2026-05-04_db856023580dd1c7b34ffcad8ffd10ea_icedid_mespinoza_njrat_ryuk_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-05-04_db856023580dd1c7b34ffcad8ffd10ea_icedid_mespinoza_njrat_ryuk_vidar
Size 1.9MB
Sample260504-dlmljaft3p
SHA256 6ceab8da06a56049dca712c14b486b8a17ce31ad1b8bcadf5b869e8e15bf99a0
MD5 db856023580dd1c7b34ffcad8ffd10ea
SHA1 fa9d205b738a86cd7ce81b00b455aeda5f32bfc2
SHA512 ff9698b0f63161e3679fd650aee388f4b124ad660b1bac332efa609e2bf4d6fea86e6b7124302146c5dd12a34a2796e3c598930afdb1a4edc3943b23a28181cc
SSDEEP 24576:7YRM7Y2cb+cRE+Yz7KEMdX6keYnAcerv:E+LcnRDYPKEnSG
TLSH
T18B95E01BE25510F9E06BC279CB528801EAB17C450B25AAEF2354D3361F77AE44F3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-05-04_db856023580dd1c7b34ffcad8ffd10ea_icedid_mespinoza_njrat_ryuk_vidar

File Explorer

2026-05-04_db856023580dd1c7b34ffcad8ffd10ea_icedid_mespinoza_njrat_ryuk_vidar

.exe 1.9MB

2026-05-04_db856023580dd1c7b34ffcad8ffd10ea_icedid_mespinoza_njrat_ryuk_vidar

IMPHASH 6a8bffcb635443fadba2b7b98db52eda
SHA256 6ceab8da06a56049dca712c14b486b8a17ce31ad1b8bcadf5b869e8e15bf99a0
MD5 db856023580dd1c7b34ffcad8ffd10ea
SHA1 fa9d205b738a86cd7ce81b00b455aeda5f32bfc2
SHA512 ff9698b0f63161e3679fd650aee388f4b124ad660b1bac332efa609e2bf4d6fea86e6b7124302146c5dd12a34a2796e3c598930afdb1a4edc3943b23a28181cc
SSDEEP 24576:7YRM7Y2cb+cRE+Yz7KEMdX6keYnAcerv:E+LcnRDYPKEnSG
TLSH
T18B95E01BE25510F9E06BC279CB528801EAB17C450B25AAEF2354D3361F77AE44F3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

188048

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

elevation_service.exe.pdb

advapi32

AddAce CopySid GetAclInformation GetLengthSid GetSecurityDescriptorControl GetSecurityDescriptorDacl GetSecurityDescriptorGroup GetSecurityDescriptorOwner GetSecurityDescriptorSacl GetSidLengthRequired GetSidSubAuthority InitializeAcl InitializeSecurityDescriptor InitializeSid IsValidSid MakeAbsoluteSD RegisterServiceCtrlHandlerW SetSecurityDescriptorDacl SetSecurityDescriptorGroup SetSecurityDescriptorOwner SetServiceStatus StartServiceCtrlDispatcherW

kernel32

AcquireSRWLockExclusive CloseHandle CreateEventW CreateFileW DecodePointer DeleteCriticalSection DeleteFileW EncodePointer EnterCriticalSection EnumSystemLocalesW ExitProcess FindClose FindFirstFileExW FindNextFileW FlushFileBuffers FormatMessageA FreeEnvironmentStringsW FreeLibrary GetACP GetCPInfo GetCommandLineA GetCommandLineW GetConsoleCP GetConsoleMode GetCurrentDirectoryW GetCurrentProcess GetCurrentProcessId GetCurrentThreadId GetEnvironmentStringsW GetEnvironmentVariableW GetFileType GetLastError GetLocalTime GetLocaleInfoW GetModuleFileNameW GetModuleHandleExW GetModuleHandleW GetNativeSystemInfo GetOEMCP GetProcAddress GetProcessHeap GetStartupInfoW GetStdHandle GetStringTypeW GetSystemInfo GetSystemTimeAsFileTime GetTickCount GetUserDefaultLCID HeapAlloc HeapCreate HeapDestroy HeapFree HeapReAlloc HeapSetInformation HeapSize InitializeCriticalSectionAndSpinCount InitializeSListHead IsDebuggerPresent IsProcessorFeaturePresent IsValidCodePage IsValidLocale LCMapStringW LeaveCriticalSection LoadLibraryExA LoadLibraryExW LocalFree MultiByteToWideChar OutputDebugStringA OutputDebugStringW QueryPerformanceCounter QueryPerformanceFrequency RaiseException ReadConsoleW ReadFile ReleaseSRWLockExclusive ResetEvent RtlCaptureContext RtlCaptureStackBackTrace RtlLookupFunctionEntry RtlPcToFileHeader RtlUnwindEx RtlVirtualUnwind SetEvent SetFilePointerEx SetLastError SetStdHandle SetUnhandledExceptionFilter Sleep SwitchToThread TerminateProcess TlsAlloc TlsFree TlsGetValue TlsSetValue TryAcquireSRWLockExclusive UnhandledExceptionFilter VirtualProtect VirtualQuery WaitForSingleObject WaitForSingleObjectEx WideCharToMultiByte WriteConsoleW WriteFile

ole32

CoAddRefServerProcess CoInitializeEx CoInitializeSecurity CoRegisterClassObject CoReleaseServerProcess CoResumeClassObjects CoRevokeClassObject CoUninitialize

shell32

CommandLineToArgvW

winmm

timeGetTime

Name

.text

Size

299KB

Virtual Size

299KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

99KB

Virtual Size

99KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

19KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

14KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.00cfg

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

1.5MB

Virtual Size

1.5MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-05-04_db856023580dd1c7b34ffcad8ffd10ea_icedid_mespinoza_njrat_ryuk_vidar

advapi32

kernel32

ole32

shell32

winmm

generic