2026-06-28_f1db7a9b558988f3fe877d60df7178b8_icedid_mespinoza_njrat_ryuk_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-06-28_f1db7a9b558988f3fe877d60df7178b8_icedid_mespinoza_njrat_ryuk_vidar
Size 1.7MB
Sample260628-wl9eeabs6m
SHA256 d28d05988b1fa99b0c44584973ed8fe868d091330ba5be7c4912a47d0903426d
MD5 f1db7a9b558988f3fe877d60df7178b8
SHA1 f36944525e8abeac1457e6e5db6addaf63f23f80
SHA512 51fd836ae8b8a09c878fd596f5dc27421c0548a231007af299a3bb5be95968b4dafae1b26945e0b97d012e4c0d172028afdda9c245feeca8f63c109ed71ee426
SSDEEP 24576:/YRr7Y2cb+cREvk2Yk5bKdAubhSu+PVx:wlLcnRePYkxKdvbqV
TLSH
T17385D01BE2A510FDD17BC2788B529801E9B17C450B61AAEF2354D3761F36AE45F3EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-06-28_f1db7a9b558988f3fe877d60df7178b8_icedid_mespinoza_njrat_ryuk_vidar

File Explorer

2026-06-28_f1db7a9b558988f3fe877d60df7178b8_icedid_mespinoza_njrat_ryuk_vidar

.exe 1.7MB

2026-06-28_f1db7a9b558988f3fe877d60df7178b8_icedid_mespinoza_njrat_ryuk_vidar

IMPHASH 6a8bffcb635443fadba2b7b98db52eda
SHA256 d28d05988b1fa99b0c44584973ed8fe868d091330ba5be7c4912a47d0903426d
MD5 f1db7a9b558988f3fe877d60df7178b8
SHA1 f36944525e8abeac1457e6e5db6addaf63f23f80
SHA512 51fd836ae8b8a09c878fd596f5dc27421c0548a231007af299a3bb5be95968b4dafae1b26945e0b97d012e4c0d172028afdda9c245feeca8f63c109ed71ee426
SSDEEP 24576:/YRr7Y2cb+cREvk2Yk5bKdAubhSu+PVx:wlLcnRePYkxKdvbqV
TLSH
T17385D01BE2A510FDD17BC2788B529801E9B17C450B61AAEF2354D3761F36AE45F3EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

188048

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

elevation_service.exe.pdb

advapi32

AddAce CopySid GetAclInformation GetLengthSid GetSecurityDescriptorControl GetSecurityDescriptorDacl GetSecurityDescriptorGroup GetSecurityDescriptorOwner GetSecurityDescriptorSacl GetSidLengthRequired GetSidSubAuthority InitializeAcl InitializeSecurityDescriptor InitializeSid IsValidSid MakeAbsoluteSD RegisterServiceCtrlHandlerW SetSecurityDescriptorDacl SetSecurityDescriptorGroup SetSecurityDescriptorOwner SetServiceStatus StartServiceCtrlDispatcherW

kernel32

AcquireSRWLockExclusive CloseHandle CreateEventW CreateFileW DecodePointer DeleteCriticalSection DeleteFileW EncodePointer EnterCriticalSection EnumSystemLocalesW ExitProcess FindClose FindFirstFileExW FindNextFileW FlushFileBuffers FormatMessageA FreeEnvironmentStringsW FreeLibrary GetACP GetCPInfo GetCommandLineA GetCommandLineW GetConsoleCP GetConsoleMode GetCurrentDirectoryW GetCurrentProcess GetCurrentProcessId GetCurrentThreadId GetEnvironmentStringsW GetEnvironmentVariableW GetFileType GetLastError GetLocalTime GetLocaleInfoW GetModuleFileNameW GetModuleHandleExW GetModuleHandleW GetNativeSystemInfo GetOEMCP GetProcAddress GetProcessHeap GetStartupInfoW GetStdHandle GetStringTypeW GetSystemInfo GetSystemTimeAsFileTime GetTickCount GetUserDefaultLCID HeapAlloc HeapCreate HeapDestroy HeapFree HeapReAlloc HeapSetInformation HeapSize InitializeCriticalSectionAndSpinCount InitializeSListHead IsDebuggerPresent IsProcessorFeaturePresent IsValidCodePage IsValidLocale LCMapStringW LeaveCriticalSection LoadLibraryExA LoadLibraryExW LocalFree MultiByteToWideChar OutputDebugStringA OutputDebugStringW QueryPerformanceCounter QueryPerformanceFrequency RaiseException ReadConsoleW ReadFile ReleaseSRWLockExclusive ResetEvent RtlCaptureContext RtlCaptureStackBackTrace RtlLookupFunctionEntry RtlPcToFileHeader RtlUnwindEx RtlVirtualUnwind SetEvent SetFilePointerEx SetLastError SetStdHandle SetUnhandledExceptionFilter Sleep SwitchToThread TerminateProcess TlsAlloc TlsFree TlsGetValue TlsSetValue TryAcquireSRWLockExclusive UnhandledExceptionFilter VirtualProtect VirtualQuery WaitForSingleObject WaitForSingleObjectEx WideCharToMultiByte WriteConsoleW WriteFile

ole32

CoAddRefServerProcess CoInitializeEx CoInitializeSecurity CoRegisterClassObject CoReleaseServerProcess CoResumeClassObjects CoRevokeClassObject CoUninitialize

shell32

CommandLineToArgvW

winmm

timeGetTime

Name

.text

Size

299KB

Virtual Size

299KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

99KB

Virtual Size

99KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

19KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

14KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.00cfg

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

1.3MB

Virtual Size

1.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-06-28_f1db7a9b558988f3fe877d60df7178b8_icedid_mespinoza_njrat_ryuk_vidar

advapi32

kernel32

ole32

shell32

winmm

generic