2026-07-24_64982d80c423d4b2afc9e5ebf6050298_icedid_mespinoza_njrat_ryuk

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-24_64982d80c423d4b2afc9e5ebf6050298_icedid_mespinoza_njrat_ryuk
Size 1.0MB
Sample260724-lc8reafd64
SHA256 33ab17240d70524a13bc20c6fc506acf77eff2c96f416cbe7c54be704c65daea
MD5 64982d80c423d4b2afc9e5ebf6050298
SHA1 a62bc38e276abb6efb83a52f29376a9eea7c2eb1
SHA512 32ed90302b826ba0997d2a831b785b25bcda755c9b9cdf11a25673824a38d814b62f51945041f805e4774903630a4b2083d82be0d95df1bb43f8965d810827d4
SSDEEP 24576:yOhXoBIPne87HtO/DF1+9codjeWyZxeCEV:yOJuIR2TPod5
TLSH
T1F725AD89A3D404E9E9E6823AA9634571F7E27CDB3B65D78F42D033092E376D0C939271
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-24_64982d80c423d4b2afc9e5ebf6050298_icedid_mespinoza_njrat_ryuk

File Explorer

2026-07-24_64982d80c423d4b2afc9e5ebf6050298_icedid_mespinoza_njrat_ryuk

.exe 1.0MB

2026-07-24_64982d80c423d4b2afc9e5ebf6050298_icedid_mespinoza_njrat_ryuk

IMPHASH 28917e24dcdaea9342514624b137931d
SHA256 33ab17240d70524a13bc20c6fc506acf77eff2c96f416cbe7c54be704c65daea
MD5 64982d80c423d4b2afc9e5ebf6050298
SHA1 a62bc38e276abb6efb83a52f29376a9eea7c2eb1
SHA512 32ed90302b826ba0997d2a831b785b25bcda755c9b9cdf11a25673824a38d814b62f51945041f805e4774903630a4b2083d82be0d95df1bb43f8965d810827d4
SSDEEP 24576:yOhXoBIPne87HtO/DF1+9codjeWyZxeCEV:yOJuIR2TPod5
TLSH
T1F725AD89A3D404E9E9E6823AA9634571F7E27CDB3B65D78F42D033092E376D0C939271
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

75736

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\TestPC\Desktop\QuickAccess_V2\Bin\Release\QASvc.pdb

kernel32

Process32NextW OpenProcess GetCurrentProcess ProcessIdToSessionId SetEnvironmentVariableW SetEnvironmentVariableA FreeEnvironmentStringsW Process32FirstW CreateToolhelp32Snapshot WriteFile ReadFile DisconnectNamedPipe ConnectNamedPipe DeviceIoControl CreateFileW FindResourceExW FindResourceW SizeofResource LockResource LoadResource GetEnvironmentVariableW InitializeCriticalSection WideCharToMultiByte Sleep GetModuleFileNameW QueueUserWorkItem CreateEventW FlushFileBuffers WTSGetActiveConsoleSessionId GetProcessHeap HeapSize HeapReAlloc HeapFree HeapAlloc HeapDestroy WaitForSingleObject SetEvent CreateThread CloseHandle DecodePointer InitializeCriticalSectionEx RaiseException GetLastError LeaveCriticalSection EnterCriticalSection DeleteCriticalSection SetEndOfFile GetEnvironmentStringsW GetOEMCP IsValidCodePage SetFilePointerEx GetConsoleMode GetConsoleCP EnumSystemLocalesW GetUserDefaultLCID WriteConsoleW ReadConsoleW SetStdHandle FindNextFileW FindFirstFileExW FindClose SetNamedPipeHandleState WaitNamedPipeW CreateNamedPipeW MultiByteToWideChar GetStringTypeW EncodePointer SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemTimeAsFileTime GetModuleHandleW GetProcAddress CompareStringW LCMapStringW GetLocaleInfoW GetCPInfo ResetEvent WaitForSingleObjectEx RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId InitializeSListHead OutputDebugStringW LocalFree RtlPcToFileHeader RtlUnwindEx FreeLibrary LoadLibraryExW GetTimeZoneInformation ExitProcess GetModuleHandleExW GetStdHandle GetCommandLineA GetCommandLineW GetACP GetFileType GetDateFormatW GetTimeFormatW IsValidLocale

user32

wsprintfW

advapi32

ConvertStringSecurityDescriptorToSecurityDescriptorW RegDeleteTreeW RegDeleteKeyValueW SystemFunction036 OpenProcessToken CreateProcessAsUserW GetLengthSid SetTokenInformation AllocateAndInitializeSid DuplicateTokenEx RegSetValueExW RegQueryValueExW GetUserNameW DeleteService QueryServiceStatus ControlService OpenServiceW ChangeServiceConfig2W CloseServiceHandle CreateServiceW OpenSCManagerW ProcessTrace OpenTraceW EnableTraceEx StartTraceW CloseTrace RegCreateKeyW RegGetValueW RegSetKeyValueW RegCloseKey RegCreateKeyExW RegOpenKeyExW DeregisterEventSource ReportEventW RegisterEventSourceW SetServiceStatus RegisterServiceCtrlHandlerExW StartServiceCtrlDispatcherW InitializeSecurityDescriptor

ole32

CoInitializeEx CoUninitialize CoCreateInstance CoSetProxyBlanket CoInitializeSecurity

oleaut32

SafeArrayUnaccessData SafeArrayAccessData SafeArrayCreate SysFreeString SysAllocString VariantChangeType VariantClear VariantCopy VariantInit

imagehlp

MakeSureDirectoryPathExists

tdh

TdhGetEventInformation

userenv

CreateEnvironmentBlock DestroyEnvironmentBlock

wtsapi32

WTSQueryUserToken

Name

.text

Size

201KB

Virtual Size

201KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

93KB

Virtual Size

93KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

11KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

146KB

Virtual Size

145KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

568KB

Virtual Size

572KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-24_64982d80c423d4b2afc9e5ebf6050298_icedid_mespinoza_njrat_ryuk

kernel32

user32

advapi32

ole32

oleaut32

imagehlp

tdh

userenv

wtsapi32

generic