54a9179d90b786aca082de5f54589a3c35ed3e84f650863a0600fb6a4526a4481ea1e0815fe0624058364
SSDEEP 49152:HaAQVi45XgQfpyx0W743VnJ1XDio/qN5ydGucCZnj5J0V1JUeYD+XqPEx0YBH7jf:mUSf91D+aPEDBH7jf
TLSH
T150F5AE1A97E806BCD0E6C179CEC6C953E776780D07B1669F02A098A25FB7270DE39713
MD5 SHA1 SHA512 SSDEEP TLSH

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

13:a0:be:70:7e:b7:3e:ff:7f:af:c7:7b:40:67:63:90:45:f7:bb:2b:dd:ec:b4:5f:f2:11:9b:ce:2c:61:f7:01

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

SERIALNUMBER=HRB 109885 B,CN=win.rar GmbH,O=win.rar GmbH,POSTALCODE=10117,STREET=Marienstr. 12,L=Berlin,ST=Berlin,C=DE,1.3.6.1.4.1.311.60.2.1.1=#13064265726c696e,1.3.6.1.4.1.311.60.2.1.2=#13064265726c696e,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

Sep 9, 2026

CN=Certum Extended Validation Code Signing 2021 CA,O=Asseco Data Systems S.A.,C=PL

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

CN=Certum Extended Validation Code Signing 2021 CA,O=Asseco Data Systems S.A.,C=PL

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Subject

CN=Certum Extended Validation Code Signing 2021 CA,O=Asseco Data Systems S.A.,C=PL

Serial Number

bb:f0:cc:b5:b7:b8:31:fd:21:ae:32:77:8a:e4:0c:89

Issuer

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

May 19, 2021 - May 18, 2036

Subject

Serial Number

0f:d2:3c:c8:5a:11:67:07:8d:e1:45:be:6f:35:1c:26

Issuer

CN=Certum Extended Validation Code Signing 2021 CA,O=Asseco Data Systems S.A.,C=PL

