2026-11-07_23cef385e901776db41ae668d1c2e151_icedid_njrat_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-11-07_23cef385e901776db41ae668d1c2e151_icedid_njrat_stealc
Size 2.5MB
Sample261107-tlnrlafc96
SHA256 5416a5fdb42d5d966e6159f886a50406284d5323fee7ff0fdffcd776f24affd1
MD5 23cef385e901776db41ae668d1c2e151
SHA1 c59dee6fe5700941eee4ee1822efecd46e7406fa
SHA512 a6b9e0730196f1ce24f32d15696d49f46123a9f07d59031bc1395a0ace88590556cd9a59189eb4615f93b467a4e4501a104fada068e40c007a8beb2ca3b66ba2
SSDEEP 49152:6dHtnh85+HDUG8uTFdUWQKC7ols6AYAP20z1OgXmyrkHsmXrnEfq:QkQnlYr5OgvkHB
TLSH
T173C5CF02B2A605E9C136E074A86E6A07E73178481B707BEB17E509295FF76D01FFB613
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-11-07_23cef385e901776db41ae668d1c2e151_icedid_njrat_stealc

File Explorer

2026-11-07_23cef385e901776db41ae668d1c2e151_icedid_njrat_stealc

.exe 2.5MB

2026-11-07_23cef385e901776db41ae668d1c2e151_icedid_njrat_stealc

IMPHASH bd5f1fb57eea562732efbe68e2667632
SHA256 5416a5fdb42d5d966e6159f886a50406284d5323fee7ff0fdffcd776f24affd1
MD5 23cef385e901776db41ae668d1c2e151
SHA1 c59dee6fe5700941eee4ee1822efecd46e7406fa
SHA512 a6b9e0730196f1ce24f32d15696d49f46123a9f07d59031bc1395a0ace88590556cd9a59189eb4615f93b467a4e4501a104fada068e40c007a8beb2ca3b66ba2
SSDEEP 49152:6dHtnh85+HDUG8uTFdUWQKC7ols6AYAP20z1OgXmyrkHsmXrnEfq:QkQnlYr5OgvkHB
TLSH
T173C5CF02B2A605E9C136E074A86E6A07E73178481B707BEB17E509295FF76D01FFB613
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1191092

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

d3d11

D3D11CreateDeviceAndSwapChain

d3dcompiler_47

D3DCompile

ole32

CoCreateInstance CoTaskMemFree CoInitializeEx CoUninitialize

kernel32

CreatePipe GetExitCodeProcess ReadConsoleW GetConsoleMode GetSystemTimePreciseAsFileTime QueryPerformanceCounter QueryPerformanceFrequency Sleep GetTickCount64 GetModuleHandleW GetCurrentProcess K32GetProcessMemoryInfo OutputDebugStringA GetWindowsDirectoryW CloseHandle WaitForSingleObject CreateThread FreeLibrary FreeLibraryAndExitThread GetModuleHandleExW MultiByteToWideChar GetFileAttributesW CreateFileW GetFileAttributesExW ReadFile SetFilePointerEx GetModuleFileNameW GetCurrentProcessId SetEvent CreateEventW WaitForMultipleObjects GetFileSizeEx GetLastError OpenProcess QueryFullProcessImageNameW GetApplicationUserModelId DeleteFileW GetProcAddress GetEnvironmentVariableW CreateDirectoryW FindClose FindFirstFileW FindNextFileW FlushFileBuffers WriteFile FormatMessageW MoveFileExW CompareStringOrdinal WideCharToMultiByte GetLocalTime GlobalAlloc GlobalUnlock GlobalLock GlobalFree LoadLibraryA GetTimeZoneInformation IsDBCSLeadByte HeapAlloc HeapReAlloc HeapFree GetCurrentThreadId VirtualProtect GetConsoleOutputCP GetFileType LCMapStringW CompareStringW FlsFree FlsSetValue FlsGetValue FlsAlloc GetCommandLineW GetCommandLineA GetStdHandle ExitProcess ExitThread CreateProcessW DuplicateHandle LoadLibraryExW TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount DeleteCriticalSection LeaveCriticalSection SetEnvironmentVariableW EnterCriticalSection EncodePointer SetLastError InterlockedFlushSList InterlockedPushEntrySList RtlUnwindEx RaiseException RtlPcToFileHeader InitializeSListHead GetProcessHeap FindFirstFileExW IsValidCodePage GetACP GetStartupInfoW IsDebuggerPresent IsProcessorFeaturePresent GetOEMCP GetCPInfo GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle GetLocaleInfoA GetStringTypeW WriteConsoleW SetEndOfFile HeapSize ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive WaitForSingleObjectEx GetExitCodeThread WakeConditionVariable WakeAllConditionVariable SleepConditionVariableSRW InitOnceBeginInitialize InitOnceComplete InitializeCriticalSectionEx GetSystemTimeAsFileTime RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess

user32

GetMessageExtraInfo TrackMouseEvent GetKeyboardLayout EmptyClipboard GetClipboardData SetClipboardData CloseClipboard OpenClipboard CharLowerBuffW GetWindowThreadProcessId GetKeyState GetAsyncKeyState AdjustWindowRect UpdateWindow ShowWindow DestroyWindow CreateWindowExW RegisterClassExW UnregisterClassW PostQuitMessage DefWindowProcW PeekMessageW DispatchMessageW TranslateMessage GetCapture SetCapture ReleaseCapture IsWindowUnicode GetClientRect SetCursorPos SetCursor GetCursorPos ClientToScreen ScreenToClient LoadCursorA GetForegroundWindow

shell32

SHCreateItemInKnownFolder ShellExecuteW

advapi32

RegGetValueW

imm32

ImmReleaseContext ImmSetCompositionWindow ImmSetCandidateWindow ImmGetContext

oleaut32

SetErrorInfo GetErrorInfo SysFreeString SysStringLen

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory

api-ms-win-core-winrt-error-l1-1-1

RoOriginateLanguageException

Name

.text

Size

1.3MB

Virtual Size

1.3MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.0MB

Virtual Size

1.0MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

38KB

Virtual Size

134KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

58KB

Virtual Size

57KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

24KB

Virtual Size

23KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-11-07_23cef385e901776db41ae668d1c2e151_icedid_njrat_stealc

d3d11

d3dcompiler_47

ole32

kernel32

user32

shell32

advapi32

imm32

oleaut32

api-ms-win-core-winrt-l1-1-0

api-ms-win-core-winrt-error-l1-1-1

generic