2026-10-13_6a2c9d510ae3dd2881dfbcc4f83fcb92_icedid_njrat_ryuk

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-13_6a2c9d510ae3dd2881dfbcc4f83fcb92_icedid_njrat_ryuk
Size 205KB
Sample261015-ntq9sscs2x
SHA256 7069a7bd27a30f134c2c0babfd7196561fdd1a96667bbf06a5433e29e2ea0a6f
MD5 6a2c9d510ae3dd2881dfbcc4f83fcb92
SHA1 5f245fc6da0fbc138ab643ec4747b12e95661f45
SHA512 e81dcbc102ddc9fe01eb3518bc41f182dddc4423654a171e483dffc34542a2760c860452520d03bb680e5762b829a1e332a65fc0cad94f7123033f3dc39b4ce9
SSDEEP 6144:Tg9SDmUQAXLbfSGh0lF+CLsScjdSsaF6:E9SDmUDXPfClFmjdm
TLSH
T18E247B0DB7A410FDE077813AC9521626F2B3741517619ADF1368437AAF236E4AF3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-13_6a2c9d510ae3dd2881dfbcc4f83fcb92_icedid_njrat_ryuk

File Explorer

2026-10-13_6a2c9d510ae3dd2881dfbcc4f83fcb92_icedid_njrat_ryuk

.exe 205KB

2026-10-13_6a2c9d510ae3dd2881dfbcc4f83fcb92_icedid_njrat_ryuk

IMPHASH f8e2d7b4be3eb63c307f7e91280c502f
SHA256 7069a7bd27a30f134c2c0babfd7196561fdd1a96667bbf06a5433e29e2ea0a6f
MD5 6a2c9d510ae3dd2881dfbcc4f83fcb92
SHA1 5f245fc6da0fbc138ab643ec4747b12e95661f45
SHA512 e81dcbc102ddc9fe01eb3518bc41f182dddc4423654a171e483dffc34542a2760c860452520d03bb680e5762b829a1e332a65fc0cad94f7123033f3dc39b4ce9
SSDEEP 6144:Tg9SDmUQAXLbfSGh0lF+CLsScjdSsaF6:E9SDmUDXPfClFmjdm
TLSH
T18E247B0DB7A410FDE077813AC9521626F2B3741517619ADF1368437AAF236E4AF3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

61840

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

ReleaseMutex GetLastError GetStartupInfoA CreateProcessA HeapFree Sleep HeapAlloc GetProcessHeap GetTickCount EnterCriticalSection LeaveCriticalSection InitializeCriticalSection GetWindowsDirectoryA DeleteCriticalSection GetSystemDirectoryA DeleteFileA CreateThread CreateDirectoryA VirtualFree VirtualAlloc FreeConsole ExitProcess SetUnhandledExceptionFilter MultiByteToWideChar WideCharToMultiByte SetFileTime GetCurrentDirectoryA LocalFileTimeToFileTime CreateFileW SystemTimeToFileTime UnmapViewOfFile WriteConsoleW SetFilePointerEx HeapReAlloc HeapSize WaitForSingleObject CreateMutexA SetFilePointer GetCurrentProcess CloseHandle CreateFileA WriteFile GetFileSizeEx ReadFile LocalFree LocalAlloc GetConsoleMode GetConsoleCP FlushFileBuffers GetStringTypeW SetStdHandle FindNextFileA FindFirstFileExA FindClose SetEnvironmentVariableA FreeEnvironmentStringsW GetEnvironmentStringsW GetCPInfo GetOEMCP GetCurrentThreadId GetFileAttributesA RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW GetModuleHandleW QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime InitializeSListHead RtlPcToFileHeader EncodePointer RaiseException RtlUnwindEx GetModuleFileNameW SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary GetProcAddress LoadLibraryExW GetModuleHandleExW GetStdHandle GetModuleFileNameA GetCommandLineA GetCommandLineW GetACP CompareStringW LCMapStringW GetFileType IsValidCodePage

user32

wsprintfA

advapi32

SystemFunction036 CryptImportKey CryptVerifySignatureA CryptAcquireContextA CryptCreateHash CryptHashData CryptDestroyHash CryptReleaseContext

ws2_32

bind WSAIoctl closesocket select listen WSAStartup accept socket recv htonl htons setsockopt gethostbyname gethostname __WSAFDIsSet inet_addr send connect

iphlpapi

GetTcpTable

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-13_6a2c9d510ae3dd2881dfbcc4f83fcb92_icedid_njrat_ryuk

kernel32

user32

advapi32

ws2_32

iphlpapi

generic