2026-04-15_3705618fc536993ad8fa9825e0a8e430_icedid_mespinoza_njrat_ryuk

Sharing

Copy URL Twitter E-mail

General

Target
2026-04-15_3705618fc536993ad8fa9825e0a8e430_icedid_mespinoza_njrat_ryuk
Size 3.2MB
Sample260415-styq4aby4m
SHA256 feb5610e157c0d41d083dd6651b35a9f5d2b24d33af0e9ec490838ec73de7cc7
MD5 3705618fc536993ad8fa9825e0a8e430
SHA1 4f3646cfe80bf999945aeeedfebec0dc5400d3f4
SHA512 b625643d119d39a760ca4ff26f5cd21f270af5f92800efa5559c81d2ccdbd271bdd5239c694d24b8e7e3d0a8968cb9782ec2f219532ffab8a444a4d38ea7718d
SSDEEP 24576:Le5NgcWvaY+wXVoXoDyhRXJG+OAQWmOxm0qY0gQzUtcbV86Z/glD/dsa:K5ecG7V+dOAlmOA5Y0fzUtcR86had3
TLSH
T1B3F5C05AA76081F9D8678270C866C1B2E6F2BCCA96348B0F1650DF6B3F335614F2E715
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-04-15_3705618fc536993ad8fa9825e0a8e430_icedid_mespinoza_njrat_ryuk

File Explorer

2026-04-15_3705618fc536993ad8fa9825e0a8e430_icedid_mespinoza_njrat_ryuk

.exe 3.2MB

2026-04-15_3705618fc536993ad8fa9825e0a8e430_icedid_mespinoza_njrat_ryuk

IMPHASH ee4dd84dff8ffc352ca2d8f33527443e
SHA256 feb5610e157c0d41d083dd6651b35a9f5d2b24d33af0e9ec490838ec73de7cc7
MD5 3705618fc536993ad8fa9825e0a8e430
SHA1 4f3646cfe80bf999945aeeedfebec0dc5400d3f4
SHA512 b625643d119d39a760ca4ff26f5cd21f270af5f92800efa5559c81d2ccdbd271bdd5239c694d24b8e7e3d0a8968cb9782ec2f219532ffab8a444a4d38ea7718d
SSDEEP 24576:Le5NgcWvaY+wXVoXoDyhRXJG+OAQWmOxm0qY0gQzUtcbV86Z/glD/dsa:K5ecG7V+dOAlmOA5Y0fzUtcR86had3
TLSH
T1B3F5C05AA76081F9D8678270C866C1B2E6F2BCCA96348B0F1650DF6B3F335614F2E715
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

163040

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

P:\Target\x64\ship\dw\x-none\dw20.pdb

advapi32

GetSecurityDescriptorDacl RegCloseKey RegCreateKeyExA RegDeleteValueA RegDeleteValueW RegOpenKeyExA RegQueryValueExA RegQueryValueExW RegSetValueExA RegSetValueExW SetNamedSecurityInfoW ConvertSidToStringSidA ConvertStringSecurityDescriptorToSecurityDescriptorA GetUserNameA RegEnumKeyExA RegEnumValueA RegQueryInfoKeyA DeregisterEventSource RegisterEventSourceW ReportEventA ReportEventW AllocateAndInitializeSid CheckTokenMembership FreeSid RegEnumValueW RegQueryInfoKeyW OpenProcessToken GetTokenInformation RegCreateKeyExW RegOpenKeyExW AddAccessAllowedAce AddAccessDeniedAce CopySid CreateWellKnownSid EqualSid GetLengthSid InitializeAcl InitializeSecurityDescriptor IsValidSid SetSecurityDescriptorDacl ConvertStringSecurityDescriptorToSecurityDescriptorW OpenThreadToken

comctl32

ord17 ImageList_Destroy ImageList_ReplaceIcon ImageList_Create

cabinet

ord10 ord13 ord12 ord14 ord20 ord21 ord22 ord23 ord11

gdi32

CreateSolidBrush CreateDCW SetMapMode SaveDC RestoreDC GetTextExtentPoint32W GetDeviceCaps DeleteObject DeleteDC CreateFontA CreateFontIndirectW CreateFontIndirectA GetTextFaceA GetObjectW ExtTextOutW GetObjectA GetTextMetricsA SetTextAlign SetBkMode SetTextColor SelectObject

