2026-05-06_a5997fbdac86959960455b3fd035e95a_icedid_mespinoza_njrat_ryuk

Resubmissions

21/08/2026, 18:31

260821-w58l8avgra3

06/05/2026, 06:02

260506-grrdfsa13s3

Sharing

Copy URL Twitter E-mail

General

Target
2026-05-06_a5997fbdac86959960455b3fd035e95a_icedid_mespinoza_njrat_ryuk
Size 186KB
Sample260506-grrdfsa13s
SHA256 69ee7f61a280ba1603a80dd15dc8f6f8fea125d366c9808cbca9d0e9129c8321
MD5 a5997fbdac86959960455b3fd035e95a
SHA1 3f69a97ffba7b5840fba77e0599b58ed60d2e4ac
SHA512 8f0dd62cefa78236e5f6d74b00e57b7f9067c0a151bf35882d2ca643cd2a62da1ccd4e96ae95107a3ddc1e24d48b807bc058b3de7918395b5498e3e57399cf90
SSDEEP 3072:/KHOHzoPVb7ap03/9KDw2RvvsQDK9oIrFpaU+hV0fdH0TCFnhv6IvxaJVYYPwit:/KwoPVnaa3/UjeN6Ivxowi
TLSH
T160146B4B72E064F5D1768235C8324D55D7B278325A60ABAF0764D31A2E333939E3BF29
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-05-06_a5997fbdac86959960455b3fd035e95a_icedid_mespinoza_njrat_ryuk

File Explorer

2026-05-06_a5997fbdac86959960455b3fd035e95a_icedid_mespinoza_njrat_ryuk

.exe 186KB

2026-05-06_a5997fbdac86959960455b3fd035e95a_icedid_mespinoza_njrat_ryuk

IMPHASH 7f3864d131389ff49b7612d8eb04b4c8
SHA256 69ee7f61a280ba1603a80dd15dc8f6f8fea125d366c9808cbca9d0e9129c8321
MD5 a5997fbdac86959960455b3fd035e95a
SHA1 3f69a97ffba7b5840fba77e0599b58ed60d2e4ac
SHA512 8f0dd62cefa78236e5f6d74b00e57b7f9067c0a151bf35882d2ca643cd2a62da1ccd4e96ae95107a3ddc1e24d48b807bc058b3de7918395b5498e3e57399cf90
SSDEEP 3072:/KHOHzoPVb7ap03/9KDw2RvvsQDK9oIrFpaU+hV0fdH0TCFnhv6IvxaJVYYPwit:/KwoPVnaa3/UjeN6Ivxowi
TLSH
T160146B4B72E064F5D1768235C8324D55D7B278325A60ABAF0764D31A2E333939E3BF29
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

14800

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\Work\Prog\KeylogMaker_241011_winver\Version3\LicenseUpdate\_BIN\Host.pdb

user32

DefWindowProcW RegisterRawInputDevices AddClipboardFormatListener CreateWindowExW RegisterClassExW wsprintfA TranslateMessage DispatchMessageW GetMessageW LoadStringW

kernel32

SetFilePointerEx GetConsoleMode GetConsoleCP GetStringTypeW SetStdHandle LCMapStringW GetFileSize OutputDebugStringW GetLastError WriteFile CloseHandle CreateFileW MultiByteToWideChar WideCharToMultiByte LoadLibraryExA RaiseException InitializeCriticalSectionEx DeleteCriticalSection LoadResource LockResource SizeofResource FindResourceW FindResourceExW GetModuleHandleW FlushFileBuffers HeapAlloc HeapFree HeapReAlloc HeapSize GetProcessHeap GetWindowsDirectoryA GetCurrentProcessId ProcessIdToSessionId ExitProcess VirtualFree VirtualProtect IsBadReadPtr LoadLibraryA FreeLibrary EnterCriticalSection LeaveCriticalSection SetEvent ResetEvent WaitForSingleObjectEx CreateEventW GetProcAddress QueryPerformanceCounter GetCurrentThreadId GetSystemTimeAsFileTime WriteConsoleW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent GetCurrentProcess TerminateProcess HeapDestroy InitializeSListHead RtlPcToFileHeader EncodePointer GetModuleFileNameW RtlUnwindEx InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW SetLastError GetStdHandle GetModuleHandleExW GetACP GetFileType FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW

advapi32

SystemFunction036

Name

.text

Size

79KB

Virtual Size

79KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

44KB

Virtual Size

44KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.gfids

Size

512B

Virtual Size

220B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

48KB

Virtual Size

48KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Resubmissions

Sharing

General

Malware Config

Signatures

File Explorer

2026-05-06_a5997fbdac86959960455b3fd035e95a_icedid_mespinoza_njrat_ryuk

user32

kernel32

advapi32

generic