2026-07-23_2d397ecca6a5eff890da25af4643d012_icedid_njrat_ryuk

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-23_2d397ecca6a5eff890da25af4643d012_icedid_njrat_ryuk
Size 1.2MB
Sample260723-laka2aba74
SHA256 c8c4f15c8b222081ace5fe74e9ae9afe9fe3d67c893f06dc41c860bae3611a28
MD5 2d397ecca6a5eff890da25af4643d012
SHA1 6bc656fdbb3e4cddc66ff5c49268d381238c8dd6
SHA512 bbf8e9c257c50558dd5a048ab188c66081425eba07ede21420836d1b60ce9c8dcd8558776daaaa55fff1a2273e9414efb453dd148cf07dc2bbf633630ca31320
SSDEEP 24576:NDO3nQ1F8lNM+8t5wXWotDWi//dirlvZGMApYSRiO:kIF8U+E5UfqkdirbGbc
TLSH
T1C945D091A79C3EDAD13BC13DC5B64695EA31BC50136097CF01E423AA1E236E6BD3B721
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-23_2d397ecca6a5eff890da25af4643d012_icedid_njrat_ryuk

File Explorer

2026-07-23_2d397ecca6a5eff890da25af4643d012_icedid_njrat_ryuk

.exe 1.2MB

2026-07-23_2d397ecca6a5eff890da25af4643d012_icedid_njrat_ryuk

IMPHASH 1f34af6b04aa944fa5141ac8b0baa197
SHA256 c8c4f15c8b222081ace5fe74e9ae9afe9fe3d67c893f06dc41c860bae3611a28
MD5 2d397ecca6a5eff890da25af4643d012
SHA1 6bc656fdbb3e4cddc66ff5c49268d381238c8dd6
SHA512 bbf8e9c257c50558dd5a048ab188c66081425eba07ede21420836d1b60ce9c8dcd8558776daaaa55fff1a2273e9414efb453dd148cf07dc2bbf633630ca31320
SSDEEP 24576:NDO3nQ1F8lNM+8t5wXWotDWi//dirlvZGMApYSRiO:kIF8U+E5UfqkdirbGbc
TLSH
T1C945D091A79C3EDAD13BC13DC5B64695EA31BC50136097CF01E423AA1E236E6BD3B721
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

10586

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\A\18\s\PCbuild\amd64\venvwlauncher_d.pdb

version

VerQueryValueW GetFileVersionInfoW GetFileVersionInfoSizeW

kernel32

GetCommandLineW GetEnvironmentVariableW SetEnvironmentVariableW GetFileAttributesW CloseHandle DuplicateHandle GetLastError WaitForSingleObjectEx GetCurrentProcess GetExitCodeProcess CreateProcessW GetStartupInfoW AssignProcessToJobObject GetStdHandle QueryInformationJobObject GetModuleFileNameW GetBinaryTypeW FormatMessageW GetPrivateProfileStringW CreateJobObjectA MultiByteToWideChar SetConsoleCtrlHandler HeapSize CreateFileW SetFilePointerEx GetFileSizeEx HeapReAlloc SetEndOfFile WriteConsoleW SetInformationJobObject SetLastError RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetModuleHandleW RtlUnwindEx InterlockedPushEntrySList InterlockedFlushSList RaiseException EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary GetProcAddress LoadLibraryExW ExitProcess GetModuleHandleExW GetCommandLineA WriteFile HeapFree HeapAlloc GetStringTypeW GetCurrentThread GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetFileType ReadFile GetConsoleMode ReadConsoleW FlushFileBuffers GetConsoleCP OutputDebugStringW FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle GetProcessHeap

user32

MessageBoxW PostMessageA GetMessageA

advapi32

RegOpenKeyExW RegEnumKeyW RegCloseKey RegQueryValueExW

Name

.text

Size

415KB

Virtual Size

414KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

86KB

Virtual Size

85KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

79KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

20KB

Virtual Size

19KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.gfids

Size

1024B

Virtual Size

710B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.00cfg

Size

512B

Virtual Size

283B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

93KB

Virtual Size

93KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

572KB

Virtual Size

576KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-23_2d397ecca6a5eff890da25af4643d012_icedid_njrat_ryuk

version

kernel32

user32

advapi32

generic