2026-04-23_2ee165ad45bde5f4d9d9dc05db3c0366_hijackloader_icedid_luca-stealer_mespinoza_njrat_ryuk_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-04-23_2ee165ad45bde5f4d9d9dc05db3c0366_hijackloader_icedid_luca-stealer_mespinoza_njrat_ryuk_stealc
Size 1.1MB
Sample260423-e8y4hsaz3v
SHA256 30541072f7b88f037e4cca04bd2ab77b9e9788a5bd76292c24b2a2e2c17d3947
MD5 2ee165ad45bde5f4d9d9dc05db3c0366
SHA1 abf09a33f01d0c77dff9fd85d16caf8944a5d6a6
SHA512 b32be2ee640a762f23e130b59cdacae4309c0bce220c5832262381c9641f47558d793f2442d24cf2e0acadf91696e619980d6c22ab50385d9b9aec2f472e6f52
SSDEEP 24576:h8+q9xTVl6jZk1oTgJbkubr1LQSBlrvxzAA9ETsgX3W1fyxdNaxpX4POD96KOeHv:h8+q93cZk1oTgJbkubr1LQSBlrvxzAAP
TLSH
T1EB35803111E9E466F26DC1B8FB4A5BD28F21718D021867FB45EDCAE13731DA16A2C372
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-04-23_2ee165ad45bde5f4d9d9dc05db3c0366_hijackloader_icedid_luca-stealer_mespinoza_njrat_ryuk_stealc

File Explorer

2026-04-23_2ee165ad45bde5f4d9d9dc05db3c0366_hijackloader_icedid_luca-stealer_mespinoza_njrat_ryuk_stealc

.exe 1.1MB

2026-04-23_2ee165ad45bde5f4d9d9dc05db3c0366_hijackloader_icedid_luca-stealer_mespinoza_njrat_ryuk_stealc

IMPHASH 4e28ad5e3b796beca5dac6f621d30e5f
SHA256 30541072f7b88f037e4cca04bd2ab77b9e9788a5bd76292c24b2a2e2c17d3947
MD5 2ee165ad45bde5f4d9d9dc05db3c0366
SHA1 abf09a33f01d0c77dff9fd85d16caf8944a5d6a6
SHA512 b32be2ee640a762f23e130b59cdacae4309c0bce220c5832262381c9641f47558d793f2442d24cf2e0acadf91696e619980d6c22ab50385d9b9aec2f472e6f52
SSDEEP 24576:h8+q9xTVl6jZk1oTgJbkubr1LQSBlrvxzAA9ETsgX3W1fyxdNaxpX4POD96KOeHv:h8+q93cZk1oTgJbkubr1LQSBlrvxzAAP
TLSH
T1EB35803111E9E466F26DC1B8FB4A5BD28F21718D021867FB45EDCAE13731DA16A2C372
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

733440

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

virtmapper.pdb

kernel32

AcquireSRWLockExclusive AreFileApisANSI CloseHandle CompareStringW CreateFileW DecodePointer DeleteCriticalSection DeleteFileW DeviceIoControl EncodePointer EnterCriticalSection EnumSystemLocalesW ExitProcess FindClose FindFirstFileExW FindFirstFileW FindNextFileW FlsAlloc FlsFree FlsGetValue FlsSetValue FlushFileBuffers FormatMessageA FreeEnvironmentStringsW FreeLibrary GetACP GetCPInfo GetCommandLineA GetCommandLineW GetConsoleMode GetConsoleOutputCP GetCurrentProcess GetCurrentProcessId GetCurrentThreadId GetEnvironmentStringsW GetFileAttributesExW GetFileAttributesW GetFileInformationByHandleEx GetFileSizeEx GetFileType GetLastError GetLocaleInfoEx GetLocaleInfoW GetModuleFileNameW GetModuleHandleA GetModuleHandleExW GetModuleHandleW GetOEMCP GetProcAddress GetProcessHeap GetStartupInfoW GetStdHandle GetStringTypeW GetSystemDirectoryA GetSystemDirectoryW GetSystemTimeAsFileTime GetTempPathW GetTickCount GetUserDefaultLCID GetWindowsDirectoryA HeapAlloc HeapFree HeapReAlloc HeapSize InitializeCriticalSectionAndSpinCount InitializeCriticalSectionEx InitializeSListHead IsDebuggerPresent IsProcessorFeaturePresent IsValidCodePage IsValidLocale LCMapStringEx LCMapStringW LeaveCriticalSection LoadLibraryExA LoadLibraryExW LocalFree MultiByteToWideChar QueryPerformanceCounter RaiseException ReadConsoleW ReadFile ReleaseSRWLockExclusive RtlCaptureContext RtlLookupFunctionEntry RtlPcToFileHeader RtlUnwind RtlUnwindEx RtlVirtualUnwind SetEndOfFile SetEnvironmentVariableW SetFilePointerEx SetLastError SetStdHandle SetUnhandledExceptionFilter SleepConditionVariableSRW TerminateProcess TlsAlloc TlsFree TlsGetValue TlsSetValue UnhandledExceptionFilter VirtualAlloc VirtualFree VirtualProtect WakeAllConditionVariable WideCharToMultiByte WriteConsoleW WriteFile

advapi32

RegCloseKey RegCreateKeyW RegDeleteTreeW RegOpenKeyW RegSetKeyValueW

ntdll

NtLoadDriver NtQuerySystemInformation NtUnloadDriver RtlAdjustPrivilege RtlInitUnicodeString

Name

.text

Size

853KB

Virtual Size

852KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

187KB

Virtual Size

186KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

28KB

Virtual Size

35KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

14KB

Virtual Size

14KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_RDATA

Size

512B

Virtual Size

500B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-04-23_2ee165ad45bde5f4d9d9dc05db3c0366_hijackloader_icedid_luca-stealer_mespinoza_njrat_ryuk_stealc

kernel32

advapi32

ntdll

generic