2026-08-02_f552fbac1a3ddb67ab9bdec19b7321a1_icedid_njrat_ryuk

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-02_f552fbac1a3ddb67ab9bdec19b7321a1_icedid_njrat_ryuk
Size 1.7MB
Sample260802-jkcb3avyax
SHA256 0bdd290eb8983be7d67456d68659bd1aa455c088fbfb60b9857cf02044cf56bf
MD5 f552fbac1a3ddb67ab9bdec19b7321a1
SHA1 1997fb0e5e59d254b57d773d1f1332285f69ac42
SHA512 db8eedbe925f5120560c4c840c305d7598309c06843f8f694e7334f228540ed37005aaed017ca997437b88652c039a47d0bb4c0261e3d4402efdb37e1aeea813
SSDEEP 24576:GJ7onabLDVBJdLBhvn/+h1xO/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:a7onabPV3xBh34eLNiXicJFFRGNzj3
TLSH
T1DC85028277D440F4E2B78538C9B20A15E5B63C654B31C65F0365276BAF33792EE39B22
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-02_f552fbac1a3ddb67ab9bdec19b7321a1_icedid_njrat_ryuk

File Explorer

2026-08-02_f552fbac1a3ddb67ab9bdec19b7321a1_icedid_njrat_ryuk

.exe 1.7MB

2026-08-02_f552fbac1a3ddb67ab9bdec19b7321a1_icedid_njrat_ryuk

IMPHASH ee18145fe05b76bbfae83a39ccf1937b
SHA256 0bdd290eb8983be7d67456d68659bd1aa455c088fbfb60b9857cf02044cf56bf
MD5 f552fbac1a3ddb67ab9bdec19b7321a1
SHA1 1997fb0e5e59d254b57d773d1f1332285f69ac42
SHA512 db8eedbe925f5120560c4c840c305d7598309c06843f8f694e7334f228540ed37005aaed017ca997437b88652c039a47d0bb4c0261e3d4402efdb37e1aeea813
SSDEEP 24576:GJ7onabLDVBJdLBhvn/+h1xO/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:a7onabPV3xBh34eLNiXicJFFRGNzj3
TLSH
T1DC85028277D440F4E2B78538C9B20A15E5B63C654B31C65F0365276BAF33792EE39B22
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

47040

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\Projects\WinRAR\uninstall\build\uninstall64\Release\uninstall.pdb

kernel32

FindNextFileW GetVersionExW GetCurrentDirectoryW FindResourceW FreeLibrary LoadLibraryW LoadLibraryExW GetProcAddress GetCurrentProcessId GetModuleHandleW GetSystemDirectoryW GetCPInfo IsDBCSLeadByte MultiByteToWideChar WideCharToMultiByte CompareStringW GetModuleHandleExW GetShortPathNameW Sleep GetTempPathW SetCurrentDirectoryW CreateProcessW GetCommandLineW GetEnvironmentVariableW RemoveDirectoryW CopyFileW MoveFileExW SetStdHandle FindFirstFileW GetProcessHeap FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetOEMCP IsValidCodePage FindNextFileA FindFirstFileExA LCMapStringW SetFilePointerEx HeapReAlloc GetConsoleMode GetConsoleCP HeapAlloc HeapFree GetACP GetModuleFileNameA ExitProcess QueryPerformanceFrequency TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount DeleteCriticalSection LeaveCriticalSection EnterCriticalSection EncodePointer RtlUnwindEx RtlVirtualUnwind RaiseException RtlPcToFileHeader FindClose ExpandEnvironmentStringsW MoveFileW SetFileAttributesW GetDiskFreeSpaceExW CreateFileW CloseHandle SetFilePointer SetEndOfFile FlushFileBuffers ReadFile GetStdHandle WriteFile GetFileType SetLastError GetLastError DeleteFileW GetFileAttributesW CreateDirectoryW GetModuleFileNameW GetStringTypeW WriteConsoleW ReadConsoleW RtlLookupFunctionEntry HeapSize UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW QueryPerformanceCounter InitializeSListHead GetSystemTimeAsFileTime GetCurrentThreadId RtlCaptureContext

user32

SendMessageW ShowWindow GetDlgItem EnableWindow InvalidateRect SetWindowTextW GetParent DialogBoxParamW EndDialog SetDlgItemTextW GetDlgItemTextW CheckDlgButton IsDlgButtonChecked OemToCharA LoadIconW SetForegroundWindow SendDlgItemMessageW MessageBoxW GetDesktopWindow ReleaseDC GetDC IsWindowVisible IsWindow CharUpperW GetSysColor LoadStringW GetWindow GetClassNameW SetProcessDefaultLayout GetWindowLongPtrW SetWindowLongW GetWindowLongW GetWindowRect GetClientRect GetWindowTextW GetSystemMetrics SetWindowPos

gdi32

GetDeviceCaps DeleteObject CreateFontW

advapi32

RegEnumKeyExW RegDeleteValueW RegDeleteKeyW RegCreateKeyExW RegQueryValueExW RegOpenKeyExW RegCloseKey RegSetValueExW

shell32

ShellExecuteW SHGetSpecialFolderLocation SHGetPathFromIDListW SHGetMalloc SHChangeNotify SHGetFolderPathW SHFileOperationW

ole32

OleUninitialize OleInitialize CoCreateInstance

Name

.text

Size

121KB

Virtual Size

121KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

54KB

Virtual Size

53KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

36KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

7KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.gfids

Size

512B

Virtual Size

208B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

180KB

Virtual Size

180KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

1.4MB

Virtual Size

1.4MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-02_f552fbac1a3ddb67ab9bdec19b7321a1_icedid_njrat_ryuk

kernel32

user32

gdi32

advapi32

shell32

ole32

generic