kernel32

GetTimeFormatW GetFileSize SetFilePointer RaiseException ExitThread SuspendThread SetPriorityClass GetTickCount64 UnmapViewOfFile CreateFileMappingA GetComputerNameA GetModuleFileNameA GetModuleHandleW LoadLibraryExA MulDiv GetACP GetSystemDefaultUILanguage GetSystemDefaultLangID GetUserDefaultLangID GetSystemDefaultLCID SetEnvironmentVariableA ExpandEnvironmentStringsW CreateDirectoryW GetFileAttributesW GetDateFormatW GetTempPathW SetEvent CreateRemoteThread SetThreadPriority CreateProcessW OpenProcess GetSystemInfo GetSystemDirectoryA VirtualQueryEx ReadProcessMemory WideCharToMultiByte IsDBCSLeadByte ResetEvent WaitForSingleObjectEx CreateEventW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentThreadId InitializeSListHead IsDebuggerPresent GetStartupInfoW RtlUnwindEx RtlPcToFileHeader InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW InterlockedPushEntrySList InterlockedFlushSList EncodePointer HeapSize GetStdHandle ExitProcess GetModuleHandleExW HeapFree HeapAlloc GetCurrentThread GetFileType HeapReAlloc OutputDebugStringA FindFirstFileExA FindNextFileA IsValidCodePage GetOEMCP GetCPInfo GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW LCMapStringW SetStdHandle GetStringTypeW GetConsoleCP GetConsoleMode SetFilePointerEx FlushFileBuffers WriteConsoleW CreateFileW GetLongPathNameW GetShortPathNameW GlobalAlloc GlobalFree lstrcmpiW UnregisterWaitEx QueryDepthSList InterlockedPopEntrySList ReleaseSemaphore VirtualFree VirtualAlloc FreeLibraryAndExitThread GetThreadTimes MoveFileW LocalFree GetSystemWindowsDirectoryW GetTickCount GetSystemTimeAsFileTime SetLastError WriteFile FindNextFileW FindFirstFileW FindClose MultiByteToWideChar GetModuleFileNameW FreeLibrary GetVersionExW GetVersionExA DeleteCriticalSection InitializeCriticalSection GetProcessHeap MapViewOfFile SetProcessWorkingSetSize GetProcAddress GetModuleHandleA CreateThread TerminateProcess GetCurrentProcessId GetCurrentProcess WaitForMultipleObjects Sleep WaitForSingleObject ReleaseMutex SetErrorMode SetUnhandledExceptionFilter CloseHandle DeleteFileW GetCommandLineW GetLocalTime LeaveCriticalSection EnterCriticalSection GetLastError SetEndOfFile VirtualProtect VirtualQuery LoadLibraryW CreateActCtxW ActivateActCtx DeactivateActCtx FindActCtxSectionStringW QueryActCtxW LCIDToLocaleName LocaleNameToLCID GetLocaleInfoEx GetStringTypeExW GetUserDefaultLocaleName InitializeCriticalSectionEx GetShortPathNameA GetLogicalProcessorInformation CreateMutexA CreateEventA OpenEventA OpenMutexA CreateSemaphoreA OpenSemaphoreA LocalAlloc CreateFileA GetSystemDefaultLocaleName EnumSystemLocalesEx GetDateFormatEx GetCalendarInfoEx GetThreadUILanguage LoadResource SizeofResource FindResourceW CompareStringEx DuplicateHandle TryEnterCriticalSection CreateTimerQueue SignalObjectAndWait SwitchToThread GetThreadPriority CreateTimerQueueTimer ChangeTimerQueueTimer DeleteTimerQueueTimer GetNumaHighestNodeNumber GetProcessAffinityMask SetThreadAffinityMask RegisterWaitForSingleObject UnregisterWait DecodePointer

ole32

CoCreateGuid CoCreateInstance StringFromIID CoTaskMemFree CoUninitialize CoInitializeEx

oleaut32

SysStringLen SysFreeString SysAllocString SystemTimeToVariantTime VariantTimeToDosDateTime

wintrust

WinVerifyTrust WTHelperProvDataFromStateData

Name

.text

Size

574KB

Virtual Size

573KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

308KB

Virtual Size

307KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

1.7MB

Virtual Size

1.7MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

31KB

Virtual Size

31KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

15KB

Virtual Size

14KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

572KB

Virtual Size

576KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-04-15_3705618fc536993ad8fa9825e0a8e430_icedid_mespinoza_njrat_ryuk

advapi32

comctl32

cabinet

gdi32

kernel32

ole32

oleaut32

wintrust

generic