2026-11-03_4383043f00a06a2d080806e2962a2af4_icedid_njrat_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-11-03_4383043f00a06a2d080806e2962a2af4_icedid_njrat_stealc
Size 1.2MB
Sample261104-2bwcpaf18j
SHA256 f5fee275e31c4ec5fc56fde34c524bd83955cc2488610bc6ebffb238e4046608
MD5 4383043f00a06a2d080806e2962a2af4
SHA1 344795bbfae7d49c0d82a528853b74b598776d9b
SHA512 b96bca2e9292b255f02a1ae381433654d1c03283e1c1fa22751b05905467a8cb870c94f2b1c2f18423011601436a85037bf97827e11488e56382e6df2a2b97ab
SSDEEP 24576:qM36J+dIYf166XGe/7CY4YVXq02/kuj+DBgzwShnd86:qa6J5YH5jCY4qqDkMVln
TLSH
T1F745CF45B6A941F8C0BBD038D956B50BFA31381507305AEB23E45A692F63BE09F7F712
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-11-03_4383043f00a06a2d080806e2962a2af4_icedid_njrat_stealc

File Explorer

2026-11-03_4383043f00a06a2d080806e2962a2af4_icedid_njrat_stealc

.exe 1.2MB

2026-11-03_4383043f00a06a2d080806e2962a2af4_icedid_njrat_stealc

IMPHASH 37b8d8c4aa1c03afbbea5833babc64bf
SHA256 f5fee275e31c4ec5fc56fde34c524bd83955cc2488610bc6ebffb238e4046608
MD5 4383043f00a06a2d080806e2962a2af4
SHA1 344795bbfae7d49c0d82a528853b74b598776d9b
SHA512 b96bca2e9292b255f02a1ae381433654d1c03283e1c1fa22751b05905467a8cb870c94f2b1c2f18423011601436a85037bf97827e11488e56382e6df2a2b97ab
SSDEEP 24576:qM36J+dIYf166XGe/7CY4YVXq02/kuj+DBgzwShnd86:qa6J5YH5jCY4qqDkMVln
TLSH
T1F745CF45B6A941F8C0BBD038D956B50BFA31381507305AEB23E45A692F63BE09F7F712
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

469380

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\cartu\Documents\CS2X FIRST RELEASE\CS2X UPDATED\bin_free\cs2x_free.pdb

shell32

SHGetKnownFolderPath ShellExecuteA ShellExecuteW

advapi32

RegGetValueW

gdi32

RoundRect CreateSolidBrush DeleteObject CreatePen SetBkMode SetTextColor DeleteDC GetDeviceCaps CreateFontW CreateCompatibleDC SelectObject CreateCompatibleBitmap BitBlt GetTextExtentPoint32W TextOutW CreateDIBSection CreateFontA

user32

GetCursorInfo EndPaint BeginPaint ReleaseDC InvalidateRect SetForegroundWindow PtInRect KillTimer DrawTextW SetCursor LoadCursorW TranslateMessage SetTimer DispatchMessageW IsWindow RegisterClassExW GetWindowLongPtrW GetSystemMetrics SendMessageW CreateWindowExW FillRect SetWindowLongPtrW GetDC DestroyWindow DefWindowProcW GetMessageW EnableWindow PostQuitMessage UpdateLayeredWindow GetClientRect GetKeyState GetMessageExtraInfo TrackMouseEvent GetKeyboardLayout SetCapture IsWindowUnicode SetCursorPos OpenClipboard CloseClipboard EmptyClipboard GetClipboardData SetClipboardData EqualRect ScreenToClient GetCapture ClipCursor SystemParametersInfoW ReleaseCapture SetLayeredWindowAttributes MessageBoxW MonitorFromPoint GetMonitorInfoW GetClipCursor GetForegroundWindow EnumDisplaySettingsW SendInput GetAsyncKeyState GetCursorPos GetWindowThreadProcessId GetWindowRect IsWindowVisible SetWindowPos UnregisterClassW WindowFromPoint ShowWindow ClientToScreen PeekMessageW GetWindowTextA IsWindowEnabled EnumWindows

d3d11

D3D11CreateDeviceAndSwapChain D3D11CreateDevice

d2d1

ord1

dwrite

DWriteCreateFactory

dcomp

DCompositionCreateDevice

winmm

timeEndPeriod timeBeginPeriod

d3dcompiler_47

D3DCompile

ole32

CoCreateInstance CoInitializeEx CoTaskMemFree CoUninitialize

imm32

ImmSetCompositionWindow ImmReleaseContext ImmGetContext ImmSetCandidateWindow

ws2_32

closesocket WSAStartup send socket WSACleanup listen select accept recv htonl htons setsockopt bind

kernel32

GetACP IsValidCodePage HeapReAlloc SetStdHandle ReadConsoleW EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW VirtualProtect FlsFree FlsSetValue FlsGetValue FlsAlloc HeapAlloc HeapFree GetConsoleMode GetConsoleOutputCP FlushFileBuffers GetFileType SetFilePointerEx GetFileSizeEx GetCommandLineA GetOEMCP GetStdHandle ReadFile DuplicateHandle GetModuleHandleExW FreeLibraryAndExitThread ExitThread CreateThread LoadLibraryExW TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount SetLastError RaiseException RtlPcToFileHeader RtlUnwindEx GetStartupInfoW IsDebuggerPresent InitializeSListHead GetCurrentProcessId IsProcessorFeaturePresent TerminateProcess GetCurrentProcess SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext GetCPInfo GetStringTypeW GetEnvironmentStringsW FreeEnvironmentStringsW GetSystemTimeAsFileTime SetEnvironmentVariableW GetProcessHeap LCMapStringEx DecodePointer EncodePointer DeleteCriticalSection InitializeCriticalSectionEx HeapSize WriteConsoleW SetEndOfFile WriteFile ExitProcess LeaveCriticalSection EnterCriticalSection TryAcquireSRWLockExclusive GetFileInformationByHandleEx MultiByteToWideChar MoveFileExW CreateToolhelp32Snapshot Process32NextW Process32FirstW CloseHandle GetModuleHandleW MulDiv OpenProcess Module32FirstW ReadProcessMemory Module32NextW GetExitCodeProcess GetCommandLineW GetLastError CreateDirectoryW SetConsoleTitleA GetModuleFileNameW RtlUnwind GetConsoleWindow AllocConsole SetConsoleTitleW GlobalAlloc GlobalFree GlobalLock WideCharToMultiByte GlobalUnlock GetLocaleInfoA LoadLibraryA QueryPerformanceFrequency GetProcAddress FreeLibrary QueryPerformanceCounter ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW WaitForSingleObjectEx Sleep GetCurrentThreadId GetExitCodeThread CreateFileW FindClose FindFirstFileW FindFirstFileExW FindNextFileW GetFileAttributesExW SetFileInformationByHandle

Name

.text

Size

647KB

Virtual Size

647KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

507KB

Virtual Size

506KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

28KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

28KB

Virtual Size

28KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-11-03_4383043f00a06a2d080806e2962a2af4_icedid_njrat_stealc

shell32

advapi32

gdi32

user32

d3d11

d2d1

dwrite

dcomp

winmm

d3dcompiler_47

ole32

imm32

ws2_32

kernel32

generic