2026-07-24_f4bc4eafe20adcbd33e17cdacb33697c_icedid_mespinoza_njrat_ryuk

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-24_f4bc4eafe20adcbd33e17cdacb33697c_icedid_mespinoza_njrat_ryuk
Size 1.6MB
Sample260724-warp8ahn2x
SHA256 5391f92a530e2609eeab6cf9f75dfb40206751e80cb687c5d7892522b450a962
MD5 f4bc4eafe20adcbd33e17cdacb33697c
SHA1 846e05f731ac3fd5b2ca073e4f0ed9a5a3ed5ae6
SHA512 96fe9940870f67410454a7da4a7da1fc52a88db8e667a27bbd4e8a0f53a99e335029b59865eb52d8bb800097ec04ac29124d6ea40e7ffefbf532109f8331084c
SSDEEP 12288:jTcDW0DBr+5PCToGceSJYT5Oi3nLICy1asXAq14KH/G5fzn5bDesMr6:fK9DBr+5POHDpnLQ1VAq1Nfwrn0sS6
TLSH
T19975E059B7A844E5ED73823CC9A28845E6B27C551B31D79F03A4431A3F37AE09D3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-24_f4bc4eafe20adcbd33e17cdacb33697c_icedid_mespinoza_njrat_ryuk

File Explorer

2026-07-24_f4bc4eafe20adcbd33e17cdacb33697c_icedid_mespinoza_njrat_ryuk

.exe 1.6MB

2026-07-24_f4bc4eafe20adcbd33e17cdacb33697c_icedid_mespinoza_njrat_ryuk

IMPHASH e1d1a7ad277faed2b5f0cb9d8be2bd98
SHA256 5391f92a530e2609eeab6cf9f75dfb40206751e80cb687c5d7892522b450a962
MD5 f4bc4eafe20adcbd33e17cdacb33697c
SHA1 846e05f731ac3fd5b2ca073e4f0ed9a5a3ed5ae6
SHA512 96fe9940870f67410454a7da4a7da1fc52a88db8e667a27bbd4e8a0f53a99e335029b59865eb52d8bb800097ec04ac29124d6ea40e7ffefbf532109f8331084c
SSDEEP 12288:jTcDW0DBr+5PCToGceSJYT5Oi3nLICy1asXAq14KH/G5fzn5bDesMr6:fK9DBr+5POHDpnLQ1VAq1Nfwrn0sS6
TLSH
T19975E059B7A844E5ED73823CC9A28845E6B27C551B31D79F03A4431A3F37AE09D3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

69880

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\cygwin64\tmp\build\source\usbdk\Install\x64\Win10Release\UsbDkController.pdb

usbdkhelper

UsbDk_DeleteAllPersistentRules UsbDk_CloseHiderHandle UsbDk_ClearHideRules UsbDk_AddExtendedHideRule UsbDk_AddHideRule UsbDk_CreateHiderHandle UsbDk_DeleteExtendedPersistentHideRule UsbDk_DeletePersistentHideRule UsbDk_AddExtendedPersistentHideRule UsbDk_AddPersistentHideRule UsbDk_StopRedirect UsbDk_StartRedirect UsbDk_ReleaseDevicesList UsbDk_GetDevicesList UsbDk_ReleaseConfigurationDescriptor UsbDk_GetConfigurationDescriptor UsbDk_UninstallDriver UsbDk_InstallDriver

kernel32

CreateFileW HeapSize WriteConsoleW ReadConsoleW SetStdHandle SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP IsValidCodePage FindNextFileW FindFirstFileExW GetModuleFileNameW SetCurrentDirectoryW GetLastError FindClose WideCharToMultiByte GetStringTypeW MultiByteToWideChar EncodePointer DecodePointer EnterCriticalSection LeaveCriticalSection DeleteCriticalSection SetLastError InitializeCriticalSectionAndSpinCount CreateEventW TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemTimeAsFileTime GetModuleHandleW GetProcAddress CompareStringW LCMapStringW GetLocaleInfoW GetCPInfo CloseHandle SetEvent ResetEvent WaitForSingleObjectEx RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId InitializeSListHead RtlPcToFileHeader RaiseException RtlUnwindEx FreeLibrary LoadLibraryExW HeapAlloc HeapReAlloc HeapFree ExitProcess GetModuleHandleExW GetStdHandle WriteFile GetCommandLineA GetCommandLineW GetACP GetFileType IsValidLocale GetUserDefaultLCID EnumSystemLocalesW FlushFileBuffers GetConsoleCP GetConsoleMode ReadFile SetFilePointerEx GetProcessHeap

shlwapi

PathRemoveFileSpecW

advapi32

SystemFunction036

Name

.text

Size

195KB

Virtual Size

195KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

99KB

Virtual Size

98KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

10KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.gfids

Size

1024B

Virtual Size

852B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

1.3MB

Virtual Size

2.0MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-24_f4bc4eafe20adcbd33e17cdacb33697c_icedid_mespinoza_njrat_ryuk

usbdkhelper

kernel32

shlwapi

advapi32

generic