2026-06-30_a8a81589112301d64080ab3299f15f94_icedid_mespinoza_njrat_ryuk

Sharing

Copy URL Twitter E-mail

General

Target
2026-06-30_a8a81589112301d64080ab3299f15f94_icedid_mespinoza_njrat_ryuk
Size 2.9MB
Sample260701-dzmtfsft61
SHA256 1d880c8d5f986f3bebf5edb135c571541ff2b5f18c432d641dd01381baf4f8ea
MD5 a8a81589112301d64080ab3299f15f94
SHA1 41d382a6d97816f4da4235f3f63be0f6e37c4f4c
SHA512 eaf4f577022056e536f16bdf607f6dc8b393d63197ad1632f81e092fbe48ea3102c41acf8026e0679e7ead9ccf2e94eca25730535ce0fdb74035027559271afe
SSDEEP 24576:LY8ZBXmlYEelw46j+dYPq0vA5yQe7+yMElJgXG7QVGfLNLgcdPAJTq4+Ys7Uv+aK:LYL58wnQcNccdYGt7Uv+MnIIC
TLSH
T1ECE5D00ABB9881F9D0B7C13AC9958597F7F2B8136A31978F52A1432E2F3B5614D2F311
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-06-30_a8a81589112301d64080ab3299f15f94_icedid_mespinoza_njrat_ryuk

File Explorer

2026-06-30_a8a81589112301d64080ab3299f15f94_icedid_mespinoza_njrat_ryuk

.exe 2.9MB

2026-06-30_a8a81589112301d64080ab3299f15f94_icedid_mespinoza_njrat_ryuk

IMPHASH 75925de8e349c9ff3bc8a4dd9ad2d5e2
SHA256 1d880c8d5f986f3bebf5edb135c571541ff2b5f18c432d641dd01381baf4f8ea
MD5 a8a81589112301d64080ab3299f15f94
SHA1 41d382a6d97816f4da4235f3f63be0f6e37c4f4c
SHA512 eaf4f577022056e536f16bdf607f6dc8b393d63197ad1632f81e092fbe48ea3102c41acf8026e0679e7ead9ccf2e94eca25730535ce0fdb74035027559271afe
SSDEEP 24576:LY8ZBXmlYEelw46j+dYPq0vA5yQe7+yMElJgXG7QVGfLNLgcdPAJTq4+Ys7Uv+aK:LYL58wnQcNccdYGt7Uv+MnIIC
TLSH
T1ECE5D00ABB9881F9D0B7C13AC9958597F7F2B8136A31978F52A1432E2F3B5614D2F311
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

291204

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

G:\jekins_work\workspace\mtz_zip_build_all\product\win32\dbginfo\wpdata64.pdb

shlwapi

PathRemoveFileSpecW PathAppendW PathAddBackslashW PathFileExistsW

kernel32

RaiseException HeapAlloc DecodePointer HeapDestroy GetProcAddress DeleteCriticalSection GetProcessHeap GetModuleHandleW ReadFile SizeofResource CreateFileW MultiByteToWideChar LockResource CloseHandle FindResourceExW LoadResource FindResourceW GetFileSize WideCharToMultiByte LoadLibraryW FreeLibrary WriteFile SetFilePointer LocalAlloc LocalFree FlushFileBuffers Sleep CreateDirectoryW SetEndOfFile GetFileAttributesW GetModuleFileNameW HeapReAlloc FindClose DeleteFileW GetSystemInfo GetCommandLineW WaitForSingleObject CreateEventW SetEvent CreateToolhelp32Snapshot Process32NextW Process32FirstW Module32FirstW Module32NextW WriteProcessMemory GetEnvironmentVariableW GetModuleHandleA OpenProcess ProcessIdToSessionId VirtualAllocEx CreateRemoteThread VirtualFreeEx GetEnvironmentStringsW GetOEMCP GetLastError HeapSize GetSystemDirectoryW GetVersionExW InitializeCriticalSectionAndSpinCount HeapFree FreeEnvironmentStringsW SetEnvironmentVariableA SetStdHandle WriteConsoleW GetConsoleCP CompareStringW GetFileType ReadConsoleW GetConsoleMode GetACP GetCommandLineA GetStdHandle GetModuleFileNameA IsValidCodePage FindNextFileA FindFirstFileExA GetTimeZoneInformation GetModuleHandleExW ExitProcess LoadLibraryExW RtlUnwindEx EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetTimeFormatW IsDebuggerPresent OutputDebugStringW EnterCriticalSection LeaveCriticalSection GetStringTypeW EncodePointer SetLastError TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemTimeAsFileTime LCMapStringW GetLocaleInfoW GetCPInfo ResetEvent WaitForSingleObjectEx RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent GetStartupInfoW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId InitializeSListHead SetFilePointerEx DeviceIoControl AreFileApisANSI FormatMessageA RtlPcToFileHeader GetDateFormatW

advapi32

ImpersonateLoggedOnUser RevertToSelf OpenProcessToken RegEnumKeyExW RegSetValueExW RegOpenKeyExW RegCloseKey RegCreateKeyExW RegQueryValueExW

shell32

ShellExecuteW SHChangeNotify SHGetFileInfoW CommandLineToArgvW ShellExecuteExW

ole32

CoInitialize CoCreateInstance CoUninitialize

oleaut32

VariantCopy SysAllocStringLen VariantClear SysAllocString

version

VerQueryValueW GetFileVersionInfoSizeW GetFileVersionInfoW

Name

.text

Size

478KB

Virtual Size

478KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

176KB

Virtual Size

175KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

13KB

Virtual Size

19KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

22KB

Virtual Size

21KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.gfids

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2.2MB

Virtual Size

2.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-06-30_a8a81589112301d64080ab3299f15f94_icedid_mespinoza_njrat_ryuk

shlwapi

kernel32

advapi32

shell32

ole32

oleaut32

version

generic