2026-08-08_549e2a42b1ac47ec947a97f93b0de326_icedid_njrat_ryuk

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-08_549e2a42b1ac47ec947a97f93b0de326_icedid_njrat_ryuk
Size 2.2MB
Sample260808-tjfcfatzex
SHA256 1835721f1ea43be845d02f7cd4db57af7a6eb8a58ff6624bfeedfdd5229ca9af
MD5 549e2a42b1ac47ec947a97f93b0de326
SHA1 3ed2a76f3ebc1fc81a02f5e78f0c8068b31fef9d
SHA512 7afe976f385bdc5edd055b3559381889cae44046d4a8a2ff03a74defe6628568b56afccb91ee08e552b4ab1c4448d6422afab9437e3f8cca225e68ae9021713d
SSDEEP 24576:SdZjU5GIyoy7JjnFJF7MUANIA5YyY1e0huhG3VZqloP/fdFLCvoKFLgYHJWwl24T:SdZjEyJFv4WDZHf7CQKKYpWwl1+NY
TLSH
T1BEA59D42BB6815DDC377C23EC5875706E5A0F02903206BEF75AC06E92B13BE91A7E395
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-08_549e2a42b1ac47ec947a97f93b0de326_icedid_njrat_ryuk

File Explorer

2026-08-08_549e2a42b1ac47ec947a97f93b0de326_icedid_njrat_ryuk

.exe 2.2MB

2026-08-08_549e2a42b1ac47ec947a97f93b0de326_icedid_njrat_ryuk

IMPHASH feb6fd9e44b406db0863bb443c5340d0
SHA256 1835721f1ea43be845d02f7cd4db57af7a6eb8a58ff6624bfeedfdd5229ca9af
MD5 549e2a42b1ac47ec947a97f93b0de326
SHA1 3ed2a76f3ebc1fc81a02f5e78f0c8068b31fef9d
SHA512 7afe976f385bdc5edd055b3559381889cae44046d4a8a2ff03a74defe6628568b56afccb91ee08e552b4ab1c4448d6422afab9437e3f8cca225e68ae9021713d
SSDEEP 24576:SdZjU5GIyoy7JjnFJF7MUANIA5YyY1e0huhG3VZqloP/fdFLCvoKFLgYHJWwl24T:SdZjEyJFv4WDZHf7CQKKYpWwl1+NY
TLSH
T1BEA59D42BB6815DDC377C23EC5875706E5A0F02903206BEF75AC06E92B13BE91A7E395
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5440

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\TCWork\f41609d3e46cb95b\ESIF\Products\ESIF_UF\Sources\win\projs\x64\Win10Release\esif_uf_64.pdb

wtsapi32

WTSQueryUserToken

ole32

CoInitializeEx CoDecrementMTAUsage CoTaskMemFree CoCreateInstance PropVariantClear CoUninitialize CoIncrementMTAUsage

wsock32

WSAGetLastError WSACleanup WSAStartup getservbyname socket select recv listen ioctlsocket htons closesocket bind accept __WSAFDIsSet send

setupapi

SetupDiCreateDeviceInfoList SetupDiEnumDeviceInfo SetupDiDestroyDeviceInfoList SetupDiEnumDeviceInterfaces SetupDiGetDeviceInterfaceDetailA SetupDiGetClassDevsW SetupDiCallClassInstaller SetupDiRemoveDevice SetupDiGetDeviceRegistryPropertyW SetupDiSetDeviceRegistryPropertyW SetupDiSetClassInstallParamsW SetupDiCreateDeviceInfoW

userenv

DestroyEnvironmentBlock CreateEnvironmentBlock

powrprof

SetSuspendState PowerGetActiveScheme PowerSetActiveScheme PowerReadPossibleFriendlyName PowerWritePossibleFriendlyName PowerWriteSettingAttributes PowerRemovePowerSetting PowerWriteACValueIndex PowerWriteDCValueIndex PowerReadACValueIndex PowerReadDCValueIndex

