2026-11-06_d266039d78f92ff770c35bc8eaea6832_icedid_njrat_ryuk

Sharing

Copy URL Twitter E-mail

General

Target
2026-11-06_d266039d78f92ff770c35bc8eaea6832_icedid_njrat_ryuk
Size 1.3MB
Sample261107-2e441avzcv
SHA256 c320e0d39e40c9f0e1b0dd7ebf6677839c620830d34aeb847f5190adaa323da5
MD5 d266039d78f92ff770c35bc8eaea6832
SHA1 2be7bd92d8181a1a7bcfabc83c61926b29188f5b
SHA512 fbf8c2ae8afba96330b0314384ab0f19629c3644666af640312c8158f2c9d3c68eab7fb324d981bbc3e1f1e5baf3c0cfd97d57597ce7e5d37f56dccdaeb8cff8
SSDEEP 24576:6XSVtghG6MgfHY3WrCyeXXEKX5eQNH/a6apOjhK1f4ltQeQQwt+OlY7q9Ueb51a:NVj6MgvleyeXXEKXpHLRwUN
TLSH
T1D8559D87E69751ECC056C0B58359A733FAB1B80547146EFB47A4C7312E26BE0AE3CB64
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-11-06_d266039d78f92ff770c35bc8eaea6832_icedid_njrat_ryuk

File Explorer

2026-11-06_d266039d78f92ff770c35bc8eaea6832_icedid_njrat_ryuk

.exe 1.3MB

2026-11-06_d266039d78f92ff770c35bc8eaea6832_icedid_njrat_ryuk

IMPHASH 5a1317152ac5f64cad99d83ad1c074a2
SHA256 c320e0d39e40c9f0e1b0dd7ebf6677839c620830d34aeb847f5190adaa323da5
MD5 d266039d78f92ff770c35bc8eaea6832
SHA1 2be7bd92d8181a1a7bcfabc83c61926b29188f5b
SHA512 fbf8c2ae8afba96330b0314384ab0f19629c3644666af640312c8158f2c9d3c68eab7fb324d981bbc3e1f1e5baf3c0cfd97d57597ce7e5d37f56dccdaeb8cff8
SSDEEP 24576:6XSVtghG6MgfHY3WrCyeXXEKX5eQNH/a6apOjhK1f4ltQeQQwt+OlY7q9Ueb51a:NVj6MgvleyeXXEKXpHLRwUN
TLSH
T1D8559D87E69751ECC056C0B58359A733FAB1B80547146EFB47A4C7312E26BE0AE3CB64
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

973152

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

/mnt/c/src/tf_zombies/src/build/windows_static_cross_Release/out/bspzip++.pdb

shell32

CommandLineToArgvW

advapi32

AdjustTokenPrivileges LookupPrivilegeValueA OpenProcessToken RegCloseKey RegOpenKeyExA RegQueryValueExA

kernel32

AcquireSRWLockExclusive CancelIoEx CloseHandle CompareStringW CreateDirectoryW CreateEventA CreateFileA CreateFileW CreateThread DeleteCriticalSection DeleteFileA DeleteFileW EncodePointer EnterCriticalSection ExitProcess ExitThread FileTimeToSystemTime FindClose FindFirstFileExW FindFirstFileW FindNextFileW FlsAlloc FlsFree FlsGetValue FlsSetValue FlushFileBuffers FreeEnvironmentStringsW FreeLibrary FreeLibraryAndExitThread GetACP GetCPInfo GetCommandLineA GetCommandLineW GetConsoleCP GetConsoleMode GetConsoleOutputCP GetConsoleScreenBufferInfo GetCurrentDirectoryW GetCurrentProcess GetCurrentProcessId GetCurrentProcessorNumber GetCurrentThreadId GetDriveTypeW GetEnvironmentStringsW GetEnvironmentVariableA GetExitCodeThread GetFileAttributesExW GetFileAttributesW GetFileSizeEx GetFileType GetFullPathNameW GetLastError GetLocalTime GetModuleFileNameA GetModuleFileNameW GetModuleHandleA GetModuleHandleExW GetModuleHandleW GetOEMCP GetOverlappedResult GetProcAddress GetProcessHeap GetProcessTimes GetStartupInfoW GetStdHandle GetStringTypeW GetSystemInfo GetSystemTimeAsFileTime GetTempPathW InitializeCriticalSection InitializeCriticalSectionAndSpinCount InitializeCriticalSectionEx InitializeSListHead InitializeSRWLock IsDebuggerPresent IsProcessorFeaturePresent IsValidCodePage LCMapStringW LeaveCriticalSection LoadLibraryA LoadLibraryExW LocalFree MoveFileExW MultiByteToWideChar OutputDebugStringA QueryPerformanceCounter QueryPerformanceFrequency RaiseException ReadConsoleInputW ReadConsoleW ReadDirectoryChangesW ReadFile ReleaseSRWLockExclusive ResetEvent RtlCaptureContext RtlLookupFunctionEntry RtlPcToFileHeader RtlUnwind RtlUnwindEx RtlVirtualUnwind SetConsoleMode SetConsoleTextAttribute SetEndOfFile SetEnvironmentVariableW SetEvent SetFileAttributesW SetFilePointer SetFilePointerEx SetLastError SetStdHandle SetThreadPriority SetUnhandledExceptionFilter Sleep SystemTimeToTzSpecificLocalTime TerminateProcess TerminateThread TlsAlloc TlsFree TlsGetValue TlsSetValue TryAcquireSRWLockExclusive UnhandledExceptionFilter VirtualAlloc VirtualFree VirtualProtect VirtualQuery WaitForMultipleObjects WaitForSingleObject WideCharToMultiByte WriteConsoleA WriteConsoleW WriteFile

Name

.text

Size

1.1MB

Virtual Size

1.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

154KB

Virtual Size

153KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

21KB

Virtual Size

69.6MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

21KB

Virtual Size

20KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

97B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_RDATA

Size

512B

Virtual Size

500B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

17KB

Virtual Size

17KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-11-06_d266039d78f92ff770c35bc8eaea6832_icedid_njrat_ryuk

shell32

advapi32

kernel32

generic