2026-07-05_4d490e94e3ee5ead209c7623d2951a5c_icedid_mespinoza_njrat_ryuk

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-05_4d490e94e3ee5ead209c7623d2951a5c_icedid_mespinoza_njrat_ryuk
Size 1.4MB
Sample260705-edjekscy8q
SHA256 72bb7183002d3a95f4090c66d3df9f92523c32e59a71b86294318886c050112d
MD5 4d490e94e3ee5ead209c7623d2951a5c
SHA1 257c25345355812c0b155482e19341dd99abcf2b
SHA512 95bd73c0960601e640b70def89eda7f2ce8bc1e5a62239d9ce5a952736746fd08b27164b89609cbdfe258f7c6bf82ef8d8f6d98697508e1dad3690fe55e89e75
SSDEEP 24576:xbHndlrk6sqjnhMgeiCl7G0nehbGZpbD:1dlr/Dmg27RnWGj
TLSH
T16365125A73A810F9D5778238CA50D51AFB337C6607209B4F13B546B69F23650EE3EB22
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-05_4d490e94e3ee5ead209c7623d2951a5c_icedid_mespinoza_njrat_ryuk

File Explorer

2026-07-05_4d490e94e3ee5ead209c7623d2951a5c_icedid_mespinoza_njrat_ryuk

.exe 1.4MB

2026-07-05_4d490e94e3ee5ead209c7623d2951a5c_icedid_mespinoza_njrat_ryuk

IMPHASH c79de8d089fca62c793d3b171fa20506
SHA256 72bb7183002d3a95f4090c66d3df9f92523c32e59a71b86294318886c050112d
MD5 4d490e94e3ee5ead209c7623d2951a5c
SHA1 257c25345355812c0b155482e19341dd99abcf2b
SHA512 95bd73c0960601e640b70def89eda7f2ce8bc1e5a62239d9ce5a952736746fd08b27164b89609cbdfe258f7c6bf82ef8d8f6d98697508e1dad3690fe55e89e75
SSDEEP 24576:xbHndlrk6sqjnhMgeiCl7G0nehbGZpbD:1dlr/Dmg27RnWGj
TLSH
T16365125A73A810F9D5778238CA50D51AFB337C6607209B4F13B546B69F23650EE3EB22
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

24744

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

z:\build\build\src\obj-firefox\toolkit\components\maintenanceservice\maintenanceservice.pdb

kernel32

WriteConsoleW HeapSize HeapReAlloc GetDriveTypeW Process32FirstW Process32NextW CreateToolhelp32Snapshot WriteFile MoveFileW GetTempFileNameW GetFullPathNameW GetProcAddress GetCurrentProcess GetExitCodeProcess LoadLibraryExW FreeLibrary TerminateProcess CopyFileW DeleteFileW MultiByteToWideChar GetFileAttributesW LocalAlloc SetLastError CreateProcessW GetFileSize LocalFree CreateFileW ReadFile lstrcmpiW MoveFileExW CreateThread CloseHandle SetEvent GetLastError Sleep CreateEventW WaitForSingleObject GetModuleFileNameW CreateDirectoryW GetProcessHeap SetEndOfFile SetStdHandle FreeEnvironmentStringsW GetEnvironmentStringsW GetCPInfo GetOEMCP IsValidCodePage FindNextFileW FindFirstFileExW FindClose GetConsoleCP FlushFileBuffers ReadConsoleW GetConsoleMode SetFilePointerEx GetStringTypeW EnterCriticalSection LeaveCriticalSection DeleteCriticalSection ResetEvent WaitForSingleObjectEx GetModuleHandleW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent RtlUnwindEx InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree RtlPcToFileHeader RaiseException ExitProcess GetModuleHandleExW WideCharToMultiByte GetFileAttributesExW GetStdHandle GetCommandLineA GetCommandLineW GetACP HeapFree HeapAlloc GetFileType CompareStringW LCMapStringW SetEnvironmentVariableA SetEnvironmentVariableW

user32

LoadStringA wsprintfW

advapi32

LookupAccountSidW RegOpenKeyExW QueryServiceConfigW ChangeServiceConfigW OpenServiceW QueryServiceObjectSecurity SetServiceStatus RegisterServiceCtrlHandlerW OpenSCManagerA QueryServiceStatusEx AdjustTokenPrivileges LookupPrivilegeValueA OpenProcessToken RegQueryInfoKeyW RegEnumKeyExW RegQueryValueExW CryptAcquireContextA CryptCreateHash CryptHashData CryptDestroyHash CryptGetHashParam CryptReleaseContext SetSecurityDescriptorDacl GetSecurityDescriptorDacl CreateServiceW RegCloseKey QueryServiceStatus CloseServiceHandle OpenSCManagerW BuildExplicitAccessWithNameW ChangeServiceConfig2W SetEntriesInAclW CreateWellKnownSid DeleteService SetServiceObjectSecurity ControlService RegSetValueExW FreeSid StartServiceCtrlDispatcherW InitializeSecurityDescriptor

crypt32

CertFreeCertificateContext CryptQueryObject CertCloseStore CryptMsgGetParam CertFindCertificateInStore CertGetNameStringW CertGetNameStringA CryptMsgClose

wintrust

WinVerifyTrust

version

VerQueryValueW GetFileVersionInfoW GetFileVersionInfoSizeW

shlwapi

PathRemoveFileSpecW PathQuoteSpacesW PathAppendW PathIsUNCServerShareW PathCanonicalizeW PathStripToRootW PathUnquoteSpacesW

ole32

CoCreateGuid

rpcrt4

RpcStringFreeW UuidToStringW

Name

.text

Size

111KB

Virtual Size

110KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

56KB

Virtual Size

55KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.gfids

Size

512B

Virtual Size

196B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

1.2MB

Virtual Size

1.8MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-05_4d490e94e3ee5ead209c7623d2951a5c_icedid_mespinoza_njrat_ryuk

kernel32

user32

advapi32

crypt32

wintrust

version

shlwapi

ole32

rpcrt4

generic