2026-11-02_cb27260f773f81a47d8be14671c186e1_icedid_ryuk

Sharing

Copy URL Twitter E-mail

General

Target
2026-11-02_cb27260f773f81a47d8be14671c186e1_icedid_ryuk
Size 1.4MB
Sample261102-2k2aasxtft
SHA256 b049e9d30cfcd168e0d0a477a66d170e2d981b6d39bc268d39d0e36b119ee1c3
MD5 cb27260f773f81a47d8be14671c186e1
SHA1 6dbed879d7ace9800a292c9bf1422507b407607d
SHA512 7dbbd1faecd1b3d4f269399134b0a21e955bc7a550128ccb5b3c2aa2f252fd062f7746fce8bf7fb6cc3b510b089782f884265210622e384d0d5885f5c1b183b0
SSDEEP 12288:3INFOVuXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:3mF9sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1E865DF8A63D514DAD5E2067679234275F3E36CEB3A298B4E86C173099F3B3C0CE245B1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-11-02_cb27260f773f81a47d8be14671c186e1_icedid_ryuk

File Explorer

2026-11-02_cb27260f773f81a47d8be14671c186e1_icedid_ryuk

.exe 1.4MB

2026-11-02_cb27260f773f81a47d8be14671c186e1_icedid_ryuk

IMPHASH f3e39b416c888262517e84006cc06035
SHA256 b049e9d30cfcd168e0d0a477a66d170e2d981b6d39bc268d39d0e36b119ee1c3
MD5 cb27260f773f81a47d8be14671c186e1
SHA1 6dbed879d7ace9800a292c9bf1422507b407607d
SHA512 7dbbd1faecd1b3d4f269399134b0a21e955bc7a550128ccb5b3c2aa2f252fd062f7746fce8bf7fb6cc3b510b089782f884265210622e384d0d5885f5c1b183b0
SSDEEP 12288:3INFOVuXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:3mF9sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1E865DF8A63D514DAD5E2067679234275F3E36CEB3A298B4E86C173099F3B3C0CE245B1
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

10552

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\KYD100_SourceCode\quick-access-v3_3038\Bin\Release\QAToastCreator.pdb

api-ms-win-core-winrt-l1-1-0

RoUninitialize RoGetActivationFactory RoInitialize

api-ms-win-core-winrt-string-l1-1-0

WindowsDeleteString WindowsCreateStringReference

shlwapi

SHStrDupW PathRemoveFileSpecW PathFileExistsW

kernel32

LeaveCriticalSection WriteConsoleW SetFilePointerEx GetConsoleMode GetConsoleCP FlushFileBuffers HeapReAlloc HeapSize GetProcessHeap GetStringTypeW GetCommandLineW Sleep CreateDirectoryW RaiseException GetFileType SetStdHandle LCMapStringW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetCPInfo GetOEMCP IsValidCodePage FindNextFileW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW GetModuleHandleW RtlPcToFileHeader EncodePointer RtlUnwindEx GetLastError SetLastError EnterCriticalSection CreateFileW DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary GetProcAddress LoadLibraryExW GetStdHandle WriteFile GetModuleFileNameW MultiByteToWideChar WideCharToMultiByte ExitProcess GetModuleHandleExW GetACP HeapFree HeapAlloc CloseHandle FindClose FindFirstFileExW

user32

DefWindowProcW PostMessageW SetWindowLongPtrW DispatchMessageW TranslateMessage GetMessageW GetWindowLongPtrW PostQuitMessage RegisterClassExW LoadCursorW LoadIconW LoadStringW CreateWindowExW

shell32

ShellExecuteW CommandLineToArgvW

ole32

PropVariantClear CoCreateInstance

Name

.text

Size

52KB

Virtual Size

52KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

41KB

Virtual Size

40KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

6KB

Virtual Size

14KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.gfids

Size

512B

Virtual Size

204B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

146KB

Virtual Size

146KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

1.2MB

Virtual Size

1.8MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-11-02_cb27260f773f81a47d8be14671c186e1_icedid_ryuk

api-ms-win-core-winrt-l1-1-0

api-ms-win-core-winrt-string-l1-1-0

shlwapi

kernel32

user32

shell32

ole32

generic