2026-07-01_7287eab3a493b8d311362676c8e3581e_icedid_mespinoza_njrat_ryuk

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-01_7287eab3a493b8d311362676c8e3581e_icedid_mespinoza_njrat_ryuk
Size 1.6MB
Sample260701-vj2fcaay3q
SHA256 6473e0a05dc9f98efa13177fa7530d2f2acdd37950cd0d9a146866309ad49e87
MD5 7287eab3a493b8d311362676c8e3581e
SHA1 7dfcd7b5597676aaef94155f2a953945d85859ce
SHA512 15029cdc012267caca008bc2d10a668da2a776718bfecac6dcac40ec8779c9025366c33a61b5aaab4148b99b8c601dc8431221c2669595927356697528930422
SSDEEP 24576:Il89dfwgQxVirnlBUKZ408vTZrX+lgdW:pLqiLlBUKubZrX+ld
TLSH
T12D85BE85A2D508E9E9E6817AA9634531F7E23CDB3B25D78F43E033091E372D0DD3A661
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-01_7287eab3a493b8d311362676c8e3581e_icedid_mespinoza_njrat_ryuk

File Explorer

2026-07-01_7287eab3a493b8d311362676c8e3581e_icedid_mespinoza_njrat_ryuk

.exe 1.6MB

2026-07-01_7287eab3a493b8d311362676c8e3581e_icedid_mespinoza_njrat_ryuk

IMPHASH 882cb250e38fd3b0809ee7221a18ba98
SHA256 6473e0a05dc9f98efa13177fa7530d2f2acdd37950cd0d9a146866309ad49e87
MD5 7287eab3a493b8d311362676c8e3581e
SHA1 7dfcd7b5597676aaef94155f2a953945d85859ce
SHA512 15029cdc012267caca008bc2d10a668da2a776718bfecac6dcac40ec8779c9025366c33a61b5aaab4148b99b8c601dc8431221c2669595927356697528930422
SSDEEP 24576:Il89dfwgQxVirnlBUKZ408vTZrX+lgdW:pLqiLlBUKubZrX+ld
TLSH
T12D85BE85A2D508E9E9E6817AA9634531F7E23CDB3B25D78F43E033091E372D0DD3A661
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

77184

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\KYD100_SourceCode\quick-access-v3_3038\Bin\Release\QASvc.pdb

kernel32

ConnectNamedPipe DisconnectNamedPipe ReadFile SetFilePointerEx GetConsoleMode GetConsoleCP CreateFileW FindResourceExW FindResourceW SizeofResource LockResource LoadResource GetEnvironmentVariableW InitializeCriticalSection WideCharToMultiByte GetModuleFileNameW QueueUserWorkItem Sleep CreateEventW FlushFileBuffers OpenProcess Process32NextW ProcessIdToSessionId Process32FirstW CreateToolhelp32Snapshot WTSGetActiveConsoleSessionId WaitForSingleObject SetEvent CreateThread CloseHandle GetProcessHeap HeapSize HeapReAlloc HeapFree HeapAlloc HeapDestroy DecodePointer InitializeCriticalSectionEx RaiseException GetLastError LeaveCriticalSection EnterCriticalSection WriteFile DeleteCriticalSection SetEndOfFile WriteConsoleW ReadConsoleW SetStdHandle EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetTimeFormatW GetDateFormatW GetFileType GetACP GetCommandLineW SetEnvironmentVariableW GetCommandLineA SetEnvironmentVariableA FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP IsValidCodePage FindNextFileW FindFirstFileExW FindClose SetNamedPipeHandleState WaitNamedPipeW CreateNamedPipeW MultiByteToWideChar GetStringTypeW EncodePointer SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemTimeAsFileTime GetModuleHandleW GetProcAddress CompareStringW LCMapStringW GetLocaleInfoW GetCPInfo ResetEvent WaitForSingleObjectEx RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId InitializeSListHead LocalFree OutputDebugStringW RtlPcToFileHeader RtlUnwindEx FreeLibrary LoadLibraryExW GetTimeZoneInformation ExitProcess GetModuleHandleExW GetStdHandle

user32

wsprintfW

advapi32

ConvertStringSecurityDescriptorToSecurityDescriptorW RegDeleteTreeW RegDeleteKeyValueW GetUserNameW DeleteService QueryServiceStatus ControlService OpenServiceW ChangeServiceConfig2W CloseServiceHandle CreateServiceW OpenSCManagerW ProcessTrace OpenTraceW EnableTraceEx StartTraceW ControlTraceW CloseTrace RegCreateKeyW OpenProcessToken CreateProcessAsUserW GetLengthSid SetTokenInformation AllocateAndInitializeSid DuplicateTokenEx RegGetValueW RegSetKeyValueW RegCloseKey RegCreateKeyExW RegOpenKeyExW DeregisterEventSource ReportEventW RegisterEventSourceW SetServiceStatus RegisterServiceCtrlHandlerExW StartServiceCtrlDispatcherW InitializeSecurityDescriptor

shell32

SHGetFolderPathW

ole32

CoCreateInstance CoSetProxyBlanket CoUninitialize CoInitializeEx

oleaut32

VariantClear VariantChangeType VariantInit VariantCopy

imagehlp

MakeSureDirectoryPathExists

shlwapi

PathRemoveFileSpecW

powrprof

IsPwrSuspendAllowed

tdh

TdhGetEventInformation

userenv

CreateEnvironmentBlock DestroyEnvironmentBlock

wtsapi32

WTSQueryUserToken

Name

.text

Size

212KB

Virtual Size

212KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

103KB

Virtual Size

103KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

11KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.gfids

Size

512B

Virtual Size

492B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

146KB

Virtual Size

145KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

1.2MB

Virtual Size

1.8MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-01_7287eab3a493b8d311362676c8e3581e_icedid_mespinoza_njrat_ryuk

kernel32

user32

advapi32

shell32

ole32

oleaut32

imagehlp

shlwapi

powrprof

tdh

userenv

wtsapi32

generic