kernel32

CreateDirectoryW SetStdHandle GetFullPathNameA GetFullPathNameW GetCurrentDirectoryW SetCurrentDirectoryW GetCurrentThread HeapAlloc GetTimeFormatW GetDateFormatW GetTimeZoneInformation HeapFree GetACP GetCommandLineA GetModuleFileNameA GetModuleHandleExW ExitProcess WideCharToMultiByte MultiByteToWideChar FileTimeToSystemTime SystemTimeToTzSpecificLocalTime PeekNamedPipe GetFileType CloseHandle InitializeSRWLock ReleaseSRWLockExclusive AcquireSRWLockExclusive ReleaseSemaphore WaitForSingleObject SetWaitableTimerEx CancelWaitableTimer CreateSemaphoreW CreateWaitableTimerW UnregisterWaitEx RegisterWaitForSingleObject ReleaseSRWLockShared AcquireSRWLockShared QueryPerformanceCounter QueryPerformanceFrequency FindClose FindFirstFileA FindNextFileA ReleaseMutex CreateMutexW Sleep CreateThread GetLastError FreeLibrary GetProcAddress LoadLibraryA LocalFree FormatMessageA OutputDebugStringA SetEvent CreateEventW GetCurrentThreadId HeapReAlloc CreateFileA DeviceIoControl GetEnvironmentVariableA GetTempPathW GetTempPathA SetLastError CreateMutexA GetCurrentProcess SetPriorityClass GetSystemDirectoryA GetSystemDirectoryW GetSystemWindowsDirectoryA GetModuleFileNameW GetSystemPowerStatus ResetEvent GetStdHandle GetCommandLineW WaitForMultipleObjects TerminateProcess GetExitCodeProcess ExitThread GetExitCodeThread CreateProcessW SetDllDirectoryA WriteConsoleInputW CreateFileW FlushFileBuffers ReadFile WriteFile ConnectNamedPipe DisconnectNamedPipe SetNamedPipeHandleState CreateNamedPipeW WaitNamedPipeW GetOverlappedResult WTSGetActiveConsoleSessionId DeleteFileW CopyFileW GetModuleHandleW GetFileInformationByHandle GetDriveTypeW DeleteCriticalSection LeaveCriticalSection EnterCriticalSection LoadLibraryExW TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount EncodePointer InterlockedFlushSList InterlockedPushEntrySList RaiseException RtlPcToFileHeader RtlUnwindEx GetStringTypeW GetConsoleMode ReadConsoleW GetConsoleCP CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW CreateProcessA GetFileAttributesExW OutputDebugStringW WaitForSingleObjectEx FindFirstFileExA FindFirstFileExW FindNextFileW IsValidCodePage GetOEMCP GetCPInfo GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableA SetEnvironmentVariableW GetProcessHeap SetConsoleCtrlHandler WriteConsoleW HeapSize SetEndOfFile GetThreadId RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent GetCurrentProcessId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW SetFilePointerEx

user32

ShowWindow CreateWindowExW LoadCursorW RegisterClassExW UnregisterClassW SendMessageW DispatchMessageW TranslateMessage GetMessageW EnumDisplayDevicesW GetSystemMetrics RegisterPowerSettingNotification UnregisterPowerSettingNotification DefWindowProcW UpdateWindow PostQuitMessage

advapi32

SystemFunction036 ReportEventA RegisterEventSourceW DeregisterEventSource StartServiceW StartServiceCtrlDispatcherW SetServiceStatus RegisterServiceCtrlHandlerExW QueryServiceConfigW OpenServiceW OpenSCManagerW DeleteService CreateServiceW ControlService CloseServiceHandle ChangeServiceConfig2W DuplicateTokenEx CreateProcessAsUserW ConvertStringSidToSidW SetSecurityDescriptorDacl InitializeSecurityDescriptor InitializeAcl GetTokenInformation GetLengthSid GetAclInformation AddAce AddAccessAllowedAce LookupPrivilegeValueW AdjustTokenPrivileges OpenProcessToken

Name

.text

Size

1.2MB

Virtual Size

1.2MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

301KB

Virtual Size

300KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

29KB

Virtual Size

125KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

55KB

Virtual Size

55KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

12KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.cfguard

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.00cfg

Size

512B

Virtual Size

283B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

576KB

Virtual Size

580KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-08_549e2a42b1ac47ec947a97f93b0de326_icedid_njrat_ryuk

wtsapi32

ole32

wsock32

setupapi

userenv

powrprof

kernel32

user32

advapi32

generic