2026-06-01_e4dab63ebf0619e5a3642cc913c5effa_icedid_mespinoza_njrat_ryuk

Sharing

Copy URL Twitter E-mail

General

Target
2026-06-01_e4dab63ebf0619e5a3642cc913c5effa_icedid_mespinoza_njrat_ryuk
Size 1.3MB
Sample260601-redlyaez4s
SHA256 ac93ec0001f343887d13b75529f5bc432a0433cf86c8dacd2ba7ff194131a046
MD5 e4dab63ebf0619e5a3642cc913c5effa
SHA1 f5d24b4c9cac88190206b497885e4a684105ba13
SHA512 267117d7cda752032b43984554eeec7fef9ba9b427872280972c85c9bee1396fa3a1132374ad395bb389c1b52d1934310bbc96359ba101f4be8c80dc6af53c66
SSDEEP 24576:kTUeMkjw36RcO87p3E4Tcc7sqjnhMgeiCl7G0nehbGZpbD:kTBjLcndEeVDmg27RnWGj
TLSH
T1F855CF167BA414E4E067C53AC9A2D115F772B8125B318BDF02A1876F2F37AE44E3E721
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-06-01_e4dab63ebf0619e5a3642cc913c5effa_icedid_mespinoza_njrat_ryuk

File Explorer

2026-06-01_e4dab63ebf0619e5a3642cc913c5effa_icedid_mespinoza_njrat_ryuk

.exe 1.3MB

2026-06-01_e4dab63ebf0619e5a3642cc913c5effa_icedid_mespinoza_njrat_ryuk

IMPHASH 9ea148a746773cb698a3bdfe49b999ff
SHA256 ac93ec0001f343887d13b75529f5bc432a0433cf86c8dacd2ba7ff194131a046
MD5 e4dab63ebf0619e5a3642cc913c5effa
SHA1 f5d24b4c9cac88190206b497885e4a684105ba13
SHA512 267117d7cda752032b43984554eeec7fef9ba9b427872280972c85c9bee1396fa3a1132374ad395bb389c1b52d1934310bbc96359ba101f4be8c80dc6af53c66
SSDEEP 24576:kTUeMkjw36RcO87p3E4Tcc7sqjnhMgeiCl7G0nehbGZpbD:kTBjLcndEeVDmg27RnWGj
TLSH
T1F855CF167BA414E4E067C53AC9A2D115F772B8125B318BDF02A1876F2F37AE44E3E721
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

284904

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

E:\B\T\599c64a7-c7d0-462e-94fa-04b0466e41cc\UBF_1\build\x64\Release\McUICnt.pdb

kernel32

HeapFree GetModuleFileNameW InitializeCriticalSection InitializeCriticalSectionEx HeapSize MultiByteToWideChar Sleep GetLastError HeapReAlloc RaiseException LoadLibraryW HeapAlloc DecodePointer HeapDestroy GetProcAddress DeleteCriticalSection GetProcessHeap GetModuleHandleW FreeLibrary WideCharToMultiByte VirtualQuery CreateFileW GetFileSize CloseHandle ReadFile GlobalAlloc GlobalLock GlobalUnlock GlobalFree EnterCriticalSection LeaveCriticalSection GetCurrentProcessId GetCommandLineW CreateProcessW WaitForSingleObject SetEvent GlobalDeleteAtom SizeofResource LockResource LoadResource FindResourceW FindResourceExW LocalFree CreateEventW OpenEventW SetLastError CreateThread LocalAlloc GlobalAddAtomW GlobalGetAtomNameW GetCurrentThreadId InitializeCriticalSectionAndSpinCount FindClose FindFirstFileW RemoveDirectoryW ReleaseMutex WriteFile SetFilePointer OutputDebugStringW GetFileAttributesW CreateMutexW GetLocalTime GetModuleHandleExW VerSetConditionMask GetCurrentProcess VerifyVersionInfoW LoadLibraryExW FormatMessageW GetCurrentDirectoryW CreateDirectoryW FindNextFileW WritePrivateProfileStructW WritePrivateProfileStringW lstrlenW GetEnvironmentVariableW QueryFullProcessImageNameW InitializeSRWLock ReleaseSRWLockExclusive ReleaseSRWLockShared AcquireSRWLockExclusive AcquireSRWLockShared OpenProcess GetWindowsDirectoryW GlobalFindAtomW SystemTimeToFileTime CreateToolhelp32Snapshot Process32FirstW Process32NextW GetFullPathNameW LockFileEx UnlockFileEx CopyFileW MoveFileW MoveFileExW ReplaceFileW DeleteFileA SetFileAttributesA GetTempPathA GetTempFileNameA GetSystemInfo VirtualProtect LoadLibraryExA IsDebuggerPresent GetStringTypeW RtlPcToFileHeader EncodePointer TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemTimeAsFileTime LCMapStringW GetLocaleInfoW GetCPInfo ResetEvent WaitForSingleObjectEx RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent GetStartupInfoW QueryPerformanceCounter InitializeSListHead RtlUnwindEx VirtualAlloc GetFileType SetFilePointerEx GetConsoleMode ReadConsoleW GetConsoleCP ExitProcess GetStdHandle GetACP IsValidLocale GetUserDefaultLCID EnumSystemLocalesW SetStdHandle FlushFileBuffers WriteConsoleW SetEndOfFile FindFirstFileExW IsValidCodePage GetOEMCP GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW

Name

.text

Size

444KB

Virtual Size

444KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

194KB

Virtual Size

194KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

15KB

Virtual Size

23KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

24KB

Virtual Size

24KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.gfids

Size

1024B

Virtual Size

532B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

44KB

Virtual Size

43KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

572KB

Virtual Size

576KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-06-01_e4dab63ebf0619e5a3642cc913c5effa_icedid_mespinoza_njrat_ryuk

kernel32

generic