2026-11-12_41be54bd613fd6db108f35e43c49c48a_icedid_njrat_ryuk

Sharing

Copy URL Twitter E-mail

General

Target
2026-11-12_41be54bd613fd6db108f35e43c49c48a_icedid_njrat_ryuk
Size 3.6MB
Sample261113-e41fsaf18q
SHA256 bccd57223bb7695a4b7f6046fb0126d4cb901c9e41f81fbec55abe4fc64d1bee
MD5 41be54bd613fd6db108f35e43c49c48a
SHA1 972707e60188a14841f3005eede4bb00881b5cb5
SHA512 cad7ff81bc998b0a7c20ecf9f5aa0f9ff15aee3a45d6eb3f44bcf65215f51f41f5bbd056140a150346e37aa24b6a44a758514a500c7bd590a470ec774a5d2c1f
SSDEEP 49152:jMRKvpJBZOhcQ0TlGRDxSpRqrWAVIuxtjlrEYnLfeAahbBHCe296xK:jMGZZOm8R/qDBHER
TLSH
T18D064A167A9A51EDC08BC474A34E45636E2178CB0F35B9EF0094E1792FBAAF41F3D624
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

2026-11-12_41be54bd613fd6db108f35e43c49c48a_icedid_njrat_ryuk

.exe 3.6MB

2026-11-12_41be54bd613fd6db108f35e43c49c48a_icedid_njrat_ryuk

IMPHASH 908b923bfe6ea068f0a28299c112c263
SHA256 bccd57223bb7695a4b7f6046fb0126d4cb901c9e41f81fbec55abe4fc64d1bee
MD5 41be54bd613fd6db108f35e43c49c48a
SHA1 972707e60188a14841f3005eede4bb00881b5cb5
SHA512 cad7ff81bc998b0a7c20ecf9f5aa0f9ff15aee3a45d6eb3f44bcf65215f51f41f5bbd056140a150346e37aa24b6a44a758514a500c7bd590a470ec774a5d2c1f
SSDEEP 49152:jMRKvpJBZOhcQ0TlGRDxSpRqrWAVIuxtjlrEYnLfeAahbBHCe296xK:jMGZZOm8R/qDBHER
TLSH
T18D064A167A9A51EDC08BC474A34E45636E2178CB0F35B9EF0094E1792FBAAF41F3D624
MD5 SHA1 SHA512 SSDEEP TLSH

Digest

bf:85:14:1b:57:42:45:09:a9:f0:3e:58:93:7c:8d:b9:e4:2c:c5:c1:eb:61:d4:f2:8b:5a:e4:95:1b:58:cd:fd

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=3582691,CN=Google LLC,O=Google LLC,L=Mountain View,ST=California,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

Chains

Nov 9, 2026

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2026 1,O=DigiCert\, Inc.,C=US

