2026-06-08_28ba91b7f4cd765a4c175b4f94005587_icedid_njrat_ryuk

Sharing

Copy URL Twitter E-mail

General

Target
2026-06-08_28ba91b7f4cd765a4c175b4f94005587_icedid_njrat_ryuk
Size 1.6MB
Sample260608-pyfvasdv5r
SHA256 5e55dbd8e883ef39d941efc8e5e8004bc6be20cfd80f05da8dbd9c7e847cd81c
MD5 28ba91b7f4cd765a4c175b4f94005587
SHA1 f63cd6262608147dda34d8d10429e2b32b9f6778
SHA512 f3a4d4eaf04f3c1e248fd19e3d39699e593be062268e5a5ead1251f4a1bfda680dc25c21d52baefd1f643cd633527d2196c16178b059729de351a4b1c4fd64d4
SSDEEP 24576:uVt3+TLIecwXbDDSBhvn/+r1zd/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:Yt3+T73rD2Bh3qzLNiXicJFFRGNzj3
TLSH
T10775014563D804F4E5B78138C962491AE2B67C558B30C79F0364276BDF37BA1EE39B22
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-06-08_28ba91b7f4cd765a4c175b4f94005587_icedid_njrat_ryuk

File Explorer

2026-06-08_28ba91b7f4cd765a4c175b4f94005587_icedid_njrat_ryuk

.exe 1.6MB

2026-06-08_28ba91b7f4cd765a4c175b4f94005587_icedid_njrat_ryuk

IMPHASH 3ec1d94e2ff31c3d07f06205adadd09b
SHA256 5e55dbd8e883ef39d941efc8e5e8004bc6be20cfd80f05da8dbd9c7e847cd81c
MD5 28ba91b7f4cd765a4c175b4f94005587
SHA1 f63cd6262608147dda34d8d10429e2b32b9f6778
SHA512 f3a4d4eaf04f3c1e248fd19e3d39699e593be062268e5a5ead1251f4a1bfda680dc25c21d52baefd1f643cd633527d2196c16178b059729de351a4b1c4fd64d4
SSDEEP 24576:uVt3+TLIecwXbDDSBhvn/+r1zd/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:Yt3+T73rD2Bh3qzLNiXicJFFRGNzj3
TLSH
T10775014563D804F4E5B78138C962491AE2B67C558B30C79F0364276BDF37BA1EE39B22
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

50512

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\Projects\WinRAR\uninstall\build\uninstall64\Release\uninstall.pdb

kernel32

FindNextFileW GetVersionExW GetCurrentDirectoryW FindResourceW FreeLibrary LoadLibraryW LoadLibraryExW GetProcAddress GetCurrentProcessId GetModuleHandleW GetSystemDirectoryW GetCPInfo IsDBCSLeadByte MultiByteToWideChar WideCharToMultiByte CompareStringW GetModuleHandleExW GetShortPathNameW Sleep GetTempPathW SetCurrentDirectoryW CreateProcessW GetCommandLineW GetEnvironmentVariableW RemoveDirectoryW CopyFileW MoveFileExW SetStdHandle FindFirstFileW GetProcessHeap FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetOEMCP IsValidCodePage FindNextFileA FindFirstFileExA LCMapStringW SetFilePointerEx HeapReAlloc GetConsoleMode GetConsoleCP HeapAlloc HeapFree GetACP GetModuleFileNameA ExitProcess QueryPerformanceFrequency TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount DeleteCriticalSection LeaveCriticalSection EnterCriticalSection EncodePointer RtlUnwindEx RtlVirtualUnwind RaiseException RtlPcToFileHeader InitializeSListHead FindClose ExpandEnvironmentStringsW MoveFileW SetFileAttributesW GetDiskFreeSpaceExW CreateFileW CloseHandle SetFileTime SetFilePointer SetEndOfFile FlushFileBuffers ReadFile GetStdHandle WriteFile GetFileType SetLastError GetLastError DeleteFileW GetFileAttributesW CreateDirectoryW GetModuleFileNameW GetStringTypeW WriteConsoleW ReadConsoleW RtlLookupFunctionEntry HeapSize UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW QueryPerformanceCounter GetSystemTimeAsFileTime GetCurrentThreadId RtlCaptureContext

user32

CharUpperW SendMessageW ShowWindow GetDlgItem EnableWindow InvalidateRect SetWindowTextW GetParent DialogBoxParamW EndDialog SetDlgItemTextW GetDlgItemTextW CheckDlgButton IsDlgButtonChecked OemToCharA LoadIconW GetSysColor SendDlgItemMessageW MessageBoxW GetDesktopWindow ReleaseDC GetDC IsWindowVisible IsWindow SetForegroundWindow LoadStringW GetWindow GetClassNameW SetProcessDefaultLayout GetWindowLongPtrW SetWindowLongW GetWindowLongW GetWindowRect GetClientRect GetSystemMetrics SetWindowPos

gdi32

GetDeviceCaps DeleteObject CreateFontW

advapi32

RegEnumKeyExW RegDeleteValueW RegDeleteKeyW RegCreateKeyExW RegQueryValueExW RegOpenKeyExW RegCloseKey RegSetValueExW

shell32

ShellExecuteW SHGetSpecialFolderLocation SHGetPathFromIDListW SHGetMalloc SHChangeNotify SHGetFolderPathW SHFileOperationW

ole32

OleUninitialize OleInitialize CoCreateInstance

Name

.text

Size

132KB

Virtual Size

131KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

58KB

Virtual Size

57KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

46KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

7KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

181KB

Virtual Size

184KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

1.2MB

Virtual Size

1.9MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-06-08_28ba91b7f4cd765a4c175b4f94005587_icedid_njrat_ryuk

kernel32

user32

gdi32

advapi32

shell32

ole32

generic