2026-06-26_2d69ce6ba485de58e5752f376d711f86_icedid_njrat_ryuk

Sharing

Copy URL Twitter E-mail

General

Target
2026-06-26_2d69ce6ba485de58e5752f376d711f86_icedid_njrat_ryuk
Size 953KB
Sample260629-vr78vsav4x
SHA256 88add5ccd2488425ae1fb2deac6b6c6d4cd2d09ac26c02644b01d695fdb7c813
MD5 2d69ce6ba485de58e5752f376d711f86
SHA1 3aa5f4418a75e69c5ed2445674a03365dffed201
SHA512 f2dd08fb9089a2877352a471b287c799689ba7e16b2e9d69048940a86574d38b9bda44e70381d026f45724f0e80448dc6662658efed6680d138447cdf725dc22
SSDEEP 24576:Qot3+TporGvTWQMSBhvn/+r18fVSnrLFY+iOOMAep10:zt3+T4K5dBh3qIVSnN7iOOMXpi
TLSH
T1A325014536D404F8E5B3C678C9715616E2B67C665B30C79F03A4276B9F333A0AE3AB12
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-06-26_2d69ce6ba485de58e5752f376d711f86_icedid_njrat_ryuk

File Explorer

2026-06-26_2d69ce6ba485de58e5752f376d711f86_icedid_njrat_ryuk

.exe 953KB

2026-06-26_2d69ce6ba485de58e5752f376d711f86_icedid_njrat_ryuk

IMPHASH 9c508ba095ca410ec4aeab8f15f92b9b
SHA256 88add5ccd2488425ae1fb2deac6b6c6d4cd2d09ac26c02644b01d695fdb7c813
MD5 2d69ce6ba485de58e5752f376d711f86
SHA1 3aa5f4418a75e69c5ed2445674a03365dffed201
SHA512 f2dd08fb9089a2877352a471b287c799689ba7e16b2e9d69048940a86574d38b9bda44e70381d026f45724f0e80448dc6662658efed6680d138447cdf725dc22
SSDEEP 24576:Qot3+TporGvTWQMSBhvn/+r18fVSnrLFY+iOOMAep10:zt3+T4K5dBh3qIVSnN7iOOMXpi
TLSH
T1A325014536D404F8E5B3C678C9715616E2B67C665B30C79F03A4276B9F333A0AE3AB12
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

50544

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\Projects\WinRAR\uninstall\build\uninstall64\Release\uninstall.pdb

kernel32

FindFirstFileW FindNextFileW GetVersionExW GetCurrentDirectoryW FindResourceW FreeLibrary LoadLibraryW LoadLibraryExW GetProcAddress GetCurrentProcessId GetModuleHandleW GetSystemDirectoryW GetCPInfo IsDBCSLeadByte MultiByteToWideChar WideCharToMultiByte CompareStringW GetModuleHandleExW GetShortPathNameW Sleep GetTempPathW SetCurrentDirectoryW CreateProcessW GetCommandLineW GetEnvironmentVariableW CopyFileW MoveFileExW SetStdHandle FindClose GetProcessHeap FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetOEMCP IsValidCodePage FindNextFileA FindFirstFileExA LCMapStringW SetFilePointerEx HeapReAlloc GetConsoleMode GetConsoleCP HeapAlloc HeapFree GetACP GetModuleFileNameA ExitProcess QueryPerformanceFrequency TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount DeleteCriticalSection LeaveCriticalSection EnterCriticalSection EncodePointer RtlUnwindEx RaiseException RtlVirtualUnwind RtlPcToFileHeader InitializeSListHead GetSystemTimeAsFileTime ExpandEnvironmentStringsW MoveFileW SetFileAttributesW RemoveDirectoryW GetDiskFreeSpaceExW CreateFileW CloseHandle SetFileTime SetFilePointer SetEndOfFile FlushFileBuffers ReadFile GetStdHandle WriteFile GetFileType SetLastError GetLastError DeleteFileW GetFileAttributesW CreateDirectoryW GetModuleFileNameW GetStringTypeW WriteConsoleW ReadConsoleW RtlLookupFunctionEntry HeapSize UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW QueryPerformanceCounter GetCurrentThreadId RtlCaptureContext

user32

CharUpperW SendMessageW ShowWindow GetDlgItem EnableWindow InvalidateRect SetWindowTextW GetParent DialogBoxParamW EndDialog SetDlgItemTextW GetDlgItemTextW CheckDlgButton IsDlgButtonChecked OemToCharA LoadIconW GetSysColor SendDlgItemMessageW MessageBoxW GetDesktopWindow ReleaseDC GetDC IsWindowVisible IsWindow SetForegroundWindow LoadStringW GetWindow GetClassNameW SetProcessDefaultLayout GetWindowLongPtrW SetWindowLongW GetWindowLongW GetWindowRect GetClientRect GetSystemMetrics SetWindowPos

gdi32

GetDeviceCaps DeleteObject CreateFontW

advapi32

RegEnumKeyExW RegDeleteValueW RegDeleteKeyW RegCreateKeyExW RegQueryValueExW RegOpenKeyExW RegCloseKey RegSetValueExW

shell32

ShellExecuteW SHGetSpecialFolderLocation SHGetPathFromIDListW SHGetMalloc SHChangeNotify SHGetFolderPathW SHFileOperationW

ole32

OleUninitialize OleInitialize CoCreateInstance

Name

.text

Size

132KB

Virtual Size

131KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

58KB

Virtual Size

57KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

46KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

7KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

181KB

Virtual Size

184KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

568KB

Virtual Size

572KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-06-26_2d69ce6ba485de58e5752f376d711f86_icedid_njrat_ryuk

kernel32

user32

gdi32

advapi32

shell32

ole32

generic