2026-10-26_809b1c820e753dac154fd9b99357bb38_icedid_njrat_ryuk

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-26_809b1c820e753dac154fd9b99357bb38_icedid_njrat_ryuk
Size 1.3MB
Sample261027-qlkhdses5n
SHA256 5622bd6f437784700fd76a225fe951e568265af446dacde2597342d3f9bd4fca
MD5 809b1c820e753dac154fd9b99357bb38
SHA1 feef01356349b159cc7af7aba041cd20091e5235
SHA512 68615e9648d908b137d99517e8a1822bbb724ffd76cf48230bbeed01abb4bcdeca1fec9a6701cf62114f8d64a8b50f65b80f05ffe91b7f07d741e5787cd756d0
SSDEEP 24576:eJ07Jyji1+sgy0bC3Qt69dcM/YKxxjfEZEtBE4t4C2zKtR/o4dWrgDOuAB:eW7Jyj8L/ZVfEZEtBE+4C2WtRQsWc
TLSH
T12255E0663BA842D6C17BD13ECA874B65E6B178114721E7CF019443AE1E37BE85E3B720
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-26_809b1c820e753dac154fd9b99357bb38_icedid_njrat_ryuk

File Explorer

2026-10-26_809b1c820e753dac154fd9b99357bb38_icedid_njrat_ryuk

.exe 1.3MB

2026-10-26_809b1c820e753dac154fd9b99357bb38_icedid_njrat_ryuk

IMPHASH 6e15961a38e91ee79e675dab352defaf
SHA256 5622bd6f437784700fd76a225fe951e568265af446dacde2597342d3f9bd4fca
MD5 809b1c820e753dac154fd9b99357bb38
SHA1 feef01356349b159cc7af7aba041cd20091e5235
SHA512 68615e9648d908b137d99517e8a1822bbb724ffd76cf48230bbeed01abb4bcdeca1fec9a6701cf62114f8d64a8b50f65b80f05ffe91b7f07d741e5787cd756d0
SSDEEP 24576:eJ07Jyji1+sgy0bC3Qt69dcM/YKxxjfEZEtBE4t4C2zKtR/o4dWrgDOuAB:eW7Jyj8L/ZVfEZEtBE+4C2WtRQsWc
TLSH
T12255E0663BA842D6C17BD13ECA874B65E6B178114721E7CF019443AE1E37BE85E3B720
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

8376

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Z:\BuildAgent\work\2a95cd8f4ff7a49d\src\Release\x64\winpty-agent.pdb

advapi32

CryptAcquireContextW CryptReleaseContext CryptGenRandom OpenProcessToken OpenThreadToken AllocateAndInitializeSid FreeSid GetTokenInformation InitializeSecurityDescriptor SetSecurityDescriptorDacl SetEntriesInAclW GetSecurityInfo

shell32

CommandLineToArgvW

user32

GetProcessWindowStation SetProcessWindowStation CloseWindowStation CreateWindowStationW GetThreadDesktop GetUserObjectInformationW CreateDesktopW MapVirtualKeyW VkKeyScanW GetDoubleClickTime SendMessageW PostMessageW CloseDesktop

kernel32

HeapSize WriteConsoleW SetFilePointerEx GetProcessHeap SetStdHandle SetEnvironmentVariableW SetEnvironmentVariableA FreeEnvironmentStringsW GetEnvironmentStringsW GetCPInfo GetOEMCP IsValidCodePage FindNextFileW FindNextFileA FindFirstFileExW FindFirstFileExA GetStdHandle CloseHandle DuplicateHandle GetLastError WaitForSingleObject GetCurrentProcess CreateProcessW ReadProcessMemory IsWow64Process GetModuleHandleW GetProcAddress WriteConsoleInputW GetLargestConsoleWindowSize SetConsoleCtrlHandler GetConsoleProcessList FreeLibrary LoadLibraryW GetConsoleCP GetConsoleOutputCP GetTickCount GenerateConsoleCtrlEvent GetConsoleMode SetConsoleMode ReadConsoleInputW Sleep WaitForMultipleObjects CreateFileW ReadFile WriteFile ConnectNamedPipe CreateNamedPipeW GetOverlappedResult CancelIo ResetEvent CreateEventW GetConsoleCursorInfo GetConsoleTitleW SetConsoleTitleW GetConsoleWindow ReadConsoleOutputW WriteConsoleOutputW FillConsoleOutputCharacterW FillConsoleOutputAttribute GetConsoleScreenBufferInfo SetConsoleScreenBufferSize SetConsoleCursorPosition SetConsoleWindowInfo SetConsoleTextAttribute CreateConsoleScreenBuffer GetCommandLineW GetCurrentThreadId GetEnvironmentVariableA SetLastError SetNamedPipeHandleState TransactNamedPipe WaitNamedPipeW GetCurrentProcessId GetSystemTimeAsFileTime GetModuleFileNameA WideCharToMultiByte GetCurrentThread LocalAlloc LocalFree GetSystemDirectoryW GetVersionExW EnterCriticalSection LeaveCriticalSection DeleteCriticalSection SetEvent WaitForSingleObjectEx RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW QueryPerformanceCounter InitializeSListHead RtlPcToFileHeader EncodePointer RaiseException RtlUnwindEx InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW InterlockedPushEntrySList InterlockedFlushSList ExitProcess GetModuleHandleExW GetModuleFileNameW MultiByteToWideChar GetCommandLineA GetACP HeapFree HeapAlloc GetFileType GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW FlushFileBuffers GetStringTypeW OutputDebugStringA OutputDebugStringW CreateThread FindClose HeapReAlloc

Name

.text

Size

526KB

Virtual Size

525KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

141KB

Virtual Size

140KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

6KB

Virtual Size

14KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

27KB

Virtual Size

26KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

7KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.gfids

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

1024B

Virtual Size

777B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.00cfg

Size

512B

Virtual Size

283B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

572KB

Virtual Size

576KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-26_809b1c820e753dac154fd9b99357bb38_icedid_njrat_ryuk

advapi32

shell32

user32

kernel32

generic