2026-09-29_45b9d1ce44be97026afa89ea0a4541b4_icedid_njrat_ryuk

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-29_45b9d1ce44be97026afa89ea0a4541b4_icedid_njrat_ryuk
Size 1.5MB
Sample260930-ckmdpsygpe
SHA256 c5b2e9a1bbf41872feec2f166059e6bc25fa3280fb0df28430beecaa21b6259f
MD5 45b9d1ce44be97026afa89ea0a4541b4
SHA1 ca415a1644c610776a8739131dbaf751fbc0711b
SHA512 287725db13db278465d959793d0cbf55056276546835054e4b4259c2a0c3e208943a71f509b3fbb045517f48d326251546d15c5d4a942771c790c5e16f7c6fc1
SSDEEP 24576:iANc9t9DTBt3byAUHWreGf+jY+JqRp5fl9NJ:ZNG9DltLyvH88YzRp5/NJ
TLSH
T1F475F04272A43FA4D1E65A39F553C7119F217F270A30466B66233ECA3E2E3C35D29B25
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-29_45b9d1ce44be97026afa89ea0a4541b4_icedid_njrat_ryuk

File Explorer

2026-09-29_45b9d1ce44be97026afa89ea0a4541b4_icedid_njrat_ryuk

.exe 1.5MB

2026-09-29_45b9d1ce44be97026afa89ea0a4541b4_icedid_njrat_ryuk

IMPHASH ab97af8ff8cf7ba1bdb7c1c70e46000e
SHA256 c5b2e9a1bbf41872feec2f166059e6bc25fa3280fb0df28430beecaa21b6259f
MD5 45b9d1ce44be97026afa89ea0a4541b4
SHA1 ca415a1644c610776a8739131dbaf751fbc0711b
SHA512 287725db13db278465d959793d0cbf55056276546835054e4b4259c2a0c3e208943a71f509b3fbb045517f48d326251546d15c5d4a942771c790c5e16f7c6fc1
SSDEEP 24576:iANc9t9DTBt3byAUHWreGf+jY+JqRp5fl9NJ:ZNG9DltLyvH88YzRp5/NJ
TLSH
T1F475F04272A43FA4D1E65A39F553C7119F217F270A30466B66233ECA3E2E3C35D29B25
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x64 arch:x64

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

11848

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

E:\QQMusicPC\pdbRelease\QMDriverHelperx64.pdb

kernel32

GetModuleFileNameW CreateFileW GetLastError CloseHandle LoadLibraryW GetProcAddress GetModuleHandleW FreeLibrary FlushFileBuffers SetFilePointerEx GetConsoleMode GetConsoleCP HeapReAlloc HeapSize GetProcessHeap SetStdHandle LCMapStringW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW RtlPcToFileHeader EncodePointer RaiseException RtlUnwindEx SetLastError EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW GetStdHandle WriteFile MultiByteToWideChar WideCharToMultiByte ExitProcess GetModuleHandleExW GetACP HeapFree HeapAlloc GetStringTypeW GetFileType FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetOEMCP GetCPInfo GetCommandLineA WriteConsoleW

user32

MessageBoxW

shell32

CommandLineToArgvW

shlwapi

PathRemoveFileSpecW PathFileExistsW PathAppendW PathAddBackslashW

setupapi

SetupDiGetDeviceRegistryPropertyW SetupDiEnumDeviceInfo SetupDiCreateDeviceInfoList SetupDiGetINFClassW SetupDiCallClassInstaller SetupDiGetDeviceInfoListDetailW SetupDiSetClassInstallParamsW SetupDiGetClassDevsExW CM_Get_Device_ID_ExW SetupDiSetDeviceRegistryPropertyW SetupDiCreateDeviceInfoW SetupDiDestroyDeviceInfoList

Name

.text

Size

74KB

Virtual Size

74KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

43KB

Virtual Size

42KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.gfids

Size

512B

Virtual Size

228B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

116KB

Virtual Size

115KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

UPX1

Size

1.3MB

Virtual Size

1.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-29_45b9d1ce44be97026afa89ea0a4541b4_icedid_njrat_ryuk

kernel32

user32

shell32

shlwapi

setupapi

generic