2026-08-22_9d22ba3848da7a36baedec2805024368_icedid_njrat_ryuk_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-22_9d22ba3848da7a36baedec2805024368_icedid_njrat_ryuk_stealc
Size 1.9MB
Sample260823-ejblxsxth1
SHA256 7404e9dcac7a10c72da50c4ba874a9c9c80c20346e330dee4c95c4cba55f3893
MD5 9d22ba3848da7a36baedec2805024368
SHA1 5a99c0c0c61de920448eadaf8c7f792096a2e993
SHA512 b19e4ecdaedce3142b58ef51b3724027758475d96d52387b982f5587176fd313d1e037db0897ae60b04d023b3a4e1efbaeaf6e2f90188e41fb53cf20ac30392c
SSDEEP 49152:zL9QPuMvpCntwzOanKO/6VfCmFMsHUUjbOZ:zbMBKO/6BFqUjm
TLSH
T1B3959E83FEF748A5D139F9B48507466A9620F88E0930655F13FC1A34EFB73A05B2A749
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
2026-08-22_9d22ba3848da7a36baedec2805024368_icedid_njrat_ryuk_stealc

File Explorer

2026-08-22_9d22ba3848da7a36baedec2805024368_icedid_njrat_ryuk_stealc

.exe 1.9MB

2026-08-22_9d22ba3848da7a36baedec2805024368_icedid_njrat_ryuk_stealc

IMPHASH 9c9ffe7c630ba06be0ada4f8967fd981
SHA256 7404e9dcac7a10c72da50c4ba874a9c9c80c20346e330dee4c95c4cba55f3893
MD5 9d22ba3848da7a36baedec2805024368
SHA1 5a99c0c0c61de920448eadaf8c7f792096a2e993
SHA512 b19e4ecdaedce3142b58ef51b3724027758475d96d52387b982f5587176fd313d1e037db0897ae60b04d023b3a4e1efbaeaf6e2f90188e41fb53cf20ac30392c
SSDEEP 49152:zL9QPuMvpCntwzOanKO/6VfCmFMsHUUjbOZ:zbMBKO/6BFqUjm
TLSH
T1B3959E83FEF748A5D139F9B48507466A9620F88E0930655F13FC1A34EFB73A05B2A749
MD5 SHA1 SHA512 SSDEEP TLSH

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

e1:a0:2c:89:e0:0e:e3:d6:72:1d:97:e9:b6:39:f9:13:5d:38:e4:48:16:74:4f:4f:aa:8f:28:d6:d1:f3:dc:b4

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

NO CERTIFICATE

Chains

Jan 1, 0001

PE Signature issue

Digest

75:49:ae:df:8b:0a:80:ca:62:c3:05:78:61:43:ea:9f:38:8e:c2:86

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

NO CERTIFICATE

Chains

Jan 1, 0001

Minor OS version

Major OS version

Entry point

741800

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

AcquireSRWLockExclusive CloseHandle CompareStringEx CreateFileW CreateThread CreateToolhelp32Snapshot DecodePointer DeleteCriticalSection EncodePointer EnterCriticalSection EnumSystemLocalesW ExitProcess ExitThread FindClose FindFirstFileExW FindNextFileW FlsAlloc FlsFree FlsGetValue FlsSetValue FlushFileBuffers FreeEnvironmentStringsW FreeLibrary FreeLibraryAndExitThread GetACP GetCPInfo GetCommandLineA GetCommandLineW GetConsoleMode GetConsoleOutputCP GetCurrentProcess GetCurrentProcessId GetCurrentThreadId GetEnvironmentStringsW GetExitCodeThread GetFileSizeEx GetFileType GetLastError GetLocaleInfoA GetLocaleInfoW GetModuleFileNameA GetModuleFileNameW GetModuleHandleA GetModuleHandleExW GetModuleHandleW GetOEMCP GetProcAddress GetProcessHeap GetStartupInfoW GetStdHandle GetStringTypeW GetSystemDefaultLangID GetSystemTimeAsFileTime GetUserDefaultLCID GlobalAlloc GlobalFree GlobalLock GlobalUnlock HeapAlloc HeapFree HeapReAlloc HeapSize InitializeCriticalSectionAndSpinCount InitializeCriticalSectionEx InitializeSListHead IsDebuggerPresent IsProcessorFeaturePresent IsValidCodePage IsValidLocale LCMapStringEx LCMapStringW LeaveCriticalSection LoadLibraryA LoadLibraryExW Module32First Module32Next MultiByteToWideChar OutputDebugStringA OutputDebugStringW Process32First Process32Next QueryPerformanceCounter QueryPerformanceFrequency RaiseException ReadConsoleW ReadFile ReadProcessMemory ReleaseSRWLockExclusive RtlCaptureContext RtlLookupFunctionEntry RtlPcToFileHeader RtlUnwind RtlUnwindEx RtlVirtualUnwind SetEndOfFile SetFilePointerEx SetLastError SetStdHandle SetUnhandledExceptionFilter Sleep SleepConditionVariableSRW TerminateProcess TlsAlloc TlsFree TlsGetValue TlsSetValue TryAcquireSRWLockExclusive UnhandledExceptionFilter VirtualAllocEx VirtualFreeEx VirtualProtect VirtualQueryEx WaitForSingleObject WaitForSingleObjectEx WakeAllConditionVariable WideCharToMultiByte WriteConsoleW WriteFile

user32

CallNextHookEx ClientToScreen CloseClipboard CreateWindowExA DefWindowProcA DestroyWindow DispatchMessageA EmptyClipboard GetAsyncKeyState GetCapture GetClientRect GetClipboardData GetCursorPos GetDesktopWindow GetFocus GetForegroundWindow GetKeyboardLayout GetMessageExtraInfo GetWindowRect IsIconic IsWindowUnicode IsWindowVisible LoadCursorA LoadImageA MessageBoxA MsgWaitForMultipleObjectsEx OpenClipboard PeekMessageA PostQuitMessage RegisterClassExA ReleaseCapture ScreenToClient SetCapture SetClipboardData SetCursor SetCursorPos SetWindowPos ShowWindow TrackMouseEvent TranslateMessage UnregisterClassA UpdateWindow

shell32

ShellExecuteA ShellExecuteExA ShellExecuteW

advapi32

AdjustTokenPrivileges AllocateAndInitializeSid CheckTokenMembership FreeSid LookupPrivilegeValueA OpenProcessToken RegCloseKey RegCreateKeyExA RegGetValueA RegOpenKeyExA RegSetValueExA

d3d11

D3D11CreateDeviceAndSwapChain

winmm

PlaySoundA

comdlg32

GetOpenFileNameA

imm32

ImmGetContext ImmReleaseContext ImmSetCandidateWindow ImmSetCompositionWindow

d3dcompiler_47

D3DCompile

Name

.text

Size

921KB

Virtual Size

921KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

969KB

Virtual Size

968KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

24KB

Virtual Size

4.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

36KB

Virtual Size

36KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.retplne

Size

512B

Virtual Size

200B

Characteristics

Name

.tls

Size

512B

Virtual Size

45B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_RDATA

Size

512B

Virtual Size

500B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-22_9d22ba3848da7a36baedec2805024368_icedid_njrat_ryuk_stealc

PE Signature issue

PE Signature issue

kernel32

user32

shell32

advapi32

d3d11

winmm

comdlg32

imm32

d3dcompiler_47

generic