2026-11-09_5b90b1a09088db9bbcdc8eb3b53459b5_icedid_njrat_ryuk

Sharing

Copy URL Twitter E-mail

General

Target
2026-11-09_5b90b1a09088db9bbcdc8eb3b53459b5_icedid_njrat_ryuk
Size 1.5MB
Sample261110-xdvrqa1v2j
SHA256 b7eae2cb58babf058242d6b9a0d6046a80f2da1715c3580db5c7ef4f412e551c
MD5 5b90b1a09088db9bbcdc8eb3b53459b5
SHA1 195efe248eccfb2a7ab9f4f57e5c91e7de72e12a
SHA512 69aac0588ba2aa41b1a0c4a71cac42e72a6250f052ef90e10941a1ab5b3aedb0503a8617c9ff4957d9181225412a37e9f495f7fdf2680511d3648822ef7db82b
SSDEEP 12288:Wcq2nRoH/uLJOyo937vGFWxwFJI+yeuVb8r+ZP712Ii+51cjVWtVj5J:VqOK2JOt934J7Z6bQaj1BvUm9J
TLSH
T1F575120BB6A434FDD1368631C8515851E7763C7A4A50AFAF036492665F3B7A0CD3EF21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-11-09_5b90b1a09088db9bbcdc8eb3b53459b5_icedid_njrat_ryuk

File Explorer

2026-11-09_5b90b1a09088db9bbcdc8eb3b53459b5_icedid_njrat_ryuk

.exe 1.5MB

2026-11-09_5b90b1a09088db9bbcdc8eb3b53459b5_icedid_njrat_ryuk

IMPHASH c51e695348cc52b665da24718811bc20
SHA256 b7eae2cb58babf058242d6b9a0d6046a80f2da1715c3580db5c7ef4f412e551c
MD5 5b90b1a09088db9bbcdc8eb3b53459b5
SHA1 195efe248eccfb2a7ab9f4f57e5c91e7de72e12a
SHA512 69aac0588ba2aa41b1a0c4a71cac42e72a6250f052ef90e10941a1ab5b3aedb0503a8617c9ff4957d9181225412a37e9f495f7fdf2680511d3648822ef7db82b
SSDEEP 12288:Wcq2nRoH/uLJOyo937vGFWxwFJI+yeuVb8r+ZP712Ii+51cjVWtVj5J:VqOK2JOt934J7Z6bQaj1BvUm9J
TLSH
T1F575120BB6A434FDD1368631C8515851E7763C7A4A50AFAF036492665F3B7A0CD3EF21
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

8100

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

E:\work\AutoInstall\AutoInstall_V2\RTKAutoInstall\RTKAutoInstall\DriverInstall_Release\x64\WifiAutoInstallDriver.pdb

difxapi

DriverPackageUninstallW DriverPackageInstallW DIFXAPISetLogCallbackW

setupapi

CM_Connect_MachineW CM_Locate_DevNode_ExW CM_Reenumerate_DevNode_Ex

kernel32

FindNextFileW GetCurrentProcess GetModuleFileNameW FindFirstFileW GetPrivateProfileStringW GetLastError CloseHandle GetNativeSystemInfo VerSetConditionMask VerifyVersionInfoW HeapReAlloc SetFilePointerEx WriteConsoleW CreateFileW FindClose HeapSize GetConsoleMode RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW GetModuleHandleW RtlUnwindEx SetLastError EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary GetProcAddress LoadLibraryExW GetStdHandle WriteFile MultiByteToWideChar WideCharToMultiByte ExitProcess GetModuleHandleExW GetCommandLineA GetCommandLineW GetACP HeapFree HeapAlloc GetFileType GetStringTypeW CompareStringW LCMapStringW FindFirstFileExW IsValidCodePage GetOEMCP GetCPInfo GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle GetProcessHeap FlushFileBuffers GetConsoleCP RaiseException

advapi32

GetTokenInformation OpenProcessToken

shell32

ShellExecuteExW

Name

.text

Size

70KB

Virtual Size

70KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

39KB

Virtual Size

39KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

2KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.gfids

Size

512B

Virtual Size

160B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

1.4MB

Virtual Size

2.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-11-09_5b90b1a09088db9bbcdc8eb3b53459b5_icedid_njrat_ryuk

difxapi

setupapi

kernel32

advapi32

shell32

generic