2026-05-06_df5d1c1365f111a858b6bada2efe6bbf_icedid_mespinoza_njrat_ryuk_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-05-06_df5d1c1365f111a858b6bada2efe6bbf_icedid_mespinoza_njrat_ryuk_vidar
Size 1.9MB
Sample260506-vrld4abs7k
SHA256 f9847c65d8d8c63d5c16a2fe93c0637a0c01e242313f5962034ca545a1a5a4ef
MD5 df5d1c1365f111a858b6bada2efe6bbf
SHA1 df57784fc31f6da905750f5845f80465723b72c8
SHA512 d06aa7bcdf3f27c91d3a0058c361f622c6c098dd289a74d65c22635a44d83b9a260f31c313d384d1282711b27aaeec608936b59003e953b5d49dd18d5c1d0365
SSDEEP 24576:RYRM7Y2cb+cREAYz7KEMdX6keYnAcerh:C+LcnRpYPKEnSG
TLSH
T15295E01BE26514F9E067C279CB528801EAB17C450B25AAEF2354D3361F77AE44F3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-05-06_df5d1c1365f111a858b6bada2efe6bbf_icedid_mespinoza_njrat_ryuk_vidar

File Explorer

2026-05-06_df5d1c1365f111a858b6bada2efe6bbf_icedid_mespinoza_njrat_ryuk_vidar

.exe 1.9MB

2026-05-06_df5d1c1365f111a858b6bada2efe6bbf_icedid_mespinoza_njrat_ryuk_vidar

IMPHASH 6a8bffcb635443fadba2b7b98db52eda
SHA256 f9847c65d8d8c63d5c16a2fe93c0637a0c01e242313f5962034ca545a1a5a4ef
MD5 df5d1c1365f111a858b6bada2efe6bbf
SHA1 df57784fc31f6da905750f5845f80465723b72c8
SHA512 d06aa7bcdf3f27c91d3a0058c361f622c6c098dd289a74d65c22635a44d83b9a260f31c313d384d1282711b27aaeec608936b59003e953b5d49dd18d5c1d0365
SSDEEP 24576:RYRM7Y2cb+cREAYz7KEMdX6keYnAcerh:C+LcnRpYPKEnSG
TLSH
T15295E01BE26514F9E067C279CB528801EAB17C450B25AAEF2354D3361F77AE44F3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

188048

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

elevation_service.exe.pdb

advapi32

AddAce CopySid GetAclInformation GetLengthSid GetSecurityDescriptorControl GetSecurityDescriptorDacl GetSecurityDescriptorGroup GetSecurityDescriptorOwner GetSecurityDescriptorSacl GetSidLengthRequired GetSidSubAuthority InitializeAcl InitializeSecurityDescriptor InitializeSid IsValidSid MakeAbsoluteSD RegisterServiceCtrlHandlerW SetSecurityDescriptorDacl SetSecurityDescriptorGroup SetSecurityDescriptorOwner SetServiceStatus StartServiceCtrlDispatcherW

kernel32

AcquireSRWLockExclusive CloseHandle CreateEventW CreateFileW DecodePointer DeleteCriticalSection DeleteFileW EncodePointer EnterCriticalSection EnumSystemLocalesW ExitProcess FindClose FindFirstFileExW FindNextFileW FlushFileBuffers FormatMessageA FreeEnvironmentStringsW FreeLibrary GetACP GetCPInfo GetCommandLineA GetCommandLineW GetConsoleCP GetConsoleMode GetCurrentDirectoryW GetCurrentProcess GetCurrentProcessId GetCurrentThreadId GetEnvironmentStringsW GetEnvironmentVariableW GetFileType GetLastError GetLocalTime GetLocaleInfoW GetModuleFileNameW GetModuleHandleExW GetModuleHandleW GetNativeSystemInfo GetOEMCP GetProcAddress GetProcessHeap GetStartupInfoW GetStdHandle GetStringTypeW GetSystemInfo GetSystemTimeAsFileTime GetTickCount GetUserDefaultLCID HeapAlloc HeapCreate HeapDestroy HeapFree HeapReAlloc HeapSetInformation HeapSize InitializeCriticalSectionAndSpinCount InitializeSListHead IsDebuggerPresent IsProcessorFeaturePresent IsValidCodePage IsValidLocale LCMapStringW LeaveCriticalSection LoadLibraryExA LoadLibraryExW LocalFree MultiByteToWideChar OutputDebugStringA OutputDebugStringW QueryPerformanceCounter QueryPerformanceFrequency RaiseException ReadConsoleW ReadFile ReleaseSRWLockExclusive ResetEvent RtlCaptureContext RtlCaptureStackBackTrace RtlLookupFunctionEntry RtlPcToFileHeader RtlUnwindEx RtlVirtualUnwind SetEvent SetFilePointerEx SetLastError SetStdHandle SetUnhandledExceptionFilter Sleep SwitchToThread TerminateProcess TlsAlloc TlsFree TlsGetValue TlsSetValue TryAcquireSRWLockExclusive UnhandledExceptionFilter VirtualProtect VirtualQuery WaitForSingleObject WaitForSingleObjectEx WideCharToMultiByte WriteConsoleW WriteFile

ole32

CoAddRefServerProcess CoInitializeEx CoInitializeSecurity CoRegisterClassObject CoReleaseServerProcess CoResumeClassObjects CoRevokeClassObject CoUninitialize

shell32

CommandLineToArgvW

winmm

timeGetTime

Name

.text

Size

299KB

Virtual Size

299KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

99KB

Virtual Size

99KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

19KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

14KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.00cfg

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

1.5MB

Virtual Size

1.5MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-05-06_df5d1c1365f111a858b6bada2efe6bbf_icedid_mespinoza_njrat_ryuk_vidar

advapi32

kernel32

ole32

shell32

winmm

generic