2026-09-04_8db2f861a2901fe360c5b5e47f33b366_icedid_njrat_ryuk_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-04_8db2f861a2901fe360c5b5e47f33b366_icedid_njrat_ryuk_stealc
Size 1.9MB
Sample260905-efbgraszdw
SHA256 75f30e4238100f75391f5df2a0d8559817151dac7105e09099ffa31250ba37f7
MD5 8db2f861a2901fe360c5b5e47f33b366
SHA1 19284ad800fc3d28f4ed8b1110bd956ae6590cc4
SHA512 d79d0a07e9ebf2455c7514d4aeca31d821c0aa59d7aa2ad72e543357aaf11d3d3521e978def24108abc65a22fada7a20648b4b4bd6c5dac6c34cd69969c42d49
SSDEEP 24576:nExW1YJybijCFrXYZIOOTA0TlwnTPTKN0BUC6PfJfkGYe4XrmZKMsH:Eg1Cye48edp+nKO/6VfCmkMsH
TLSH
T1C2959E83FEF748A5D039F9B48507466A9620F88E0930655F17FC1A34EFB73A05B2A749
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-04_8db2f861a2901fe360c5b5e47f33b366_icedid_njrat_ryuk_stealc

File Explorer

2026-09-04_8db2f861a2901fe360c5b5e47f33b366_icedid_njrat_ryuk_stealc

.exe 1.9MB

2026-09-04_8db2f861a2901fe360c5b5e47f33b366_icedid_njrat_ryuk_stealc

IMPHASH c7ac63cee36856586f6b4e7a20613226
SHA256 75f30e4238100f75391f5df2a0d8559817151dac7105e09099ffa31250ba37f7
MD5 8db2f861a2901fe360c5b5e47f33b366
SHA1 19284ad800fc3d28f4ed8b1110bd956ae6590cc4
SHA512 d79d0a07e9ebf2455c7514d4aeca31d821c0aa59d7aa2ad72e543357aaf11d3d3521e978def24108abc65a22fada7a20648b4b4bd6c5dac6c34cd69969c42d49
SSDEEP 24576:nExW1YJybijCFrXYZIOOTA0TlwnTPTKN0BUC6PfJfkGYe4XrmZKMsH:Eg1Cye48edp+nKO/6VfCmkMsH
TLSH
T1C2959E83FEF748A5D039F9B48507466A9620F88E0930655F17FC1A34EFB73A05B2A749
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

741224

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

AcquireSRWLockExclusive CloseHandle CompareStringEx CreateFileW CreateThread CreateToolhelp32Snapshot DecodePointer DeleteCriticalSection EncodePointer EnterCriticalSection EnumSystemLocalesW ExitProcess ExitThread FindClose FindFirstFileExW FindNextFileW FlsAlloc FlsFree FlsGetValue FlsSetValue FlushFileBuffers FreeEnvironmentStringsW FreeLibrary FreeLibraryAndExitThread GetACP GetCPInfo GetCommandLineA GetCommandLineW GetConsoleMode GetConsoleOutputCP GetCurrentProcess GetCurrentProcessId GetCurrentThreadId GetEnvironmentStringsW GetExitCodeThread GetFileSizeEx GetFileType GetLastError GetLocaleInfoA GetLocaleInfoW GetModuleFileNameW GetModuleHandleA GetModuleHandleExW GetModuleHandleW GetOEMCP GetProcAddress GetProcessHeap GetStartupInfoW GetStdHandle GetStringTypeW GetSystemDefaultLangID GetSystemTimeAsFileTime GetUserDefaultLCID GlobalAlloc GlobalFree GlobalLock GlobalUnlock HeapAlloc HeapFree HeapReAlloc HeapSize InitializeCriticalSectionAndSpinCount InitializeCriticalSectionEx InitializeSListHead IsDebuggerPresent IsProcessorFeaturePresent IsValidCodePage IsValidLocale LCMapStringEx LCMapStringW LeaveCriticalSection LoadLibraryA LoadLibraryExW Module32First Module32Next MultiByteToWideChar OutputDebugStringA OutputDebugStringW Process32First Process32Next QueryPerformanceCounter QueryPerformanceFrequency RaiseException ReadConsoleW ReadFile ReadProcessMemory ReleaseSRWLockExclusive RtlCaptureContext RtlLookupFunctionEntry RtlPcToFileHeader RtlUnwind RtlUnwindEx RtlVirtualUnwind SetEndOfFile SetFilePointerEx SetLastError SetStdHandle SetUnhandledExceptionFilter Sleep SleepConditionVariableSRW TerminateProcess TlsAlloc TlsFree TlsGetValue TlsSetValue TryAcquireSRWLockExclusive UnhandledExceptionFilter VirtualAllocEx VirtualFreeEx VirtualProtect VirtualQueryEx WaitForSingleObject WaitForSingleObjectEx WakeAllConditionVariable WideCharToMultiByte WriteConsoleW WriteFile

user32

CallNextHookEx ClientToScreen CloseClipboard CreateWindowExA DefWindowProcA DestroyWindow DispatchMessageA EmptyClipboard GetAsyncKeyState GetCapture GetClientRect GetClipboardData GetCursorPos GetDesktopWindow GetFocus GetForegroundWindow GetKeyboardLayout GetMessageExtraInfo GetWindowRect IsIconic IsWindowUnicode IsWindowVisible LoadCursorA LoadImageA MessageBoxA MsgWaitForMultipleObjectsEx OpenClipboard PeekMessageA PostQuitMessage RegisterClassExA ReleaseCapture ScreenToClient SetCapture SetClipboardData SetCursor SetCursorPos SetWindowPos ShowWindow TrackMouseEvent TranslateMessage UnregisterClassA UpdateWindow

shell32

ShellExecuteA ShellExecuteW

advapi32

AdjustTokenPrivileges LookupPrivilegeValueA OpenProcessToken RegCloseKey RegCreateKeyExA RegGetValueA RegOpenKeyExA RegSetValueExA

d3d11

D3D11CreateDeviceAndSwapChain

winmm

PlaySoundA

comdlg32

GetOpenFileNameA

imm32

ImmGetContext ImmReleaseContext ImmSetCandidateWindow ImmSetCompositionWindow

d3dcompiler_47

D3DCompile

Name

.text

Size

921KB

Virtual Size

920KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

968KB

Virtual Size

968KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

24KB

Virtual Size

4.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

36KB

Virtual Size

36KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.retplne

Size

512B

Virtual Size

200B

Characteristics

Name

.tls

Size

512B

Virtual Size

45B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_RDATA

Size

512B

Virtual Size

500B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-04_8db2f861a2901fe360c5b5e47f33b366_icedid_njrat_ryuk_stealc

kernel32

user32

shell32

advapi32

d3d11

winmm

comdlg32

imm32

d3dcompiler_47

generic