2026-11-02_cdefa826895e4d8e970b5837064d380b_icedid_njrat

Sharing

Copy URL Twitter E-mail

General

Target
2026-11-02_cdefa826895e4d8e970b5837064d380b_icedid_njrat
Size 13.4MB
Sample261102-2a8avsxtby
SHA256 a63cc7c88033af605f82e9c1a9dc0e38ebad593a76bad98cb76b736a01c3f0a4
MD5 cdefa826895e4d8e970b5837064d380b
SHA1 febf5089b338ec11960ba076df3b781156f17670
SHA512 3ee10b12e43998258c328a72815cf91e77578733dacf74d1a09cb20a557d5912e83700558e1f8982406d2891b9b06b9b235de52dc071cecc775c0c2fd7400501
SSDEEP 196608:t51mobTZlVw2HZQ3yi2tMYHcwn1GavPFYXvN5rOqJr9Fmm+CmuElE:t3moDfi2trJn9vPuFh37Fm7CmJlE
TLSH
T175E68C0704A6446CD3BF2BBD87FA1009EE5234D40B6463EBEDA493B55E63EDC05B9B18
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-11-02_cdefa826895e4d8e970b5837064d380b_icedid_njrat

File Explorer

2026-11-02_cdefa826895e4d8e970b5837064d380b_icedid_njrat

.exe 13.4MB

2026-11-02_cdefa826895e4d8e970b5837064d380b_icedid_njrat

IMPHASH 2c0a8ef20306b62e33da2ccf63a4ea51
SHA256 a63cc7c88033af605f82e9c1a9dc0e38ebad593a76bad98cb76b736a01c3f0a4
MD5 cdefa826895e4d8e970b5837064d380b
SHA1 febf5089b338ec11960ba076df3b781156f17670
SHA512 3ee10b12e43998258c328a72815cf91e77578733dacf74d1a09cb20a557d5912e83700558e1f8982406d2891b9b06b9b235de52dc071cecc775c0c2fd7400501
SSDEEP 196608:t51mobTZlVw2HZQ3yi2tMYHcwn1GavPFYXvN5rOqJr9Fmm+CmuElE:t3moDfi2trJn9vPuFh37Fm7CmJlE
TLSH
T175E68C0704A6446CD3BF2BBD87FA1009EE5234D40B6463EBEDA493B55E63EDC05B9B18
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

3338240

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

LockResource DeleteFileA GlobalAlloc CloseHandle LoadResource SetFileAttributesA GetProcAddress GlobalLock LocalFree GetFileSize ExitProcess lstrcpynA GetCurrentProcessId FreeLibrary GetConsoleWindow CreateDirectoryA QueryPerformanceCounter GlobalUnlock IsDebuggerPresent GetComputerNameA CheckRemoteDebuggerPresent FlushFileBuffers GetExitCodeProcess WriteConsoleW CreateFileW GetConsoleMode GetConsoleOutputCP HeapReAlloc GetSystemDirectoryA SetFilePointerEx GetStringTypeW SetStdHandle GetProcessHeap GetVolumeInformationA LCMapStringW LoadLibraryExW VirtualProtect FreeEnvironmentStringsW GetEnvironmentStringsW WideCharToMultiByte MultiByteToWideChar GetCommandLineW GetCommandLineA GetCPInfo GetOEMCP GetACP IsValidCodePage FindNextFileW GetCurrentThread CreateFileA GetFileAttributesA CopyFileA GetTickCount64 Sleep GetSystemWindowsDirectoryA GetModuleHandleA ResumeThread HeapSize WaitForSingleObject GetEnvironmentVariableA FindResourceA SetFilePointer SetThreadPriority GetProcessId WriteFile GetCurrentProcess ReadFile FindFirstFileExW FindClose GetFileSizeEx MoveFileA SizeofResource GetFileType HeapAlloc HeapFree UnhandledExceptionFilter RtlVirtualUnwind RtlCaptureContext IsProcessorFeaturePresent GetStdHandle GetModuleFileNameW GetModuleHandleExW TerminateProcess DeleteCriticalSection InitializeCriticalSectionEx LeaveCriticalSection EnterCriticalSection EncodePointer GetModuleFileNameA ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW SetUnhandledExceptionFilter GetStartupInfoW GetModuleHandleW GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead RtlLookupFunctionEntry RtlUnwindEx RtlPcToFileHeader RaiseException GetLastError SetLastError FlsAlloc FlsGetValue FlsSetValue FlsFree

user32

MapWindowPoints EnableWindow EndPaint GetNextDlgTabItem BeginPaint InvalidateRect UpdateWindow RegisterClassExA PtInRect GetParent PostQuitMessage KillTimer GetClientRect LoadIconA GetMessageA DispatchMessageA GetWindowRect LoadCursorA DestroyWindow FillRect GetSystemMetrics ShowWindow SetTimer SendMessageA GetWindowTextA DrawTextA TrackMouseEvent FrameRect SetWindowTextA IsWindowEnabled DefWindowProcA CreateWindowExA SetFocus TranslateMessage

gdi32

CreateFontA SelectObject SetTextColor SetBkMode LineTo CreatePen MoveToEx SetBkColor DeleteObject CreateSolidBrush

advapi32

CryptGenRandom CryptGetHashParam CryptDestroyHash CryptHashData CryptCreateHash CryptAcquireContextA CryptReleaseContext

ole32

CreateStreamOnHGlobal

comctl32

ord410 ord413

gdiplus

GdiplusStartup GdipCloneImage GdipAlloc GdipLoadImageFromStream GdipDeleteGraphics GdipCreateFromHDC GdipFree GdipSetPixelOffsetMode GdipSetInterpolationMode GdipDisposeImage GdipDrawImageRectI GdiplusShutdown

shlwapi

StrStrIA

crypt32

CryptProtectData

Name

.text

Size

174KB

Virtual Size

173KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

2.9MB

Virtual Size

2.9MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

7KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

89KB

Virtual Size

89KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.data1

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gfids

Size

10.0MB

Virtual Size

10.0MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.pdata1

Size

223KB

Virtual Size

222KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-11-02_cdefa826895e4d8e970b5837064d380b_icedid_njrat

kernel32

user32

gdi32

advapi32

ole32

comctl32

gdiplus

shlwapi

crypt32

generic