2026-07-20_f491f9cda1a5f2f965d9d9cd3aa6d966_icedid_mespinoza_njrat_ryuk

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-20_f491f9cda1a5f2f965d9d9cd3aa6d966_icedid_mespinoza_njrat_ryuk
Size 1.3MB
Sample260720-t8h5maas21
SHA256 409ea71b207dcac3429aa09bde653728bf498050f521b82889792fbd002343d8
MD5 f491f9cda1a5f2f965d9d9cd3aa6d966
SHA1 d1714cdc5d8454fd47bd186b1dfcb41cb01066ea
SHA512 f910938dae3dba3927f7c665933784abd6de384be67b61a3574085e1d4007918eb37b0d9456888b4160cec0a977cd2106b3c666c7825d3bd390de0fb156c2a15
SSDEEP 12288:i4CDkAZHTHJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:tCZxTHdCN/j2GLl3iFSE33b9
TLSH
T1DE55F156B6A4A0F5E13B82388A664741E772FC604B209BCF436403BE9F777D0AD39761
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-20_f491f9cda1a5f2f965d9d9cd3aa6d966_icedid_mespinoza_njrat_ryuk

File Explorer

2026-07-20_f491f9cda1a5f2f965d9d9cd3aa6d966_icedid_mespinoza_njrat_ryuk

.exe 1.3MB

2026-07-20_f491f9cda1a5f2f965d9d9cd3aa6d966_icedid_mespinoza_njrat_ryuk

IMPHASH d369790441941e463947a64e80977d90
SHA256 409ea71b207dcac3429aa09bde653728bf498050f521b82889792fbd002343d8
MD5 f491f9cda1a5f2f965d9d9cd3aa6d966
SHA1 d1714cdc5d8454fd47bd186b1dfcb41cb01066ea
SHA512 f910938dae3dba3927f7c665933784abd6de384be67b61a3574085e1d4007918eb37b0d9456888b4160cec0a977cd2106b3c666c7825d3bd390de0fb156c2a15
SSDEEP 12288:i4CDkAZHTHJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:tCZxTHdCN/j2GLl3iFSE33b9
TLSH
T1DE55F156B6A4A0F5E13B82388A664741E772FC604B209BCF436403BE9F777D0AD39761
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

39952

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

c:\DAX3\API\output\Release\x64\DAX3API.pdb

kernel32

lstrcpyW MultiByteToWideChar WriteConsoleW SetFilePointerEx GetConsoleMode lstrcmpiW FlushFileBuffers GetStringTypeW SetStdHandle GetProcessHeap FindResourceW SizeofResource LoadResource LoadLibraryExW GetProcAddress GetModuleHandleW GetModuleFileNameW FreeLibrary GetCurrentThreadId CreateThread Sleep CreateEventW WaitForSingleObject SetEvent DeleteCriticalSection InitializeCriticalSectionEx LeaveCriticalSection EnterCriticalSection GetLastError RaiseException CloseHandle DecodePointer GetConsoleCP GetCommandLineW LCMapStringW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetCPInfo GetOEMCP IsValidCodePage FindNextFileW CreateFileW FindFirstFileExW FindClose GetFileType IsDebuggerPresent OutputDebugStringW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent ResetEvent WaitForSingleObjectEx GetStartupInfoW QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime InitializeSListHead RtlPcToFileHeader EncodePointer RtlUnwindEx InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree SetLastError ExitProcess GetModuleHandleExW WideCharToMultiByte GetStdHandle WriteFile GetACP HeapFree HeapAlloc HeapSize HeapReAlloc

user32

LoadStringW TranslateMessage DispatchMessageW PostThreadMessageW CharUpperW CharNextW MessageBoxW GetMessageW

advapi32

SetServiceStatus RegisterServiceCtrlHandlerW OpenServiceW OpenSCManagerW DeleteService CreateServiceW ControlService CloseServiceHandle ChangeServiceConfig2W ChangeServiceConfigW RegSetValueExW RegQueryValueExW RegQueryInfoKeyW RegOpenKeyExW RegEnumKeyExW RegDeleteValueW RegDeleteKeyW RegCreateKeyExW RegCloseKey ReportEventW RegisterEventSourceW DeregisterEventSource StartServiceCtrlDispatcherW

ole32

CoRegisterClassObject CoRevokeClassObject CoUninitialize CoResumeClassObjects CoReleaseServerProcess CoInitializeSecurity CoCreateInstance StringFromGUID2 CoTaskMemAlloc CoTaskMemRealloc CoInitializeEx CoTaskMemFree CoAddRefServerProcess

oleaut32

LoadRegTypeLi UnRegisterTypeLi RegisterTypeLi LoadTypeLi SysStringLen SysFreeString SysAllocString VarUI4FromStr

Name

.text

Size

104KB

Virtual Size

104KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

58KB

Virtual Size

57KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

7KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.gfids

Size

512B

Virtual Size

212B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

18KB

Virtual Size

18KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

1.1MB

Virtual Size

1.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-20_f491f9cda1a5f2f965d9d9cd3aa6d966_icedid_mespinoza_njrat_ryuk

kernel32

user32

advapi32

ole32

oleaut32

generic