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jul 17, 2026 - Oct 19, 2027

Subject

CN=Certum Timestamp 2026,O=Asseco Data Systems S.A.,C=PL

Serial Number

28:f0:77:c1:1c:36:bd:fe:5f:74:32:47:70:27:2e:03

Issuer

CN=Certum Timestamping 2021 CA,O=Asseco Data Systems S.A.,C=PL

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 11, 2026 - Feb 27, 2036

Subject

CN=Certum Timestamping 2021 CA,O=Asseco Data Systems S.A.,C=PL

Serial Number

e7:ff:69:c7:3b:35:ce:4b:91:26:d8:74:7c:68:a5:87

Issuer

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 19, 2021 - May 18, 2036

Subject

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Serial Number

1b:b5:8f:25:2a:df:23:00:49:28:c9:ae:3d:7e:ed:27

Issuer

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

May 31, 2021 - Sep 17, 2029

Minor OS version

Major OS version

Entry point

1893520

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

d:\Projects\WinRAR\build\winrar64\Release\WinRAR.pdb

kernel32

CreateMutexExW CreateSemaphoreExW GetModuleFileNameA GetModuleHandleExW FormatMessageW WideCharToMultiByte GetDiskFreeSpaceW FindCloseChangeNotification FindFirstChangeNotificationW GetCompressedFileSizeW GetLocalTime ConnectNamedPipe DisconnectNamedPipe PeekNamedPipe CreateNamedPipeW GetOverlappedResult CreateEventW OpenProcess LocalFree QueryFullProcessImageNameW GetNamedPipeClientProcessId LoadResource SizeofResource FindResourceW GetFileInformationByHandle DeleteFileW RemoveDirectoryW BackupRead BackupSeek GetLongPathNameW GetShortPathNameW GetStdHandle FlushFileBuffers GetFileType GetFileTime CreateDirectoryW GetDiskFreeSpaceExW GetFileAttributesW SetFileAttributesW FindNextFileW VirtualAlloc VirtualFree SetCurrentDirectoryW GetCurrentDirectoryW GetFullPathNameW GetModuleFileNameW FoldStringW LoadLibraryExW ExpandEnvironmentStringsW CompareStringA GetCurrentThread SetThreadPriority SetPriorityClass GetSystemDirectoryW SetThreadExecutionState InitializeCriticalSection EnterCriticalSection LeaveCriticalSection DeleteCriticalSection SetEvent ResetEvent CreateSemaphoreW CreateThread GetProcessAffinityMask FileTimeToLocalFileTime LocalFileTimeToFileTime GetSystemTime SystemTimeToTzSpecificLocalTime TzSpecificLocalTimeToSystemTime FileTimeToSystemTime SystemTimeToFileTime CompareStringW GetCPInfo IsDBCSLeadByte EnumResourceNamesW EnumResourceLanguagesW BeginUpdateResourceW UpdateResourceW EndUpdateResourceW GetLocaleInfoW GetNumberFormatW GetLogicalDrives GetTempPathW SetEnvironmentVariableW GlobalMemoryStatusEx LockResource GetDateFormatW GetTimeFormatW SuspendThread ResumeThread WaitForSingleObjectEx GetSystemTimeAsFileTime Beep FindNextChangeNotification SetErrorMode GetThreadPriority GetPriorityClass CompareFileTime WaitForMultipleObjects MulDiv OutputDebugStringA LocalAlloc GetEnvironmentVariableW WriteConsoleW HeapSize GetStringTypeW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA IsValidCodePage FindFirstFileExW ReadConsoleW SetStdHandle HeapReAlloc LCMapStringW FlsFree FlsSetValue FlsGetValue FlsAlloc GetConsoleMode GetConsoleOutputCP SetFilePointerEx GetFileSizeEx ExitProcess FreeLibraryAndExitThread ExitThread TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount EncodePointer RtlUnwindEx RtlPcToFileHeader InitializeSListHead IsProcessorFeaturePresent TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext SleepConditionVariableSRW WakeAllConditionVariable InitializeCriticalSectionEx QueryPerformanceFrequency QueryPerformanceCounter TryAcquireSRWLockExclusive AcquireSRWLockExclusive ReleaseSRWLockExclusive LoadLibraryExA VirtualQuery VirtualProtect GetSystemInfo RaiseException ReleaseSemaphore GetProcessHeap OutputDebugStringW DebugBreak IsDebuggerPresent CreateHardLinkW DeviceIoControl SetLastError HeapFree HeapAlloc HeapDestroy HeapCreate LoadLibraryW FreeLibrary Sleep WriteFile SetFileTime SetFilePointer OpenSemaphoreW SetEndOfFile ReadFile GetFileSize CreateFileW MoveFileW GetTickCount GetCPInfoExW GetOEMCP GetACP GetCurrentProcess GetVolumeInformationW GetDriveTypeW GlobalFree GlobalLock GlobalUnlock GlobalSize GlobalAlloc CreateMutexW ReleaseMutex GetLastError MultiByteToWideChar GetProcAddress GetModuleHandleW GetVersionExW GetCurrentThreadId GetCurrentProcessId CopyFileW RtlUnwind WaitForSingleObject CloseHandle GetCommandLineW GetPhysicallyInstalledSystemMemory FindFirstFileW GetStartupInfoW FindClose

user32

CharToOemBuffW OemToCharA GetScrollBarInfo IsDialogMessageW CreateDialogIndirectParamW PostQuitMessage DispatchMessageW TranslateMessage GetMessageW MessageBeep CharToOemA PeekMessageW MapDialogRect GetSystemMenu DialogBoxIndirectParamW GetScrollInfo EnableMenuItem CheckMenuItem MoveWindow PostMessageW AppendMenuW GetMenuItemCount DrawMenuBar ClientToScreen CallWindowProcW InsertMenuItemW DeleteMenu InsertMenuW GetSubMenu DestroyMenu CreatePopupMenu IsWindow LoadCursorW WindowFromPoint SetCursor GetMenuItemID SetMenu OemToCharBuffW LoadAcceleratorsW SendInput IsChild SetUserObjectInformationW GetClipboardData LoadIconW CreateDialogParamW SetScrollRange SetScrollPos ScrollWindowEx CreateIconIndirect FindWindowW TranslateAcceleratorW BringWindowToTop FlashWindow EnumDisplayMonitors SetProcessDefaultLayout GetIconInfo MessageBoxW GetForegroundWindow SendMessageW DefWindowProcW CreateWindowExW DestroyWindow SetFocus GetClientRect DrawFocusRect FillRect GetWindowLongW SetWindowLongW GetComboBoxInfo SetWindowPos keybd_event FlashWindowEx CreateIcon EnumWindows SetForegroundWindow IsCharAlphaW CopyRect LoadStringW ExitWindowsEx CharUpperW CharLowerW LoadMenuW GetLastActivePopup RegisterClassExW DrawEdge GetKeyState RegisterClipboardFormatW GetClassNameW GetDesktopWindow IntersectRect GetWindowTextLengthW GetWindowTextW EnableWindow IsIconic UnhookWinEvent SetWinEventHook GetWindowPlacement SetWindowPlacement IsWindowVisible DialogBoxParamW EndDialog GetDlgItem SetDlgItemInt GetDlgItemInt SetDlgItemTextW IsDlgButtonChecked SendDlgItemMessageW GetWindowRect MapWindowPoints GetParent DestroyIcon ShowWindow UpdateWindow GetDlgItemTextW CheckDlgButton OpenClipboard CloseClipboard SetClipboardData EmptyClipboard SetTimer KillTimer GetWindowDC ReleaseDC SetWindowTextW CharToOemBuffA WaitForInputIdle IsWindowEnabled RegisterWindowMessageW RegisterClassW GetFocus GetAsyncKeyState GetSystemMetrics GetMenu TrackPopupMenu SetMenuInfo GetMenuItemInfoW SetMenuItemInfoW DrawTextW GetDC BeginPaint EndPaint InvalidateRect RedrawWindow ValidateRect DrawIconEx LoadImageW SetPropW GetPropW SystemParametersInfoW CopyImage CallNextHookEx UnhookWindowsHookEx SetWindowsHookExW GetWindow GetWindowThreadProcessId FindWindowExW SetWindowLongPtrW GetWindowLongPtrW PtInRect GetSysColor ScreenToClient GetCursorPos RemovePropW OemToCharBuffA

