2026-08-04_cc3cb57977706c6a6d81dd1692c5a9b9_icedid_njrat_ryuk

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-04_cc3cb57977706c6a6d81dd1692c5a9b9_icedid_njrat_ryuk
Size 960KB
Sample260804-f33eesde78
SHA256 f539e6b4582fa2bb9490ab82be01547e1ad301f9adc2a86840799544c3d7a0f9
MD5 cc3cb57977706c6a6d81dd1692c5a9b9
SHA1 4eaf5c598d6f584f3d7c47160826500ae54f3c20
SHA512 3e1328cddd35d8beacf3e44b35b2d7fb398d8a2a79501e56ce8ae9ad5e93bd2eb01ae8b87ff6111316088d10d2689f72ca481c97a579f3a803da89d980d4cd3a
SSDEEP 24576:ghIRzVakfCrljcpV9F3c8OmAyAhgAQiE6E6bMY0C:g6RzVakfCrlmy8OOAhgAQRX6OC
TLSH
T134250246F7A110F5D57BC23C98634612E672B45E0734EBEB03A88A561F632F15E3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-04_cc3cb57977706c6a6d81dd1692c5a9b9_icedid_njrat_ryuk

File Explorer

2026-08-04_cc3cb57977706c6a6d81dd1692c5a9b9_icedid_njrat_ryuk

.exe 960KB

2026-08-04_cc3cb57977706c6a6d81dd1692c5a9b9_icedid_njrat_ryuk

IMPHASH c3450b747b22f2447bb5c3214451ada3
SHA256 f539e6b4582fa2bb9490ab82be01547e1ad301f9adc2a86840799544c3d7a0f9
MD5 cc3cb57977706c6a6d81dd1692c5a9b9
SHA1 4eaf5c598d6f584f3d7c47160826500ae54f3c20
SHA512 3e1328cddd35d8beacf3e44b35b2d7fb398d8a2a79501e56ce8ae9ad5e93bd2eb01ae8b87ff6111316088d10d2689f72ca481c97a579f3a803da89d980d4cd3a
SSDEEP 24576:ghIRzVakfCrljcpV9F3c8OmAyAhgAQiE6E6bMY0C:g6RzVakfCrlmy8OOAhgAQRX6OC
TLSH
T134250246F7A110F5D57BC23C98634612E672B45E0734EBEB03A88A561F632F15E3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

83360

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

ssh-agent.pdb

libcrypto

EVP_CIPHER_CTX_get_app_data EVP_CIPHER_CTX_set_app_data ECDSA_do_sign AES_set_encrypt_key ECDSA_do_verify ECDSA_SIG_new AES_encrypt DSA_do_sign DSA_do_verify ECDSA_SIG_free DSA_SIG_new EVP_sha384 EVP_md5 EVP_sha256 EVP_Digest EVP_sha1 EVP_sha512 EVP_CIPHER_CTX_key_length EVP_aes_256_cbc DSA_SIG_free EVP_aes_192_cbc EVP_aes_256_gcm EVP_aes_128_gcm EC_POINT_oct2point BN_bn2bin EC_POINT_point2oct BN_bin2bn BN_init RSA_public_decrypt RSA_sign BN_div RSA_size RSA_blinding_on EC_GROUP_get_order DSA_free BN_clear_free EC_KEY_set_private_key BN_value_one EC_METHOD_get_field_type EC_POINT_mul RSA_new RSA_free EC_POINT_get_affine_coordinates_GFp EC_KEY_set_public_key BN_CTX_get EC_POINT_is_at_infinity EC_POINT_free EVP_aes_128_cbc EC_KEY_free BN_CTX_start EC_KEY_get0_public_key DSA_new EC_POINT_new BN_new EC_KEY_get0_private_key EC_KEY_get0_group BN_CTX_new BN_cmp BN_sub EVP_des_ede3_cbc BN_CTX_free EC_GROUP_method_of EC_KEY_new_by_curve_name BN_num_bits

api-ms-win-core-console-l1-1-0

ReadConsoleW SetConsoleCtrlHandler WriteConsoleW GetConsoleCP GetConsoleMode

api-ms-win-service-management-l1-1-0

OpenServiceW OpenSCManagerW

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleW LoadLibraryExW GetModuleHandleExW GetModuleFileNameW FreeLibraryAndExitThread FreeLibrary GetProcAddress

api-ms-win-service-core-l1-1-0

StartServiceCtrlDispatcherW SetServiceStatus

api-ms-win-service-winsvc-l1-1-0

RegisterServiceCtrlHandlerW StartServiceA

api-ms-win-core-errorhandling-l1-1-0

SetLastError GetLastError UnhandledExceptionFilter SetUnhandledExceptionFilter RaiseException

api-ms-win-security-base-l1-1-0

IsWellKnownSid CreateWellKnownSid EqualSid CheckTokenMembership DuplicateToken GetTokenInformation ImpersonateLoggedOnUser RevertToSelf

