2026-09-22_fb0b035e07ef8a6d2439c0369de79c47_icedid_njrat_ryuk

General

Target
2026-09-22_fb0b035e07ef8a6d2439c0369de79c47_icedid_njrat_ryuk
Size 1.6MB
Sample260922-tlzh4aaa68
SHA256 263f83034541a8ce232e9ce3ca0acd9647d8fdb6e29cc4008597ddd1aa4b1bf5
MD5 fb0b035e07ef8a6d2439c0369de79c47
SHA1 fe1d8f5ce2fa277cec45aa57a3c9528b5e9f1722
SHA512 cff7d07557cd76a37c055eb68e67c3fc3bc5ac695ee96b16361a238b6cd73e122947f75d9658fd136e995933f09a1bd36b7ec79d40a73de770e65bc1043ddf73
SSDEEP 12288:kFxkdbZVNhophAzXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DX:kFadb7PzsqjnhMgeiCl7G0nehbGZpbD
TLSH
T12875F166F75009BAD07BD178CA118B55E9B33C595720A34B13F827AA2F333606A3F725
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-22_fb0b035e07ef8a6d2439c0369de79c47_icedid_njrat_ryuk

File Explorer

2026-09-22_fb0b035e07ef8a6d2439c0369de79c47_icedid_njrat_ryuk

.exe 1.6MB

2026-09-22_fb0b035e07ef8a6d2439c0369de79c47_icedid_njrat_ryuk

IMPHASH 45faf0ab8f7eaf7fe63ebdaaa4600eae
SHA256 263f83034541a8ce232e9ce3ca0acd9647d8fdb6e29cc4008597ddd1aa4b1bf5
MD5 fb0b035e07ef8a6d2439c0369de79c47
SHA1 fe1d8f5ce2fa277cec45aa57a3c9528b5e9f1722
SHA512 cff7d07557cd76a37c055eb68e67c3fc3bc5ac695ee96b16361a238b6cd73e122947f75d9658fd136e995933f09a1bd36b7ec79d40a73de770e65bc1043ddf73
SSDEEP 12288:kFxkdbZVNhophAzXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DX:kFadb7PzsqjnhMgeiCl7G0nehbGZpbD
TLSH
T12875F166F75009BAD07BD178CA118B55E9B33C595720A34B13F827AA2F333606A3F725
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

2

Major OS version

5

Entry point

7244

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Q:\v310\Beta14\src\mnt\cnmmntexe\mnt\obj\Release\x64\cnmpaui.pdb

kernel32

GetCommandLineW CloseHandle OpenFileMappingW MapViewOfFile UnmapViewOfFile FreeLibrary GetProcAddress LoadLibraryExW LoadLibraryW GlobalAlloc GlobalFree WriteConsoleW CreateFileW ReadConsoleW ReadFile SetFilePointerEx GetFileSizeEx GetConsoleMode GetConsoleCP FlushFileBuffers HeapReAlloc HeapSize SetConsoleCtrlHandler GetProcessHeap LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW EnumSystemLocalesW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW GetModuleHandleW RtlUnwindEx InterlockedPushEntrySList InterlockedFlushSList GetLastError SetLastError EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree GetStdHandle WriteFile GetModuleFileNameW ExitProcess GetModuleHandleExW HeapFree HeapAlloc GetCurrentThread OutputDebugStringW FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle GetFileType GetStringTypeW GetLocaleInfoW IsValidLocale GetUserDefaultLCID RaiseException

winspool.drv

OpenPrinterW ClosePrinter

user32

LoadImageW DestroyIcon UpdateWindow ShowWindow DestroyWindow IsWindow CreateWindowExW RegisterClassExW UnregisterClassW PostQuitMessage DefWindowProcW SendMessageW DispatchMessageW GetMessageW

Name

.text

Size

287KB

Virtual Size

286KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

64KB

Virtual Size

63KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

17KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.gfids

Size

512B

Virtual Size

356B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

55KB

Virtual Size

54KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

1.2MB

Virtual Size

1.8MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-22_fb0b035e07ef8a6d2439c0369de79c47_icedid_njrat_ryuk

kernel32

winspool.drv

user32

generic