2026-08-14_7008ed64d89ae4ed43fd83ecf4446eb8_icedid_ryuk

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-14_7008ed64d89ae4ed43fd83ecf4446eb8_icedid_ryuk
Size 312KB
Sample260814-qn89jacm21
SHA256 f55e9b34f5c9e48703ddb9a3c1cdd9656ae5d7597ee5dd0da02bee805334cb74
MD5 7008ed64d89ae4ed43fd83ecf4446eb8
SHA1 27822bbab3971a15c6be10bfebbe37a16ab1595e
SHA512 b3eb97f2dc7ca7cd16ec096a80369e526e5b6a227a0530e36d3ea1686e89d9420bf7a977c76f538c3450a332952a7410c9724884272d322755a14808e629733b
SSDEEP 6144:g/xeaxzDn3Qgo0JT+hiDzlOi9E3AAqgm:qxeaFVo0YhwzlOi9E3AAqz
TLSH
T1F364A3067141EA99C8614130CC2EDAF57B227CE4C6A14AF73AF27F7F3D752426D9A620
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-14_7008ed64d89ae4ed43fd83ecf4446eb8_icedid_ryuk

File Explorer

2026-08-14_7008ed64d89ae4ed43fd83ecf4446eb8_icedid_ryuk

.exe 312KB

2026-08-14_7008ed64d89ae4ed43fd83ecf4446eb8_icedid_ryuk

IMPHASH 097b6793264cf2055c6b61acbb002ed5
SHA256 f55e9b34f5c9e48703ddb9a3c1cdd9656ae5d7597ee5dd0da02bee805334cb74
MD5 7008ed64d89ae4ed43fd83ecf4446eb8
SHA1 27822bbab3971a15c6be10bfebbe37a16ab1595e
SHA512 b3eb97f2dc7ca7cd16ec096a80369e526e5b6a227a0530e36d3ea1686e89d9420bf7a977c76f538c3450a332952a7410c9724884272d322755a14808e629733b
SSDEEP 6144:g/xeaxzDn3Qgo0JT+hiDzlOi9E3AAqgm:qxeaFVo0YhwzlOi9E3AAqz
TLSH
T1F364A3067141EA99C8614130CC2EDAF57B227CE4C6A14AF73AF27F7F3D752426D9A620
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

360448

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

winmm

waveOutWrite waveOutUnprepareHeader waveOutReset waveOutOpen waveOutPrepareHeader

kernel32

CreateMutexW WaitForSingleObject GetLastError TerminateThread CloseHandle LoadLibraryW GetProcAddress FreeLibrary HeapFree HeapReAlloc HeapSize GetStringTypeW GetFileType SetStdHandle GetProcessHeap FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetCPInfo GetOEMCP IsValidCodePage FindNextFileW FindFirstFileExW FindClose RaiseException HeapAlloc CreateThread Sleep GetCurrentThreadId FlushFileBuffers GetConsoleCP GetConsoleMode SetFilePointerEx WriteConsoleW GetCurrentProcessId RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter CreateFileW GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW GetModuleHandleW RtlUnwindEx SetLastError EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW ExitProcess GetModuleHandleExW GetStdHandle WriteFile GetModuleFileNameW MultiByteToWideChar WideCharToMultiByte GetACP LCMapStringW

user32

GetMessageW DispatchMessageW SetTimer TranslateMessage EnumDisplayMonitors GetWindowRect GetDC MessageBoxW EnumChildWindows CallNextHookEx GetSystemMetrics SetWindowTextW DrawIcon DestroyCursor ShowWindow GetCursorInfo RedrawWindow MoveWindow UnhookWindowsHookEx EnumWindows SetWindowsHookExW SetCursorPos ReleaseDC EnableWindow

gdi32

CreatePen Ellipse DeleteObject CreateSolidBrush BitBlt SelectObject CreateDIBSection CreateCompatibleDC StretchBlt DeleteDC

Name

.text

Size

99KB

Virtual Size

98KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

55KB

Virtual Size

55KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

2KB

Virtual Size

24KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.gfids

Size

512B

Virtual Size

160B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

143KB

Virtual Size

142KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.vmlay

Size

1024B

Virtual Size

707B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-14_7008ed64d89ae4ed43fd83ecf4446eb8_icedid_ryuk

winmm

kernel32

user32

gdi32

generic