2026-11-02_cd9d3badf6999f4bc23ceefca3d7f9fa_icedid_njrat

Sharing

Copy URL Twitter E-mail

General

Target
2026-11-02_cd9d3badf6999f4bc23ceefca3d7f9fa_icedid_njrat
Size 1.6MB
Sample261102-2bxkraxtb1
SHA256 f77d96f206d2490d175badee1cdeb1872f8d7e0da33973cc5aa6ecef2a551de4
MD5 cd9d3badf6999f4bc23ceefca3d7f9fa
SHA1 1e53b976987d220b81ded27821a46cebbd216a80
SHA512 b65a1a96811c688335dfc64c5a8da743e9e98fbcb990e0332229baccf834aeec342c41da0bbc6dced0a8f2344be15b847eb3eea26e8cad48f8867f4936b962ba
SSDEEP 24576:9CAWB1B83tiUtE5wxkWaeV9vc5sFtasr9KPCi+57zpBSh6YAU:9o1BTjWDe+r9KPCi+57zpBSh6
TLSH
T15275E829EA7940E1E4FBC179C5631926FD3034B9033867D753859AC61B21FF8AA3D3A1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-11-02_cd9d3badf6999f4bc23ceefca3d7f9fa_icedid_njrat

File Explorer

2026-11-02_cd9d3badf6999f4bc23ceefca3d7f9fa_icedid_njrat

.exe 1.6MB

2026-11-02_cd9d3badf6999f4bc23ceefca3d7f9fa_icedid_njrat

IMPHASH 6a5cd8805b984f65d2a990d22d9b05e6
SHA256 f77d96f206d2490d175badee1cdeb1872f8d7e0da33973cc5aa6ecef2a551de4
MD5 cd9d3badf6999f4bc23ceefca3d7f9fa
SHA1 1e53b976987d220b81ded27821a46cebbd216a80
SHA512 b65a1a96811c688335dfc64c5a8da743e9e98fbcb990e0332229baccf834aeec342c41da0bbc6dced0a8f2344be15b847eb3eea26e8cad48f8867f4936b962ba
SSDEEP 24576:9CAWB1B83tiUtE5wxkWaeV9vc5sFtasr9KPCi+57zpBSh6YAU:9o1BTjWDe+r9KPCi+57zpBSh6
TLSH
T15275E829EA7940E1E4FBC179C5631926FD3034B9033867D753859AC61B21FF8AA3D3A1
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

852256

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\git\vanguard-modules\egm\x64\Debug\egm.pdb

ntdll

RtlLookupFunctionEntry RtlVirtualUnwind RtlPcToFileHeader RtlUnwindEx RtlInitUnicodeString NtQueryInformationProcess RtlCaptureContext

kernel32

FindClose FindFirstFileW FindNextFileW WideCharToMultiByte FreeEnvironmentStringsW LocalFree LocalAlloc CreateFileW LoadLibraryW GetEnvironmentStringsW GetOEMCP GetACP IsValidCodePage GetTimeZoneInformation HeapQueryInformation HeapReAlloc SetFilePointerEx GetProcAddress GetModuleHandleW FreeLibrary CloseHandle GetFinalPathNameByHandleW SetEnvironmentVariableW GetFileSizeEx GetConsoleMode GetConsoleOutputCP FlushFileBuffers GetLocaleInfoEx QueryPerformanceCounter FindFirstFileExW GetFileAttributesExW GetLastError MultiByteToWideChar GetStringTypeW EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection GetSystemTimeAsFileTime CreateProcessW EncodePointer DecodePointer LCMapStringEx CompareStringEx GetCPInfo GetCurrentThreadId UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW GetCurrentProcessId InitializeSListHead RaiseException HeapAlloc HeapFree GetProcessHeap VirtualQuery GetModuleFileNameW LoadLibraryExW SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree GetModuleHandleExW HeapSize HeapValidate GetSystemInfo GetStdHandle GetFileType WriteConsoleW ExitProcess WriteFile GetCommandLineA GetCommandLineW FlsAlloc FlsGetValue FlsSetValue FlsFree VirtualProtect GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW OutputDebugStringW WaitForSingleObject GetExitCodeProcess SetStdHandle

shell32

CommandLineToArgvW

wintrust

CryptCATAdminAcquireContext CryptCATAdminReleaseContext CryptCATAdminReleaseCatalogContext CryptCATCatalogInfoFromContext CryptCATAdminCalcHashFromFileHandle CryptCATAdminEnumCatalogFromHash

crypt32

CertCloseStore CertGetNameStringW CryptMsgClose CryptDecodeObject CertFindCertificateInStore CertFreeCertificateContext CryptQueryObject CryptMsgGetParam

Name

.text

Size

1.3MB

Virtual Size

1.3MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

199KB

Virtual Size

199KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

8KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

66KB

Virtual Size

66KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.msvcjmc

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-11-02_cd9d3badf6999f4bc23ceefca3d7f9fa_icedid_njrat

ntdll

kernel32

shell32

wintrust

crypt32

generic