2026-07-23_0087beeb0cdef5033f6b5343d18d65a6_icedid_mespinoza_njrat_ryuk

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-23_0087beeb0cdef5033f6b5343d18d65a6_icedid_mespinoza_njrat_ryuk
Size 16.6MB
Sample260724-atedcayse1
SHA256 e5b5ae2f262a00a5b324332fc66d9f66bb53e67f04b232f4eb0ce1223cb5367d
MD5 0087beeb0cdef5033f6b5343d18d65a6
SHA1 a2230afdc798d2e695ab23a69785702082c2d0e4
SHA512 1d2e7043901bffb8f4c59349f87de78a9d835f8a57d515dcbff8e0ee0c34c44dc6135ebd13da3b39a682b320b9c9ca4cdf183616fb6fa8cdeda173c3682e7743
SSDEEP 98304:5xbOL0FaMw+2pkyEalkUiH0CEXrGpQlTZLplj5QyEDLW4tkqJS0hp:5xbOifamhEXrR1Lzj5GDLW7qJND
TLSH
T13F070212F750C4BAD067423049579A96E772BC540B329FFF93F4B62A6E336908E2E711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-23_0087beeb0cdef5033f6b5343d18d65a6_icedid_mespinoza_njrat_ryuk

File Explorer

2026-07-23_0087beeb0cdef5033f6b5343d18d65a6_icedid_mespinoza_njrat_ryuk

.exe 16.6MB

2026-07-23_0087beeb0cdef5033f6b5343d18d65a6_icedid_mespinoza_njrat_ryuk

IMPHASH 8b2c04ed35a1437b96640f86e88b80a3
SHA256 e5b5ae2f262a00a5b324332fc66d9f66bb53e67f04b232f4eb0ce1223cb5367d
MD5 0087beeb0cdef5033f6b5343d18d65a6
SHA1 a2230afdc798d2e695ab23a69785702082c2d0e4
SHA512 1d2e7043901bffb8f4c59349f87de78a9d835f8a57d515dcbff8e0ee0c34c44dc6135ebd13da3b39a682b320b9c9ca4cdf183616fb6fa8cdeda173c3682e7743
SSDEEP 98304:5xbOL0FaMw+2pkyEalkUiH0CEXrGpQlTZLplj5QyEDLW4tkqJS0hp:5xbOifamhEXrR1Lzj5GDLW7qJND
TLSH
T13F070212F750C4BAD067423049579A96E772BC540B329FFF93F4B62A6E336908E2E711
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

116844

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

H:\sourcecode\SourceCode_NonDior\CustomerAPP\Zebra\Capsule\Capsule tool_1.1.0.9\x64\Release\Capsule.pdb

kernel32

ReadFile WriteFile CreateFileW Sleep CloseHandle SizeofResource OutputDebugStringW LockResource LoadLibraryW LoadResource FindResourceW DeleteCriticalSection GetProcAddress FreeLibrary WideCharToMultiByte MultiByteToWideChar GetModuleHandleW GetTickCount GetModuleFileNameA GetCurrentProcess GetSystemPowerStatus WriteConsoleW SetEndOfFile DecodePointer RaiseException GetLastError GetCurrentDirectoryW InitializeCriticalSectionEx HeapSize FlushFileBuffers SetStdHandle GetProcessHeap SetEnvironmentVariableW SetEnvironmentVariableA FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP IsValidCodePage FindNextFileW FindFirstFileExW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent EnterCriticalSection LeaveCriticalSection SetEvent ResetEvent WaitForSingleObjectEx CreateEventW IsDebuggerPresent GetStartupInfoW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead GetStringTypeW EncodePointer SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree CompareStringW LCMapStringW GetLocaleInfoW GetCPInfo LocalFree RtlPcToFileHeader RtlUnwindEx LoadLibraryExW ExitProcess GetModuleHandleExW GetModuleFileNameW GetStdHandle GetCommandLineA GetCommandLineW GetACP HeapAlloc HeapReAlloc HeapFree GetDateFormatW GetTimeFormatW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetFileType SetFilePointerEx GetConsoleMode ReadConsoleW DeleteFileW GetConsoleCP GetNumberOfConsoleInputEvents PeekConsoleInputA GetTimeZoneInformation FindClose

advapi32

InitiateSystemShutdownW AdjustTokenPrivileges OpenProcessToken LookupPrivilegeValueW

ole32

CoInitialize CoUninitialize CoCreateInstance CoInitializeSecurity CoInitializeEx CoSetProxyBlanket

oleaut32

SafeArrayUnaccessData SafeArrayAccessData VariantInit SysFreeString SysAllocString VariantClear

Name

.text

Size

276KB

Virtual Size

275KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

114KB

Virtual Size

114KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

13KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gfids

Size

1024B

Virtual Size

824B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

240KB

Virtual Size

240KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-23_0087beeb0cdef5033f6b5343d18d65a6_icedid_mespinoza_njrat_ryuk

kernel32

advapi32

ole32

oleaut32

generic