2026-08-20_8b11c767d086ec069bc67be162af602d_icedid_njrat_ryuk_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-20_8b11c767d086ec069bc67be162af602d_icedid_njrat_ryuk_stealc
Size 4.7MB
Sample260820-pfx1vsdb75
SHA256 c581d0bbd98c84e37f2c792cee8d76c9db9ccd68e32909add7f43b6698bc8649
MD5 8b11c767d086ec069bc67be162af602d
SHA1 d98d0f6d97618bb949841aa5e9b27523234e6420
SHA512 7756336f46cbd5468acfc75496b3f26b8a0f35d009abf389ee982a0edbcce66d4b2e1505d8efdb37073decbae6be01118c49e820e644cfd3cd8d6c6af5ccc7b0
SSDEEP 49152:5fFTNdGUacNyuPUFIzYFzg4qHTBM9zQojzYl5hRuUupZUfaT++W1XMCeMapp:54Vk4n5jzY/hjusfaT7W18/Mu
TLSH
T11936E07BDD0130A4C956B0B4565D3EEBE2EBB7610F10997B207A16C566302E42FE2F1B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-20_8b11c767d086ec069bc67be162af602d_icedid_njrat_ryuk_stealc

File Explorer

2026-08-20_8b11c767d086ec069bc67be162af602d_icedid_njrat_ryuk_stealc

.exe 4.7MB

2026-08-20_8b11c767d086ec069bc67be162af602d_icedid_njrat_ryuk_stealc

IMPHASH ce0021e88794a5bb7f4ab66e4ba78424
SHA256 c581d0bbd98c84e37f2c792cee8d76c9db9ccd68e32909add7f43b6698bc8649
MD5 8b11c767d086ec069bc67be162af602d
SHA1 d98d0f6d97618bb949841aa5e9b27523234e6420
SHA512 7756336f46cbd5468acfc75496b3f26b8a0f35d009abf389ee982a0edbcce66d4b2e1505d8efdb37073decbae6be01118c49e820e644cfd3cd8d6c6af5ccc7b0
SSDEEP 49152:5fFTNdGUacNyuPUFIzYFzg4qHTBM9zQojzYl5hRuUupZUfaT++W1XMCeMapp:54Vk4n5jzY/hjusfaT7W18/Mu
TLSH
T11936E07BDD0130A4C956B0B4565D3EEBE2EBB7610F10997B207A16C566302E42FE2F1B
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

3454872

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Injector.pdb

kernel32

AcquireSRWLockExclusive AreFileApisANSI CloseHandle CompareStringEx CompareStringW CopyFileW CreateDirectoryW CreateFileW CreateHardLinkW CreateProcessW CreateSymbolicLinkW CreateThread CreateToolhelp32Snapshot DecodePointer DeleteCriticalSection DeviceIoControl DuplicateHandle EncodePointer EnterCriticalSection EnumSystemLocalesW ExitProcess ExitThread FindClose FindFirstFileExW FindFirstFileW FindNextFileW FlsAlloc FlsFree FlsGetValue FlsSetValue FlushFileBuffers FormatMessageA FreeEnvironmentStringsW FreeLibrary FreeLibraryAndExitThread GetACP GetCPInfo GetCommandLineA GetCommandLineW GetConsoleMode GetConsoleOutputCP GetCurrentProcess GetCurrentProcessId GetCurrentThreadId GetDateFormatW GetEnvironmentStringsW GetExitCodeProcess GetFileAttributesExW GetFileAttributesW GetFileInformationByHandle GetFileInformationByHandleEx GetFileSize GetFileSizeEx GetFileType GetFullPathNameW GetLastError GetLocaleInfoEx GetLocaleInfoW GetModuleFileNameW GetModuleHandleExW GetModuleHandleW GetOEMCP GetProcAddress GetProcessHeap GetStartupInfoW GetStdHandle GetStringTypeW GetSystemTimeAsFileTime GetTempPathW GetTimeFormatW GetTimeZoneInformation GetUserDefaultLCID HeapAlloc HeapFree HeapReAlloc HeapSize InitializeCriticalSectionAndSpinCount InitializeCriticalSectionEx InitializeSListHead IsDebuggerPresent IsProcessorFeaturePresent IsValidCodePage IsValidLocale LCMapStringEx LCMapStringW LeaveCriticalSection LoadLibraryA LoadLibraryExW LocalFree Module32First Module32FirstW Module32Next Module32NextW MultiByteToWideChar OpenProcess Process32First Process32FirstW Process32Next Process32NextW QueryFullProcessImageNameW QueryPerformanceCounter QueryPerformanceFrequency RaiseException ReadConsoleW ReadFile ReadProcessMemory ReleaseSRWLockExclusive SetConsoleTitleW SetCurrentDirectoryW SetEndOfFile SetEnvironmentVariableW SetFileInformationByHandle SetFilePointerEx SetLastError SetStdHandle SetUnhandledExceptionFilter Sleep TerminateProcess TlsAlloc TlsFree TlsGetValue TlsSetValue TryAcquireSRWLockExclusive UnhandledExceptionFilter VirtualAlloc VirtualAllocEx VirtualFree VirtualFreeEx VirtualProtect VirtualProtectEx VirtualQuery WaitForSingleObject WakeAllConditionVariable WideCharToMultiByte WriteConsoleW WriteFile WriteProcessMemory

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

shell32

SHGetKnownFolderPath ShellExecuteW

ole32

CoTaskMemFree

user32

EnumWindows FindWindowA GetWindow GetWindowTextA GetWindowTextW GetWindowThreadProcessId IsWindowVisible MessageBoxA PostMessageA

ntdll

NtQueryInformationProcess NtQueryObject RtlCaptureContext RtlLookupFunctionEntry RtlPcToFileHeader RtlUnwind RtlUnwindEx RtlVirtualUnwind

Name

.text

Size

3.5MB

Virtual Size

3.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

453KB

Virtual Size

453KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

788KB

Virtual Size

805KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

23KB

Virtual Size

23KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_RDATA

Size

512B

Virtual Size

500B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

512B

Virtual Size

472B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-20_8b11c767d086ec069bc67be162af602d_icedid_njrat_ryuk_stealc

kernel32

version

shell32

ole32

user32

ntdll

generic