2026-11-12_48e5700129ede1562413487ebc217de7_icedid_njrat_ryuk

General

Target
2026-11-12_48e5700129ede1562413487ebc217de7_icedid_njrat_ryuk
Size 1.6MB
Sample261113-ef3agaft51
SHA256 3da20e19862790f5ae5faf87682adbecf06320010e8fc641f6ec1c0fbacdf657
MD5 48e5700129ede1562413487ebc217de7
SHA1 9c04df05298f5e62c98649121672b5e11b54ef1a
SHA512 d8fd84af59c0a16dc27671edbff13e6e16b2636194036e5014244bed4a2f3a9d9ff1b048ebc9c2e2b3e5b144c0e945a0626df5ba2356f02e699ec68519258180
SSDEEP 24576:dbHFk9uQrKYmcR/hienYsqjnhMgeiCl7G0nehbGZpbD:dmhienEDmg27RnWGj
TLSH
T1C175F166F75419BAD17BD238CA564A15E8B33C064B20A34F13F917AA1F33360663FB25
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-11-12_48e5700129ede1562413487ebc217de7_icedid_njrat_ryuk

File Explorer

2026-11-12_48e5700129ede1562413487ebc217de7_icedid_njrat_ryuk

.exe 1.6MB

2026-11-12_48e5700129ede1562413487ebc217de7_icedid_njrat_ryuk

IMPHASH dc2e249ef016ea03d842e47d03bbfab3
SHA256 3da20e19862790f5ae5faf87682adbecf06320010e8fc641f6ec1c0fbacdf657
MD5 48e5700129ede1562413487ebc217de7
SHA1 9c04df05298f5e62c98649121672b5e11b54ef1a
SHA512 d8fd84af59c0a16dc27671edbff13e6e16b2636194036e5014244bed4a2f3a9d9ff1b048ebc9c2e2b3e5b144c0e945a0626df5ba2356f02e699ec68519258180
SSDEEP 24576:dbHFk9uQrKYmcR/hienYsqjnhMgeiCl7G0nehbGZpbD:dmhienEDmg27RnWGj
TLSH
T1C175F166F75419BAD17BD238CA564A15E8B33C064B20A34F13F917AA1F33360663FB25
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

2

Major OS version

5

Entry point

7244

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

G:\v320\Beta4\src\mnt\cnmmntexe\mnt\obj\Release\x64\cnmpaui.pdb

kernel32

GetCommandLineW CloseHandle OpenFileMappingW MapViewOfFile UnmapViewOfFile FreeLibrary GetProcAddress LoadLibraryExW LoadLibraryW GlobalAlloc GlobalFree CreateFileW WriteConsoleW SetFilePointerEx GetConsoleMode GetConsoleCP FlushFileBuffers HeapReAlloc HeapSize SetConsoleCtrlHandler GetProcessHeap GetStringTypeW GetFileType SetStdHandle EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW GetModuleHandleW RtlUnwindEx InterlockedPushEntrySList InterlockedFlushSList GetLastError SetLastError EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree GetStdHandle WriteFile GetModuleFileNameW GetModuleFileNameA MultiByteToWideChar WideCharToMultiByte ExitProcess GetModuleHandleExW GetACP HeapFree HeapAlloc GetCurrentThread OutputDebugStringA OutputDebugStringW WaitForSingleObjectEx CreateThread FindClose FindFirstFileExA FindFirstFileExW FindNextFileA FindNextFileW IsValidCodePage GetOEMCP GetCPInfo GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableA SetEnvironmentVariableW GetDateFormatW GetTimeFormatW CompareStringW RaiseException

winspool.drv

OpenPrinterW ClosePrinter

user32

LoadImageW DestroyIcon UpdateWindow ShowWindow DestroyWindow IsWindow CreateWindowExW RegisterClassExW UnregisterClassW PostQuitMessage DefWindowProcW SendMessageW DispatchMessageW GetMessageW

Name

.text

Size

269KB

Virtual Size

269KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

63KB

Virtual Size

63KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

16KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.gfids

Size

512B

Virtual Size

364B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

55KB

Virtual Size

54KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

1.2MB

Virtual Size

1.8MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-11-12_48e5700129ede1562413487ebc217de7_icedid_njrat_ryuk

kernel32

winspool.drv

user32

generic