2026-11-10_fbfd44d590e6c7dccfab37dfe528701e_hijackloader_icedid_njrat_ryuk

Sharing

Copy URL Twitter E-mail

General

Target
2026-11-10_fbfd44d590e6c7dccfab37dfe528701e_hijackloader_icedid_njrat_ryuk
Size 380KB
Sample261110-e2yt6syza1
SHA256 027ba790455f9008315df183af5afc467ab2bcd7ccdd74334ea76d5bd616d94c
MD5 fbfd44d590e6c7dccfab37dfe528701e
SHA1 562547bdc51697004a4599e2f5da59b94cf081b7
SHA512 967003197fb6bccf016e5ff117cc8d700ace088d40910cd9a80a0e6ecc9ac43639304d33ad6f86de1c2ef26cbfa597e337631ce3436a3322f374a1c9ced30613
SSDEEP 6144:uTIouiesmi2YYl7Yhy1y8Pzkhwod9GjVL9hpq3C:uTIhrYYZYhebkKkuhpmC
TLSH
T120843A19BF6488E5F966A1FC89B58F4AE6717C150B21D7CB0370721A3F336E28D39621
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-11-10_fbfd44d590e6c7dccfab37dfe528701e_hijackloader_icedid_njrat_ryuk

File Explorer

2026-11-10_fbfd44d590e6c7dccfab37dfe528701e_hijackloader_icedid_njrat_ryuk

.exe 380KB

2026-11-10_fbfd44d590e6c7dccfab37dfe528701e_hijackloader_icedid_njrat_ryuk

IMPHASH 6bf6001d2c638c09f7580c858d97c896
SHA256 027ba790455f9008315df183af5afc467ab2bcd7ccdd74334ea76d5bd616d94c
MD5 fbfd44d590e6c7dccfab37dfe528701e
SHA1 562547bdc51697004a4599e2f5da59b94cf081b7
SHA512 967003197fb6bccf016e5ff117cc8d700ace088d40910cd9a80a0e6ecc9ac43639304d33ad6f86de1c2ef26cbfa597e337631ce3436a3322f374a1c9ced30613
SSDEEP 6144:uTIouiesmi2YYl7Yhy1y8Pzkhwod9GjVL9hpq3C:uTIhrYYZYhebkKkuhpmC
TLSH
T120843A19BF6488E5F966A1FC89B58F4AE6717C150B21D7CB0370721A3F336E28D39621
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

127864

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\mpay-pc-webview-support\bin_x64\Release\webviewsupport\webview_support_browser.pdb

kernel32

GetLastError LocalFree SetEvent CloseHandle GetCommandLineW SetLastError CreateFileW WriteConsoleW FlushFileBuffers SetFilePointerEx GetConsoleMode GetConsoleCP HeapReAlloc HeapSize SetStdHandle GetProcessHeap FreeEnvironmentStringsW CreateMutexW WaitForSingleObject GetCurrentThreadId ReleaseMutex CreateEventW GetCurrentProcessId OpenMutexW MapViewOfFile UnmapViewOfFile CreateFileMappingW OpenFileMappingW GetCurrentProcess GetStdHandle GetModuleFileNameW GetVersionExW MultiByteToWideChar WideCharToMultiByte SetThreadPriority TerminateThread Sleep TlsAlloc TlsGetValue TlsSetValue TlsFree EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionAndSpinCount DeleteCriticalSection GetSystemTimeAsFileTime QueryPerformanceCounter CreateIoCompletionPort GetQueuedCompletionStatus PostQueuedCompletionStatus GetModuleHandleW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW InitializeSListHead RtlPcToFileHeader EncodePointer RaiseException RtlUnwindEx FreeLibrary GetProcAddress LoadLibraryExW CreateThread ExitThread FreeLibraryAndExitThread GetModuleHandleExW ExitProcess WriteFile GetACP HeapFree HeapAlloc GetFileType GetStringTypeW LCMapStringW FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetOEMCP GetCPInfo GetCommandLineA GetEnvironmentStringsW OpenEventW

user32

KillTimer DispatchMessageW TranslateMessage GetMessageW DefWindowProcW SetWindowLongPtrW GetWindowLongPtrW CreateWindowExW UnregisterClassW RegisterClassExW PostMessageW DestroyWindow PostQuitMessage PeekMessageW WaitMessage CallMsgFilterW GetQueueStatus MsgWaitForMultipleObjectsEx SetTimer

shell32

CommandLineToArgvW

webview_support

CreateMpayWebviewSupport CheckMpayWebviewSupportVersion

winmm

timeGetTime

advapi32

SetSecurityInfo ConvertStringSecurityDescriptorToSecurityDescriptorW GetSecurityDescriptorSacl

Name

.text

Size

207KB

Virtual Size

206KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

93KB

Virtual Size

93KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

6KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

12KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.gfids

Size

512B

Virtual Size

248B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

18KB

Virtual Size

18KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-11-10_fbfd44d590e6c7dccfab37dfe528701e_hijackloader_icedid_njrat_ryuk

kernel32

user32

shell32

webview_support

winmm

advapi32

generic