2026-07-29_7e707da317030a69205743d37ed686d2_icedid_njrat_ryuk

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-29_7e707da317030a69205743d37ed686d2_icedid_njrat_ryuk
Size 205KB
Sample260729-c6vxzavthy
SHA256 a0e2105388820e9663200dfc54040c042ef8aa21c414321b8f058dec575a5994
MD5 7e707da317030a69205743d37ed686d2
SHA1 084959144f077d465a50aecda71a9e7859da3082
SHA512 ee60e5f1952d34b28e2ffa4521ef5eea2a3f6897df728411319c9c31cf43a96c3f69c170114a77d98872735cf9b54c15ab0cb0ea1fdc7e4777c937ba90e74116
SSDEEP 6144:Tg9SDmUQAXLbfSGh0lF+CLsScjdSsaq6:E9SDmUDXPfClFmjdm
TLSH
T156247B0DB7A410FDE077813AC9521626F2B3741517619ADF1368437AAF236E4AF3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-29_7e707da317030a69205743d37ed686d2_icedid_njrat_ryuk

File Explorer

2026-07-29_7e707da317030a69205743d37ed686d2_icedid_njrat_ryuk

.exe 205KB

2026-07-29_7e707da317030a69205743d37ed686d2_icedid_njrat_ryuk

IMPHASH f8e2d7b4be3eb63c307f7e91280c502f
SHA256 a0e2105388820e9663200dfc54040c042ef8aa21c414321b8f058dec575a5994
MD5 7e707da317030a69205743d37ed686d2
SHA1 084959144f077d465a50aecda71a9e7859da3082
SHA512 ee60e5f1952d34b28e2ffa4521ef5eea2a3f6897df728411319c9c31cf43a96c3f69c170114a77d98872735cf9b54c15ab0cb0ea1fdc7e4777c937ba90e74116
SSDEEP 6144:Tg9SDmUQAXLbfSGh0lF+CLsScjdSsaq6:E9SDmUDXPfClFmjdm
TLSH
T156247B0DB7A410FDE077813AC9521626F2B3741517619ADF1368437AAF236E4AF3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

61840

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

ReleaseMutex GetLastError GetStartupInfoA CreateProcessA HeapFree Sleep HeapAlloc GetProcessHeap GetTickCount EnterCriticalSection LeaveCriticalSection InitializeCriticalSection GetWindowsDirectoryA DeleteCriticalSection GetSystemDirectoryA DeleteFileA CreateThread CreateDirectoryA VirtualFree VirtualAlloc FreeConsole ExitProcess SetUnhandledExceptionFilter MultiByteToWideChar WideCharToMultiByte SetFileTime GetCurrentDirectoryA LocalFileTimeToFileTime CreateFileW SystemTimeToFileTime UnmapViewOfFile WriteConsoleW SetFilePointerEx HeapReAlloc HeapSize WaitForSingleObject CreateMutexA SetFilePointer GetCurrentProcess CloseHandle CreateFileA WriteFile GetFileSizeEx ReadFile LocalFree LocalAlloc GetConsoleMode GetConsoleCP FlushFileBuffers GetStringTypeW SetStdHandle FindNextFileA FindFirstFileExA FindClose SetEnvironmentVariableA FreeEnvironmentStringsW GetEnvironmentStringsW GetCPInfo GetOEMCP GetCurrentThreadId GetFileAttributesA RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW GetModuleHandleW QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime InitializeSListHead RtlPcToFileHeader EncodePointer RaiseException RtlUnwindEx GetModuleFileNameW SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary GetProcAddress LoadLibraryExW GetModuleHandleExW GetStdHandle GetModuleFileNameA GetCommandLineA GetCommandLineW GetACP CompareStringW LCMapStringW GetFileType IsValidCodePage

user32

wsprintfA

advapi32

SystemFunction036 CryptImportKey CryptVerifySignatureA CryptAcquireContextA CryptCreateHash CryptHashData CryptDestroyHash CryptReleaseContext

ws2_32

bind WSAIoctl closesocket select listen WSAStartup accept socket recv htonl htons setsockopt gethostbyname gethostname __WSAFDIsSet inet_addr send connect

iphlpapi

GetTcpTable

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-29_7e707da317030a69205743d37ed686d2_icedid_njrat_ryuk

kernel32

user32

advapi32

ws2_32

iphlpapi

generic