2026-10-30_022367d8308804f971c7b2660c38dd74_icedid

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-30_022367d8308804f971c7b2660c38dd74_icedid
Size 1.2MB
Sample261101-hs7bqsaz7k
SHA256 696c0efdd3e43f0bf1bce9c922275a72e59165506caffde241e60975e1225916
MD5 022367d8308804f971c7b2660c38dd74
SHA1 91af659d36f92d3b32e091b2562e9fc161ef5e22
SHA512 267222b6bd32e7f16082d6d8681eca0aa7c8a6c9cc0b9cd6ce4253d0496639aa98ed8173590994974c8cdcf6a2b92ec0f5adee61361dc6b69cf46b87af6eb91c
SSDEEP 24576:c5S+iaUhIWok5N1Wx+7jcI5dZ2A6rG5MdLDw/4UiYuZvdyaVgIj:c5Xiar
TLSH
T1FA45B07476046CF9E5AF817BCA9699ED137239538F47A8CF00A86B921D733B1EF25804
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Custom signature

Detects executables embedding registry key / value combination indicative of disabling Windows Defen 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
2026-10-30_022367d8308804f971c7b2660c38dd74_icedid

File Explorer

2026-10-30_022367d8308804f971c7b2660c38dd74_icedid

.exe 1.2MB

2026-10-30_022367d8308804f971c7b2660c38dd74_icedid

IMPHASH 262b9abab43c35cd7cb5c1b56a10fa6a
SHA256 696c0efdd3e43f0bf1bce9c922275a72e59165506caffde241e60975e1225916
MD5 022367d8308804f971c7b2660c38dd74
SHA1 91af659d36f92d3b32e091b2562e9fc161ef5e22
SHA512 267222b6bd32e7f16082d6d8681eca0aa7c8a6c9cc0b9cd6ce4253d0496639aa98ed8173590994974c8cdcf6a2b92ec0f5adee61361dc6b69cf46b87af6eb91c
SSDEEP 24576:c5S+iaUhIWok5N1Wx+7jcI5dZ2A6rG5MdLDw/4UiYuZvdyaVgIj:c5Xiar
TLSH
T1FA45B07476046CF9E5AF817BCA9699ED137239538F47A8CF00A86B921D733B1EF25804
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects executables embedding registry key / value combination indicative of disabling Windows Defen
Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

f2:3c:56:e4:a8:a6:5e:4e:69:c1:fa:fb:54:78:20:9e:12:ed:53:c3:02:45:e4:0c:2e:ab:fb:81:3f:52:89:0b

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=WinSvc Systems

Chains

Oct 30, 2026

CN=WinSvc Systems

Subject

CN=WinSvc Systems

Serial Number

35:ab:70:52:05:45:38:be:42:e1:5c:af:29:5f:34:bf

Issuer

CN=WinSvc Systems

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 23, 2026 - Oct 23, 2036

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2026 1,O=DigiCert\, Inc.,C=US

Serial Number

08:4f:dc:33:4f:7e:45:4e:db:c3:0f:8f:f9:92:18:35

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Aug 5, 2026 - Nov 4, 2037

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

211188

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Loader.pdb

ntdll

RtlUnwindEx RtlCaptureContext NtOpenFile NtCreateNamedPipeFile NtReadFile RtlNtStatusToDosError NtWriteFile RtlVirtualUnwind RtlLookupFunctionEntry RtlPcToFileHeader

kernel32

HeapSize LCMapStringW CompareStringW GetProcessHeap HeapFree FindClose CloseHandle FindFirstFileExW GetLastError FindNextFileW SetFileAttributesW CreateMutexW GetCurrentProcess GetTickCount64 GetCurrentProcessId GetACP GetOEMCP GetVersion GetConsoleCP GetSystemTimePreciseAsFileTime CreateThread SetHandleInformation WaitForSingleObject GetExitCodeProcess TerminateProcess WaitForMultipleObjects GetOverlappedResult SystemTimeToFileTime CreateFileW SetFileTime AddVectoredExceptionHandler SetThreadStackGuarantee GetCurrentThread HeapReAlloc GetCurrentThreadId SetLastError GetCurrentDirectoryW WaitForSingleObjectEx LoadLibraryA GetProcAddress FlushFileBuffers CreateMutexA ReleaseMutex WideCharToMultiByte GetModuleHandleW FormatMessageW GetStdHandle GetConsoleMode GetConsoleOutputCP MultiByteToWideChar WriteConsoleW FlsAlloc GetModuleHandleExW FlsFree IsThreadAFiber FlsSetValue HeapAlloc GetEnvironmentVariableW SleepEx ReadFileEx WriteFileEx QueryPerformanceFrequency QueryPerformanceCounter GetModuleHandleA GetFullPathNameW GetFileInformationByHandle GetFileInformationByHandleEx SetFileInformationByHandle CreateDirectoryW CreateEventW CancelIo ReadFile CompareStringOrdinal GetEnvironmentStringsW FreeEnvironmentStringsW GetSystemDirectoryW GetWindowsDirectoryW CreateProcessW GetFileAttributesW DuplicateHandle CreateWaitableTimerExW SetWaitableTimer Sleep VirtualProtect lstrlenW GetModuleFileNameW InitializeCriticalSectionEx FlsGetValue GetStringTypeW GetFileType SetStdHandle SetEnvironmentVariableW GetCPInfo IsValidCodePage GetCommandLineW GetCommandLineA ExitProcess WriteFile LoadLibraryExW FreeLibrary TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount DeleteCriticalSection GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent EncodePointer RaiseException EnterCriticalSection LeaveCriticalSection SetFilePointerEx

advapi32

OpenProcessToken GetTokenInformation

shell32

ShellExecuteW

user32

GetSystemMetrics GetDoubleClickTime GetCaretBlinkTime GetKeyboardType GetDesktopWindow GetKeyState

api-ms-win-core-synch-l1-2-0

WakeByAddressAll WakeByAddressSingle WaitOnAddress

ws2_32

WSASocketW WSAStartup freeaddrinfo getaddrinfo getsockopt ioctlsocket WSAGetLastError connect select closesocket

Name

.text

Size

264KB

Virtual Size

263KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

902KB

Virtual Size

902KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

11KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-30_022367d8308804f971c7b2660c38dd74_icedid

PE Signature issue

ntdll

kernel32

advapi32

shell32

user32

api-ms-win-core-synch-l1-2-0

ws2_32

generic