2026-07-31_f978d504fb6e75a33535883014dff797_icedid_njrat_ryuk

General

Target
2026-07-31_f978d504fb6e75a33535883014dff797_icedid_njrat_ryuk
Size 1.3MB
Sample260731-ex92msce85
SHA256 1664ce431fa22a07ff4d6111d8c0edba4e23e3d9fba230ceeca199a3b3a6a0c2
MD5 f978d504fb6e75a33535883014dff797
SHA1 52872ed0e8636f1d18fd50eb62964e8330766f48
SHA512 b3e4bd960e1e78d338d4dd61f520678d8d7e457dffbb6a3eddee6755adb2caf8842c2b1db0227036b4f8475155ffbdf6275e84907f2d41ef1e0dd650d89f5a54
SSDEEP 12288:viQeD1eDrqRjg9QADAlkSXk2j+pDiV+ntZcOQrkP7jXjcO2MB/AKYZ:qQeDsrqUQSAlkSB+pfAOQ+7jXjra
TLSH
T1D055019672A434F5E0A28635CD210491E7B6B8760B619B9F479483654F327E2EC3EF32
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-31_f978d504fb6e75a33535883014dff797_icedid_njrat_ryuk

File Explorer

2026-07-31_f978d504fb6e75a33535883014dff797_icedid_njrat_ryuk

.exe 1.3MB

2026-07-31_f978d504fb6e75a33535883014dff797_icedid_njrat_ryuk

IMPHASH ed0b4adaec30b407514a660b4fc1d4c2
SHA256 1664ce431fa22a07ff4d6111d8c0edba4e23e3d9fba230ceeca199a3b3a6a0c2
MD5 f978d504fb6e75a33535883014dff797
SHA1 52872ed0e8636f1d18fd50eb62964e8330766f48
SHA512 b3e4bd960e1e78d338d4dd61f520678d8d7e457dffbb6a3eddee6755adb2caf8842c2b1db0227036b4f8475155ffbdf6275e84907f2d41ef1e0dd650d89f5a54
SSDEEP 12288:viQeD1eDrqRjg9QADAlkSXk2j+pDiV+ntZcOQrkP7jXjcO2MB/AKYZ:qQeDsrqUQSAlkSB+pfAOQ+7jXjra
TLSH
T1D055019672A434F5E0A28635CD210491E7B6B8760B619B9F479483654F327E2EC3EF32
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

35248

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

E:\bt\973263\repo\out\retail-amd64\msmpiLaunchSvc\msmpiLaunchSvc.pdb

kernel32

CreateEventA FreeLibrary DeleteCriticalSection AcquireSRWLockShared GetProcAddress CreateThread ReleaseSRWLockShared CloseHandle AcquireSRWLockExclusive GetCurrentProcess LocalFree LoadLibraryExW WriteConsoleW SetFilePointerEx GetConsoleMode GetConsoleCP FlushFileBuffers GetFileType RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent SetLastError GetCurrentThread GetACP GetStringTypeW HeapFree GetModuleHandleW HeapAlloc InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemTimeAsFileTime CompareStringW LCMapStringW IsValidCodePage GetOEMCP GetCPInfo GetProcessHeap ExitProcess GetModuleHandleExW WideCharToMultiByte HeapSize HeapReAlloc QueryPerformanceCounter GetCurrentProcessId InitializeSListHead RtlUnwindEx GetModuleFileNameW RtlPcToFileHeader RaiseException SetEvent ReleaseSRWLockExclusive GetLastError MultiByteToWideChar ResumeThread OpenJobObjectW WaitForSingleObject InitializeCriticalSection LeaveCriticalSection WaitForMultipleObjects TerminateProcess AssignProcessToJobObject EnterCriticalSection InitializeSRWLock GetCurrentThreadId GetStartupInfoW GetStdHandle WriteFile GetModuleFileNameA GetCommandLineA GetCommandLineW FindClose FindFirstFileExA FindNextFileA GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableA SetStdHandle CreateFileW

advapi32

LookupAccountNameW LookupPrivilegeValueA LookupAccountSidW GetTokenInformation CreateWellKnownSid RegSetValueExW RegCreateKeyExW RegOpenCurrentUser RegCloseKey RegGetValueW RegOpenKeyExW ReportEventW RegisterEventSourceW DeregisterEventSource SystemFunction036 AdjustTokenPrivileges SetServiceStatus RegisterServiceCtrlHandlerW OpenProcessToken StartServiceCtrlDispatcherW LogonUserW CheckTokenMembership CreateProcessAsUserW DuplicateTokenEx OpenThreadToken

crypt32

CryptUnprotectData CryptProtectData

userenv

UnloadUserProfile LoadUserProfileW DestroyEnvironmentBlock ExpandEnvironmentStringsForUserW CreateEnvironmentBlock

Name

.text

Size

81KB

Virtual Size

81KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

46KB

Virtual Size

46KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

1.2MB

Virtual Size

1.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-31_f978d504fb6e75a33535883014dff797_icedid_njrat_ryuk

kernel32

advapi32

crypt32

userenv

generic