api-ms-win-security-lsalookup-l2-1-0

LookupAccountNameW

api-ms-win-core-handle-l1-1-0

CloseHandle SetHandleInformation

api-ms-win-security-sddl-l1-1-0

ConvertStringSecurityDescriptorToSecurityDescriptorW

api-ms-win-core-namedpipe-l1-1-0

ConnectNamedPipe CreateNamedPipeW

api-ms-win-core-synch-l1-2-1

WaitForMultipleObjects

api-ms-win-core-kernel32-legacy-l1-1-0

GetNamedPipeClientProcessId

api-ms-win-core-io-l1-1-0

CreateIoCompletionPort GetOverlappedResult GetQueuedCompletionStatus

api-ms-win-core-processthreads-l1-1-0

OpenProcessToken GetExitCodeProcess GetCurrentProcessId CreateProcessW ExitProcess GetCurrentProcess TerminateProcess GetCurrentThreadId GetStartupInfoW CreateThread TlsAlloc QueueUserAPC TlsGetValue TlsSetValue OpenThread ExitThread TlsFree

api-ms-win-core-registry-l1-1-0

RegQueryValueExW RegOpenKeyExA RegDeleteTreeW RegCreateKeyExW RegSetValueExW RegEnumKeyExW RegDeleteKeyExA RegCreateKeyExA RegOpenKeyExW RegDeleteTreeA RegCloseKey RegOpenCurrentUser

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent OpenProcess

api-ms-win-core-synch-l1-1-0

DeleteCriticalSection WaitForMultipleObjectsEx InitializeCriticalSectionAndSpinCount WaitForSingleObjectEx SetEvent CreateEventA LeaveCriticalSection SleepEx EnterCriticalSection WaitForSingleObject

api-ms-win-core-file-l1-1-0

ReadFile GetFileType FindNextFileW SetEndOfFile FindFirstFileExW FlushFileBuffers FindClose CreateFileW SetFilePointerEx WriteFile WriteFileEx

api-ms-win-core-debug-l1-1-0

DebugBreak IsDebuggerPresent

api-ms-win-core-heap-l2-1-0

LocalFree

crypt32

CryptStringToBinaryA CryptProtectData CryptUnprotectData

api-ms-win-core-processenvironment-l1-1-0

SetStdHandle SetCurrentDirectoryW GetStdHandle SetEnvironmentVariableW SetEnvironmentVariableA FreeEnvironmentStringsW GetCurrentDirectoryW GetEnvironmentStringsW GetCommandLineA GetCommandLineW

api-ms-win-core-sysinfo-l1-1-0

GetLocalTime GetSystemTimeAsFileTime

ws2_32

WSAGetLastError WSASend WSAStartup

api-ms-win-core-console-l2-1-0

ScrollConsoleScreenBufferA SetConsoleWindowInfo SetConsoleTextAttribute GetConsoleScreenBufferInfo ReadConsoleOutputA WriteConsoleOutputA SetConsoleCursorInfo FillConsoleOutputCharacterA FillConsoleOutputAttribute GetConsoleCursorInfo SetConsoleScreenBufferSize SetConsoleCursorPosition

api-ms-win-core-string-l1-1-0

GetStringTypeW MultiByteToWideChar CompareStringW WideCharToMultiByte

api-ms-win-core-synch-ansi-l1-1-0

CreateWaitableTimerA

api-ms-win-core-util-l1-1-0

Beep

api-ms-win-core-localization-l1-2-0

GetOEMCP GetCPInfo GetACP LCMapStringW IsValidCodePage

user32

GetWindowPlacement ShowWindow FindWindowA

api-ms-win-core-rtlsupport-l1-1-0

RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind RtlUnwindEx

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

api-ms-win-core-heap-l1-1-0

HeapFree GetProcessHeap HeapSize HeapAlloc HeapReAlloc

api-ms-win-eventing-provider-l1-1-0

EventRegister EventWrite

Name

.text

Size

172KB

Virtual Size

172KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

167KB

Virtual Size

166KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

20KB

Virtual Size

36KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

9KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

586KB

Virtual Size

588KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-04_cc3cb57977706c6a6d81dd1692c5a9b9_icedid_njrat_ryuk

libcrypto

api-ms-win-core-console-l1-1-0

api-ms-win-service-management-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-service-core-l1-1-0

api-ms-win-service-winsvc-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-security-base-l1-1-0

api-ms-win-security-lsalookup-l2-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-security-sddl-l1-1-0

api-ms-win-core-namedpipe-l1-1-0

api-ms-win-core-synch-l1-2-1

api-ms-win-core-kernel32-legacy-l1-1-0

api-ms-win-core-io-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-registry-l1-1-0

api-ms-win-core-processthreads-l1-1-1

api-ms-win-core-synch-l1-1-0

api-ms-win-core-file-l1-1-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-heap-l2-1-0

crypt32

api-ms-win-core-processenvironment-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

ws2_32

api-ms-win-core-console-l2-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-synch-ansi-l1-1-0

api-ms-win-core-util-l1-1-0

api-ms-win-core-localization-l1-2-0

user32

api-ms-win-core-rtlsupport-l1-1-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-interlocked-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-eventing-provider-l1-1-0

generic