2026-06-28_06125433b2312ed8a95d60bc63e7f917_icedid_mespinoza_njrat_ryuk

Sharing

Copy URL Twitter E-mail

General

Target
2026-06-28_06125433b2312ed8a95d60bc63e7f917_icedid_mespinoza_njrat_ryuk
Size 1.5MB
Sample260629-a2edbaax4n
SHA256 ac9c65efb06a27c0be2e451d51af6b8fc993c9cd8c72ec5b0ba93ff12ac4114b
MD5 06125433b2312ed8a95d60bc63e7f917
SHA1 fed23158b56ad5bc80e740d17c4d79ec9c0fa2bf
SHA512 c250428e485f6087f3bca69a5955531b0db9eb87948cdc64b266b86b0096bb3d8e5e418437dcaec4c8579a4bd1c7d35b09242c07334c5828e22e73bf6206e335
SSDEEP 24576:KxFJJ4SFfxy4FJ5L0jy+8/9IRKM9egqAqufH9ttHgim5dk:KxFJhfxuGRPduf9Hlm5C
TLSH
T119655C1BEBF500E4F57AC13599A26129FDB238D54B38A7CB97804A0F5B31BE4AD39701
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-06-28_06125433b2312ed8a95d60bc63e7f917_icedid_mespinoza_njrat_ryuk

File Explorer

2026-06-28_06125433b2312ed8a95d60bc63e7f917_icedid_mespinoza_njrat_ryuk

.exe 1.5MB

2026-06-28_06125433b2312ed8a95d60bc63e7f917_icedid_mespinoza_njrat_ryuk

IMPHASH fa2737ff29b2c325c121a0867390efe4
SHA256 ac9c65efb06a27c0be2e451d51af6b8fc993c9cd8c72ec5b0ba93ff12ac4114b
MD5 06125433b2312ed8a95d60bc63e7f917
SHA1 fed23158b56ad5bc80e740d17c4d79ec9c0fa2bf
SHA512 c250428e485f6087f3bca69a5955531b0db9eb87948cdc64b266b86b0096bb3d8e5e418437dcaec4c8579a4bd1c7d35b09242c07334c5828e22e73bf6206e335
SSDEEP 24576:KxFJJ4SFfxy4FJ5L0jy+8/9IRKM9egqAqufH9ttHgim5dk:KxFJhfxuGRPduf9Hlm5C
TLSH
T119655C1BEBF500E4F57AC13599A26129FDB238D54B38A7CB97804A0F5B31BE4AD39701
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

53040

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\PROG\HotKey\x64\Release\HotkeyService.pdb

kernel32

VerifyVersionInfoW VerSetConditionMask CreateEventW QueueUserWorkItem CreateProcessW FindResourceW LoadResource FindResourceExW LockResource WaitForSingleObject SizeofResource InitializeCriticalSection LeaveCriticalSection EnterCriticalSection CloseHandle GetCurrentThread Sleep LocalAlloc GetModuleFileNameW GetCurrentProcess GetProcessHeap DeleteCriticalSection LocalFree HeapDestroy DecodePointer HeapAlloc RaiseException HeapReAlloc GetLastError HeapSize InitializeCriticalSectionEx SetLastError HeapFree SetEndOfFile SetFilePointerEx CreateFileW ReadConsoleW ReadFile GetConsoleMode GetConsoleCP FlushFileBuffers SetStdHandle SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCPInfo GetOEMCP IsValidCodePage FindFirstFileExW HeapQueryInformation EnumSystemLocalesW IsDebuggerPresent OutputDebugStringW InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemTimeAsFileTime GetModuleHandleW GetProcAddress SetEvent ResetEvent WaitForSingleObjectEx RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent GetStartupInfoW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId InitializeSListHead MultiByteToWideChar WideCharToMultiByte VirtualQuery FreeLibrary CreateDirectoryW DeleteFileW FindClose FindFirstFileW FindNextFileW GetFileAttributesExW GetFullPathNameW GetTempFileNameW ReleaseMutex CreateMutexW GetLocalTime QueryUnbiasedInterruptTime MoveFileW FileTimeToSystemTime OutputDebugStringA RtlPcToFileHeader EncodePointer LoadLibraryExW RtlUnwindEx GetModuleFileNameA GetModuleHandleExW HeapValidate GetSystemInfo ExitProcess GetStdHandle WriteFile GetCommandLineA GetCommandLineW GetACP CreateThread ExitThread FreeLibraryAndExitThread GetFileType WriteConsoleW GetStringTypeW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID

advapi32

RegQueryValueExW RegOpenKeyExW DeregisterEventSource SetServiceStatus RegisterServiceCtrlHandlerW StartServiceW StartServiceCtrlDispatcherW QueryServiceStatusEx RegisterEventSourceW ReportEventW SetSecurityDescriptorDacl CreateServiceW GetAclInformation QueryServiceStatus SetSecurityDescriptorOwner GetAce CloseServiceHandle OpenSCManagerW CreateWellKnownSid CopySid DeleteService ControlService IsValidSid AddAce OpenProcessToken InitializeSecurityDescriptor InitializeAcl OpenServiceW GetLengthSid AddAccessAllowedAce OpenThreadToken SetSecurityDescriptorGroup GetTokenInformation RegCloseKey

ole32

OleRun CoUninitialize CoCreateInstance CoInitializeEx CoInitializeSecurity CLSIDFromProgID

oleaut32

GetErrorInfo SysStringLen VariantClear VariantCopy SysStringByteLen SysAllocStringByteLen VariantInit SysFreeString SysAllocString

wlanapi

WlanOpenHandle WlanQueryInterface WlanEnumInterfaces WlanCloseHandle WlanFreeMemory WlanRegisterNotification WlanSetInterface

shell32

SHCreateDirectoryExW SHGetFolderPathW

shlwapi

StrRChrW

version

GetFileVersionInfoSizeW VerQueryValueW GetFileVersionInfoW

Name

.text

Size

625KB

Virtual Size

625KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

259KB

Virtual Size

258KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

7KB

Virtual Size

23KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

39KB

Virtual Size

38KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.gfids

Size

1024B

Virtual Size

528B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

572KB

Virtual Size

576KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-06-28_06125433b2312ed8a95d60bc63e7f917_icedid_mespinoza_njrat_ryuk

kernel32

advapi32

ole32

oleaut32

wlanapi

shell32

shlwapi

version

generic