2026-10-28_9df64c1d5ba81e3ea674639ba5daf757_icedid_njrat_ryuk

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-28_9df64c1d5ba81e3ea674639ba5daf757_icedid_njrat_ryuk
Size 2.6MB
Sample261029-2glqfaft6t
SHA256 a28661b517346119dca08e26fdf508d2cfadadf78a992532d0c126fd8fca9a2e
MD5 9df64c1d5ba81e3ea674639ba5daf757
SHA1 5aa7cf5e5d6a352096fc5c9343b438319060bab0
SHA512 360f8959978329bb3227e0ab48136915eea821bc6b860ec9ec51277ae817c63479e96efbc92780400a777250f2d8ce094862d47aad43bf079c6e8c64cc069f03
SSDEEP 49152:tdZpxYT0shsrPtUd4wD0BUi/LNiXicJFFRGNzj3:S8tZB17wRGpj3
TLSH
T1D7D5AF53779899E9C1B7C23EC587860AE9B074250722ABDF319C02692F13BE51E3F716
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-28_9df64c1d5ba81e3ea674639ba5daf757_icedid_njrat_ryuk

File Explorer

2026-10-28_9df64c1d5ba81e3ea674639ba5daf757_icedid_njrat_ryuk

.exe 2.6MB

2026-10-28_9df64c1d5ba81e3ea674639ba5daf757_icedid_njrat_ryuk

IMPHASH 009f2479574379d512a798dfa381487a
SHA256 a28661b517346119dca08e26fdf508d2cfadadf78a992532d0c126fd8fca9a2e
MD5 9df64c1d5ba81e3ea674639ba5daf757
SHA1 5aa7cf5e5d6a352096fc5c9343b438319060bab0
SHA512 360f8959978329bb3227e0ab48136915eea821bc6b860ec9ec51277ae817c63479e96efbc92780400a777250f2d8ce094862d47aad43bf079c6e8c64cc069f03
SSDEEP 49152:tdZpxYT0shsrPtUd4wD0BUi/LNiXicJFFRGNzj3:S8tZB17wRGpj3
TLSH
T1D7D5AF53779899E9C1B7C23EC587860AE9B074250722ABDF319C02692F13BE51E3F716
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4526

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\tcag1\work\17c22847bd57b040\ESIF\Products\ESIF_UF\Sources\win\projs\x64\Win10Release\esif_uf_64.pdb

ole32

CoTaskMemFree CoUninitialize CoCreateInstance CoInitializeEx PropVariantClear

wsock32

__WSAFDIsSet listen WSACleanup WSAStartup getservbyname socket setsockopt select recv accept ioctlsocket htons closesocket bind send

setupapi

SetupDiCreateDeviceInfoList SetupDiEnumDeviceInfo SetupDiDestroyDeviceInfoList SetupDiGetClassDevsW SetupDiCallClassInstaller SetupDiRemoveDevice SetupDiGetDeviceRegistryPropertyW SetupDiSetDeviceRegistryPropertyW SetupDiCreateDeviceInfoW

userenv

DestroyEnvironmentBlock CreateEnvironmentBlock

powrprof

SetSuspendState PowerGetActiveScheme PowerSetActiveScheme PowerReadPossibleFriendlyName PowerWritePossibleFriendlyName PowerWriteSettingAttributes PowerRemovePowerSetting PowerWriteACValueIndex PowerWriteDCValueIndex PowerReadACValueIndex PowerReadDCValueIndex