gdi32

CreateFontW GetTextFaceW LineTo MoveToEx CreateBitmap TextOutW GetMapMode SetMapMode StretchBlt DPtoLP GetPixel CreateDIBSection SetPixel TextOutA GetObjectW Rectangle GetTextExtentPoint32W ExcludeClipRect GetStockObject CreateSolidBrush CreatePen CreateFontIndirectW SelectObject DeleteObject DeleteDC CreateCompatibleDC CreateCompatibleBitmap BitBlt ExtTextOutW GetTextMetricsW GetDeviceCaps SetBkColor SetTextColor

comdlg32

CommDlgExtendedError GetSaveFileNameW GetOpenFileNameW ChooseFontW

shell32

DragFinish DragAcceptFiles SHGetFolderPathW DragQueryFileW ShellExecuteW SHGetSpecialFolderLocation SHGetMalloc SHAddToRecentDocs ord100 SHGetPathFromIDListEx SHFileOperationW ShellExecuteExW SHCreateItemFromParsingName SHChangeNotify SHGetStockIconInfo SHGetDesktopFolder SHGetFolderLocation SHGetFileInfoW Shell_NotifyIconW

ole32

RegisterDragDrop OleUninitialize OleInitialize CLSIDFromString CreateStreamOnHGlobal CoTaskMemAlloc RevokeDragDrop DoDragDrop CoTaskMemFree CoInitializeEx CoUninitialize CoCreateInstance CoSetProxyBlanket OleSetClipboard

oleaut32

VariantCopy VariantClear VariantInit SysFreeString SysAllocString

shlwapi

StrCmpLogicalW ord219 ord176 SHAutoComplete AssocQueryStringW

powrprof

SetSuspendState

comctl32

InitCommonControlsEx ImageList_ReplaceIcon ImageList_Create CreateStatusWindowW ord380 PropertySheetW ord381 ord413 ord412 ord410 ImageList_GetIconSize ImageList_Draw

uxtheme

IsAppThemed OpenThemeData CloseThemeData GetThemePartSize SetWindowTheme IsThemeActive

gdiplus

GdipCreateBitmapFromFile GdipCreateBitmapFromStream GdipDisposeImage GdipCloneImage GdipFillPath GdipFillEllipse GdipFillPolygon GdipFillRectangle GdipDrawPath GdipDrawEllipse GdipDrawRectangle GdipDrawLineI GdipDrawLine GdipSetSmoothingMode GdipDeleteGraphics GdipCreateFromHDC GdipSetPenLineJoin GdipSetPenEndCap GdipSetPenStartCap GdipDeletePen GdipCreatePen1 GdipCreateSolidFill GdipCloneBrush GdipAddPathArc GdipAddPathLine GdipClosePathFigure GdipDeletePath GdipCreatePath GdipFree GdipAlloc GdipCreateHBITMAPFromBitmap GdiplusStartup GdiplusShutdown GdipCreateBitmapFromHBITMAP GdipBitmapGetPixel GdipBitmapSetPixel GdipDeleteBrush

msimg32

AlphaBlend GradientFill

dwmapi

DwmSetWindowAttribute

Name

.text

Size

2.0MB

Virtual Size

2.0MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

337KB

Virtual Size

337KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

44KB

Virtual Size

350KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

52KB

Virtual Size

51KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.didat

Size

512B

Virtual Size

328B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

787KB

Virtual Size

787KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

8KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-28_cbf010695eea3dc4e1ad5384a79bf902_cryptbot_icedid_njrat_stealc

PE Signature issue

kernel32

user32

gdi32

comdlg32

shell32

ole32

oleaut32

shlwapi

powrprof

comctl32

uxtheme

gdiplus

msimg32

dwmapi

generic