Serial Number

08:4f:dc:33:4f:7e:45:4e:db:c3:0f:8f:f9:92:18:35

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Aug 5, 2026 - Nov 4, 2037

Subject

Serial Number

0b:50:cf:24:6b:26:3e:fd:85:a7:29:31:51:58:f3:ff

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 8, 2024 - Apr 10, 2027

Minor OS version

Major OS version

Entry point

2371632

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

/proc/self/cwd/blaze-out/cfg/bin/ops/winops/toaster/gWindows-Toaster.pdb

kernel32

AcquireSRWLockExclusive CloseHandle CompareFileTime CompareStringW CreateEventW CreateFileA CreateFileMappingW CreateFileW CreateThread CreateToolhelp32Snapshot DeleteCriticalSection DeleteFileW EncodePointer EnterCriticalSection EnumSystemLocalesW ExitProcess ExitThread FindClose FindCloseChangeNotification FindFirstChangeNotificationW FindFirstFileExW FindFirstFileW FindNextChangeNotification FindNextFileW FlsAlloc FlsFree FlsGetValue FlsSetValue FlushFileBuffers FormatMessageA FreeEnvironmentStringsW FreeLibrary FreeLibraryAndExitThread GetACP GetCPInfo GetCommandLineA GetCommandLineW GetConsoleMode GetConsoleOutputCP GetCurrentDirectoryA GetCurrentProcess GetCurrentProcessId GetCurrentThreadId GetDateFormatW GetDynamicTimeZoneInformation GetEnvironmentStringsW GetEnvironmentVariableA GetEnvironmentVariableW GetExitCodeProcess GetFileAttributesW GetFileSize GetFileSizeEx GetFileType GetLastError GetLocaleInfoEx GetLocaleInfoW GetLogicalProcessorInformation GetModuleFileNameW GetModuleHandleExW GetModuleHandleW GetOEMCP GetProcAddress GetProcessHeap GetStartupInfoW GetStdHandle GetStringTypeW GetSystemDirectoryW GetSystemInfo GetSystemTimeAsFileTime GetTimeFormatW GetTimeZoneInformation GetUserDefaultLCID HeapAlloc HeapFree HeapQueryInformation HeapReAlloc HeapSize InitializeConditionVariable InitializeCriticalSectionAndSpinCount InitializeCriticalSectionEx InitializeSListHead InitializeSRWLock IsDebuggerPresent IsProcessorFeaturePresent IsValidCodePage IsValidLocale K32GetModuleFileNameExW LCMapStringW LeaveCriticalSection LoadLibraryExW LoadLibraryW LocalFileTimeToFileTime LocalFree MapViewOfFile MoveFileExW MultiByteToWideChar OpenProcess OutputDebugStringA Process32FirstW Process32NextW ProcessIdToSessionId QueryPerformanceCounter QueryPerformanceFrequency RaiseException ReadConsoleW ReadFile ReleaseSRWLockExclusive ResetEvent RtlCaptureContext RtlCaptureStackBackTrace RtlLookupFunctionEntry RtlPcToFileHeader RtlUnwind RtlUnwindEx RtlVirtualUnwind SetEndOfFile SetEnvironmentVariableW SetEvent SetFilePointerEx SetLastError SetStdHandle SetUnhandledExceptionFilter Sleep SleepConditionVariableSRW SwitchToThread SystemTimeToFileTime TerminateProcess TlsAlloc TlsFree TlsGetValue TlsSetValue UnhandledExceptionFilter UnmapViewOfFile VerSetConditionMask VerifyVersionInfoW VirtualAlloc VirtualProtect WaitForMultipleObjects WaitForSingleObject WaitForSingleObjectEx WakeAllConditionVariable WakeConditionVariable WideCharToMultiByte WriteConsoleW WriteFile

wtsapi32

WTSEnumerateSessionsW WTSFreeMemory WTSLogoffSession WTSQuerySessionInformationW WTSQueryUserToken WTSShutdownSystem

user32

CloseDesktop ExitWindowsEx OpenInputDesktop

advapi32

AdjustTokenPrivileges AllocateAndInitializeSid CheckTokenMembership ConvertSidToStringSidW ConvertStringSecurityDescriptorToSecurityDescriptorW CreateProcessAsUserW DeregisterEventSource DuplicateTokenEx FreeSid GetTokenInformation IsWellKnownSid LookupPrivilegeValueW OpenProcessToken RegCloseKey RegCreateKeyExW RegDeleteKeyValueW RegDeleteValueW RegEnumValueW RegGetValueW RegNotifyChangeKeyValue RegOpenKeyExA RegOpenKeyExW RegQueryValueExA RegQueryValueExW RegSetValueExW RegisterEventSourceW RegisterServiceCtrlHandlerW ReportEventW SetServiceStatus StartServiceCtrlDispatcherW

shlwapi

AssocQueryStringW PathFileExistsW

userenv

CreateEnvironmentBlock DestroyEnvironmentBlock

shell32

CommandLineToArgvW ShellExecuteW

crypt32

CertCloseStore CertDuplicateCertificateContext CertEnumCertificatesInStore CertFreeCertificateContext CertGetCertificateContextProperty CertGetEnhancedKeyUsage CertGetNameStringW CertOpenStore CertVerifyTimeValidity

ws2_32

WSACleanup WSAStartup

ole32

CoCreateGuid CoCreateInstance CoInitializeEx CoInitializeSecurity CoSetProxyBlanket CoTaskMemAlloc CoUninitialize PropVariantClear

oleaut32

SysAllocString SysFreeString VariantClear VariantInit

winhttp

WinHttpAddRequestHeaders WinHttpCloseHandle WinHttpConnect WinHttpOpen WinHttpOpenRequest WinHttpQueryDataAvailable WinHttpQueryHeaders WinHttpReadData WinHttpReceiveResponse WinHttpSendRequest WinHttpSetOption

dbghelp

SymFromAddr SymInitialize SymSetOptions

bcrypt

BCryptCloseAlgorithmProvider BCryptGenRandom BCryptOpenAlgorithmProvider

Name

.text

Size

2.5MB

Virtual Size

2.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

812KB

Virtual Size

812KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

67KB

Virtual Size

92KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

121KB

Virtual Size

121KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data.re

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.data.re

Size

10KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

441B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_RDATA

Size

512B

Virtual Size

500B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

flags_he

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

google_i

Size

512B

Virtual Size

281B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

malloc_h

Size

1024B

Virtual Size

680B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

protodes

Size

28KB

Virtual Size

28KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

18KB

Virtual Size

18KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-11-12_41be54bd613fd6db108f35e43c49c48a_icedid_njrat_ryuk

kernel32

wtsapi32

user32

advapi32

shlwapi

userenv

shell32

crypt32

ws2_32

ole32

oleaut32

winhttp

dbghelp

bcrypt

generic