2026-08-16_0cb12382a886877e86a7f5959202a09c_icedid_njrat_ryuk

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-16_0cb12382a886877e86a7f5959202a09c_icedid_njrat_ryuk
Size 1.4MB
Sample260816-12vcmsybpc
SHA256 cd20e350971fae5789589d89b8c57d510f2fa761ecfcda43e006aa99cf4846f0
MD5 0cb12382a886877e86a7f5959202a09c
SHA1 5f56aa8505881780cbdd7afcd4f2536cf728dde2
SHA512 f8dd23e7a884450e543ffd4ba15e5a1dfe1dd9f0ac6b552e69be5481ffe1ccdb8691ae52dbb260a8cafd68abe90ce7755eaa46e9099fdf76cf35b799a189a2bf
SSDEEP 24576:/0AOq1690/sqjnhMgeiCl7G0nehbGZpbD:/Z1690jDmg27RnWGj
TLSH
T13D65016973544CF9E97B817DC952E506E9737C120B60D28B13B40A7B6F736A08E3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-16_0cb12382a886877e86a7f5959202a09c_icedid_njrat_ryuk

File Explorer

2026-08-16_0cb12382a886877e86a7f5959202a09c_icedid_njrat_ryuk

.exe 1.4MB

2026-08-16_0cb12382a886877e86a7f5959202a09c_icedid_njrat_ryuk

IMPHASH e87a863e008828af688feb7537282fe7
SHA256 cd20e350971fae5789589d89b8c57d510f2fa761ecfcda43e006aa99cf4846f0
MD5 0cb12382a886877e86a7f5959202a09c
SHA1 5f56aa8505881780cbdd7afcd4f2536cf728dde2
SHA512 f8dd23e7a884450e543ffd4ba15e5a1dfe1dd9f0ac6b552e69be5481ffe1ccdb8691ae52dbb260a8cafd68abe90ce7755eaa46e9099fdf76cf35b799a189a2bf
SSDEEP 24576:/0AOq1690/sqjnhMgeiCl7G0nehbGZpbD:/Z1690jDmg27RnWGj
TLSH
T13D65016973544CF9E97B817DC952E506E9737C120B60D28B13B40A7B6F736A08E3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

38916

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

d:\BuildAutomation\USHUpgradeService_int_cs_4.6\sw\int_cs_4.6\host\windows\UshUpgradeService\x64\Release\UshUpgradeService.pdb

wtsapi32

WTSQueryUserToken

userenv

CreateEnvironmentBlock

setupapi

SetupDiDestroyDeviceInfoList SetupDiEnumDeviceInterfaces SetupDiGetClassDevsW SetupDiGetDeviceInterfaceDetailW CM_Reenumerate_DevNode CM_Locate_DevNodeW

kernel32

WTSGetActiveConsoleSessionId VerSetConditionMask VerifyVersionInfoW FreeLibrary SetStdHandle SetEnvironmentVariableW ResetEvent LocalFree CreateThread CloseHandle TerminateThread CreateFileW LocalAlloc WaitForSingleObject GetModuleFileNameW CreateEventA GetProcessHeap HeapAlloc HeapFree GetProcAddress LoadLibraryW GetLastError GetPrivateProfileStringW FindClose ExpandEnvironmentStringsW FindNextFileW FindFirstFileW SetEvent Sleep GetCurrentProcessId GetLocalTime GetCurrentThreadId FreeEnvironmentStringsW GetEnvironmentStringsW GetCPInfo GetOEMCP IsValidCodePage FindFirstFileExW HeapSize HeapReAlloc SetEndOfFile RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW GetModuleHandleW RtlPcToFileHeader EncodePointer RaiseException RtlUnwindEx SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW EnterCriticalSection LeaveCriticalSection DeleteCriticalSection ReadFile GetConsoleMode ReadConsoleInputA SetConsoleMode MultiByteToWideChar WideCharToMultiByte GetStdHandle WriteFile ExitProcess GetModuleHandleExW GetCommandLineA GetCommandLineW GetACP GetFileType GetConsoleCP SetFilePointerEx ReadConsoleW GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetTimeZoneInformation FlushFileBuffers WriteConsoleW GetStringTypeW SetEnvironmentVariableA

user32

RegisterDeviceNotificationW

advapi32

SystemFunction036 DeregisterEventSource CreateProcessAsUserA SetTokenInformation RegCreateKeyExA RegCreateKeyExW RegSetValueExW ReportEventA RegSetValueExA RegDeleteValueW DuplicateTokenEx RegisterEventSourceA RegisterServiceCtrlHandlerExW CreateServiceW SetServiceStatus ChangeServiceConfig2W DeleteService StartServiceCtrlDispatcherW QueryServiceStatusEx SetSecurityDescriptorDacl AllocateAndInitializeSid FreeSid InitializeSecurityDescriptor InitializeAcl GetLengthSid AddAccessAllowedAce QueryServiceStatus CloseServiceHandle OpenSCManagerW ControlService StartServiceW OpenServiceW RegCloseKey RegOpenKeyExW RegQueryValueExW

shell32

SHGetFolderPathA

Name

.text

Size

170KB

Virtual Size

169KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

67KB

Virtual Size

66KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

14KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

8KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.gfids

Size

512B

Virtual Size

244B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1024B

Virtual Size

816B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

1.2MB

Virtual Size

1.8MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-16_0cb12382a886877e86a7f5959202a09c_icedid_njrat_ryuk

wtsapi32

userenv

setupapi

kernel32

user32

advapi32

shell32

generic