kernel32

GetFullPathNameW IsValidLocale GetLocaleInfoW LCMapStringW GetCurrentDirectoryW SetCurrentDirectoryW GetCurrentThread HeapAlloc HeapFree GetACP GetCommandLineA GetModuleFileNameA GetModuleHandleExW ExitProcess WideCharToMultiByte MultiByteToWideChar CloseHandle InitializeSRWLock ReleaseSRWLockExclusive AcquireSRWLockExclusive ReleaseSemaphore WaitForSingleObject CreateSemaphoreW CreateWaitableTimerW UnregisterWaitEx RegisterWaitForSingleObject ReleaseSRWLockShared AcquireSRWLockShared QueryPerformanceCounter QueryPerformanceFrequency FindClose FindFirstFileA FindNextFileA Sleep OpenThread CreateThread GetLastError FreeLibrary GetProcAddress LoadLibraryA LocalFree FormatMessageA OutputDebugStringA ReleaseMutex CreateMutexW SetEvent OpenEventW LoadLibraryW CreateEventW GetCurrentThreadId GetThreadId CreateFileA DeviceIoControl GetEnvironmentVariableA GetTempPathW GetTempPathA GetFullPathNameA CreateMutexA GetCurrentProcess SetPriorityClass GetSystemDirectoryA GetSystemDirectoryW GetSystemWindowsDirectoryA GetModuleFileNameW GetSystemPowerStatus ResetEvent GetStdHandle GetCommandLineW WaitForMultipleObjects TerminateProcess GetExitCodeProcess ExitThread GetExitCodeThread CreateProcessW WriteConsoleInputW CreateFileW FlushFileBuffers ReadFile WriteFile ConnectNamedPipe DisconnectNamedPipe SetNamedPipeHandleState CreateNamedPipeW WaitNamedPipeW GetOverlappedResult WTSGetActiveConsoleSessionId CreateDirectoryW DeleteFileW RemoveDirectoryW GetModuleHandleW LoadResource LockResource SizeofResource FindResourceW CopyFileW FileTimeToSystemTime SystemTimeToTzSpecificLocalTime PeekNamedPipe GetFileType GetFileInformationByHandle GetDriveTypeW DeleteCriticalSection LeaveCriticalSection EnterCriticalSection LoadLibraryExW TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount EncodePointer InterlockedFlushSList SetStdHandle HeapReAlloc GetStringTypeW GetConsoleMode ReadConsoleW SetFilePointerEx GetConsoleCP GetTimeZoneInformation GetUserDefaultLCID EnumSystemLocalesW CreateProcessA GetFileAttributesExW OutputDebugStringW WaitForSingleObjectEx FindFirstFileExA FindFirstFileExW FindNextFileW IsValidCodePage GetOEMCP GetCPInfo GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableA SetEnvironmentVariableW GetProcessHeap SetConsoleCtrlHandler WriteConsoleW HeapSize SetEndOfFile SetLastError CompareStringW GetTimeFormatW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent GetCurrentProcessId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW RtlUnwindEx RtlPcToFileHeader RaiseException InterlockedPushEntrySList GetDateFormatW

user32

UnregisterClassW RegisterClassExW SendMessageW ShowWindow UpdateWindow LoadCursorW DispatchMessageW TranslateMessage GetMessageW EnumDisplayDevicesW GetSystemMetrics RegisterPowerSettingNotification UnregisterPowerSettingNotification DefWindowProcW CreateWindowExW PostQuitMessage

advapi32

SystemFunction036 ReportEventA RegisterEventSourceW DeregisterEventSource StartServiceW StartServiceCtrlDispatcherW SetServiceStatus RegisterServiceCtrlHandlerExW QueryServiceConfigW OpenServiceW OpenSCManagerW DeleteService CreateServiceW ControlService CloseServiceHandle ChangeServiceConfig2W DuplicateTokenEx CreateProcessAsUserW ConvertStringSidToSidW SetSecurityDescriptorDacl InitializeSecurityDescriptor InitializeAcl GetTokenInformation GetLengthSid GetAclInformation AddAce AddAccessAllowedAce LookupPrivilegeValueW AdjustTokenPrivileges OpenProcessToken

wtsapi32

WTSQueryUserToken

Name

.text

Size

1.1MB

Virtual Size

1.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

297KB

Virtual Size

296KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

26KB

Virtual Size

122KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

53KB

Virtual Size

52KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

12KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.gfids

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.00cfg

Size

512B

Virtual Size

283B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

617KB

Virtual Size

617KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

576KB

Virtual Size

580KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-28_9df64c1d5ba81e3ea674639ba5daf757_icedid_njrat_ryuk

ole32

wsock32

setupapi

userenv

powrprof

kernel32

user32

advapi32

wtsapi32

generic