2026-08-07_f53587838272f842d85f4d568bcd929a_icedid_njrat_ryuk

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-07_f53587838272f842d85f4d568bcd929a_icedid_njrat_ryuk
Size 8.1MB
Sample260807-sffncszzfs
SHA256 e2bf258b0ee5e4f0e9b6ce6ee29c1ed66c5201d20a70374f1d7032e2b6a5a1ba
MD5 f53587838272f842d85f4d568bcd929a
SHA1 c31e1ea841092a1ac1763234ab039a61e4173c51
SHA512 5bd2941cc177bf58fb54da7d001f55120052882dfea61159efef6bede3affa36dbd5ab0ec3db703189337ef251674423414b054a35b97cb2f13ba241c4abca21
SSDEEP 98304:6ubdMTVyht2gFAk4aAweuC6atUKze3d9BdrrcFVQ:6uJMxzgFAk4aAweu/azedx
TLSH
T108865C2D7AA441A4D1F6C178CB469A93E2B270541B317EF75261420F5F33AF86E3EE21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-07_f53587838272f842d85f4d568bcd929a_icedid_njrat_ryuk

File Explorer

2026-08-07_f53587838272f842d85f4d568bcd929a_icedid_njrat_ryuk

.exe 8.1MB

2026-08-07_f53587838272f842d85f4d568bcd929a_icedid_njrat_ryuk

IMPHASH a10d32b9b42fcb4d138722d37758da4d
SHA256 e2bf258b0ee5e4f0e9b6ce6ee29c1ed66c5201d20a70374f1d7032e2b6a5a1ba
MD5 f53587838272f842d85f4d568bcd929a
SHA1 c31e1ea841092a1ac1763234ab039a61e4173c51
SHA512 5bd2941cc177bf58fb54da7d001f55120052882dfea61159efef6bede3affa36dbd5ab0ec3db703189337ef251674423414b054a35b97cb2f13ba241c4abca21
SSDEEP 98304:6ubdMTVyht2gFAk4aAweuC6atUKze3d9BdrrcFVQ:6uJMxzgFAk4aAweu/azedx
TLSH
T108865C2D7AA441A4D1F6C178CB469A93E2B270541B317EF75261420F5F33AF86E3EE21
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5215732

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

ws2_32

select recv connect getnameinfo send getsockname sendto inet_addr freeaddrinfo getaddrinfo ntohl WSASend WSARecv shutdown getpeername WSAIoctl WSAGetOverlappedResult WSAGetLastError socket setsockopt listen htons htonl closesocket bind WSACleanup WSAStartup

iphlpapi

GetIpAddrTable GetBestRoute

kernel32

GetTimeFormatW GetDateFormatW GetCurrentDirectoryA SetCurrentDirectoryA IsValidLocale SetEnvironmentVariableA GetACP GetCommandLineW GetCommandLineA ExitProcess EnumSystemLocalesW GetFileType GetLastError PostQueuedCompletionStatus EnterCriticalSection LeaveCriticalSection TlsAlloc TlsFree Sleep GetModuleFileNameA LocalFree FormatMessageA VirtualAlloc VirtualFree CloseHandle QueryPerformanceCounter QueryPerformanceFrequency CreateIoCompletionPort GetQueuedCompletionStatusEx InitializeCriticalSectionAndSpinCount DeleteCriticalSection GetCurrentThreadId SwitchToFiber DeleteFiber ConvertFiberToThread CreateFiberEx ConvertThreadToFiberEx CancelIoEx CreateFileA FlushFileBuffers GetFileSizeEx SetEndOfFile SetFilePointer MapViewOfFile FlushViewOfFile UnmapViewOfFile CreateFileMappingA MoveFileExA GetSystemTimeAsFileTime GetSystemInfo GetModuleHandleA GetProcAddress SetConsoleCtrlHandler GetConsoleCP SetConsoleTextAttribute SetFileInformationByHandle GetCurrentProcessorNumber InitializeSRWLock ReleaseSRWLockExclusive ReleaseSRWLockShared AcquireSRWLockExclusive AcquireSRWLockShared GetFileAttributesExA SetFilePointerEx SetFileTime MapViewOfFileEx CreateHardLinkA GetComputerNameA TlsGetValue TlsSetValue WaitForSingleObject GetCurrentThread GetThreadId WriteFile GetFileInformationByHandle ReadFile GetCurrentDirectoryW CreateDirectoryW CreateFileW DeleteFileW FindClose FindNextFileW GetFileAttributesW GetFileAttributesExW RemoveDirectoryW DeviceIoControl MoveFileExW AreFileApisANSI MultiByteToWideChar WideCharToMultiByte FreeLibrary LoadLibraryA LCMapStringW LCMapStringA GetUserDefaultLCID GetStringTypeExA GetCurrentProcessId ReadConsoleW HeapReAlloc HeapFree HeapAlloc GetModuleHandleExW ExitThread GetConsoleMode HeapSize IsValidCodePage GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle GetProcessHeap FindFirstFileExA FindNextFileA WriteConsoleW GetStdHandle GetFullPathNameA GetDriveTypeW FileTimeToSystemTime SystemTimeToTzSpecificLocalTime FormatMessageW RtlPcToFileHeader EncodePointer DecodePointer RaiseException TryEnterCriticalSection QueueUserWorkItem IsProcessorFeaturePresent DuplicateHandle WaitForSingleObjectEx GetCurrentProcess GetExitCodeThread GetNativeSystemInfo GetStringTypeW SetLastError CreateEventW GetTickCount GetModuleHandleW CompareStringW GetLocaleInfoW GetCPInfo SetEvent ResetEvent RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW InitializeSListHead TerminateProcess CreateTimerQueue SignalObjectAndWait SwitchToThread CreateThread SetThreadPriority GetThreadPriority GetLogicalProcessorInformation CreateTimerQueueTimer ChangeTimerQueueTimer DeleteTimerQueueTimer GetNumaHighestNodeNumber GetProcessAffinityMask SetThreadAffinityMask RegisterWaitForSingleObject UnregisterWait GetThreadTimes FreeLibraryAndExitThread GetModuleFileNameW LoadLibraryExW GetVersionExW VirtualProtect ReleaseSemaphore InterlockedPopEntrySList InterlockedPushEntrySList InterlockedFlushSList QueryDepthSList UnregisterWaitEx LoadLibraryW RtlUnwindEx GetTimeZoneInformation FindFirstFileExW

user32

LoadStringA

shell32

SHGetSpecialFolderPathA

advapi32

CryptGenRandom CryptReleaseContext CryptAcquireContextA StartServiceCtrlDispatcherA SetServiceStatus RegisterServiceCtrlHandlerA QueryServiceStatus OpenServiceA OpenSCManagerA DeleteService CreateServiceA ControlService CloseServiceHandle CryptAcquireContextW

rpcrt4

UuidToStringA UuidCreateSequential RpcStringFreeA

Name

.text

Size

5.7MB

Virtual Size

5.7MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

2.0MB

Virtual Size

2.0MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

123KB

Virtual Size

177KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

228KB

Virtual Size

228KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

1024B

Virtual Size

709B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gfids

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

30KB

Virtual Size

29KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

24KB

Virtual Size

24KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-07_f53587838272f842d85f4d568bcd929a_icedid_njrat_ryuk

ws2_32

iphlpapi

kernel32

user32

shell32

advapi32

rpcrt4

generic