2026-07-28_0aa80693834e22ac5c284f04f6e84d33_icedid_mespinoza_njrat

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-28_0aa80693834e22ac5c284f04f6e84d33_icedid_mespinoza_njrat
Size 19.5MB
Sample260728-gprlfack2w
SHA256 c618e135af43dff4f2d33457f0cae98177eb8436e1c1ad4e5cc30dfee1d345c2
MD5 0aa80693834e22ac5c284f04f6e84d33
SHA1 778c892119037b4243912f0ef4c7808f59ff862b
SHA512 97a0be0bd686c2a804d8a5cff6a12820860dafb4aa2522a6ad7387a9faadeb66373612a5802507ade64253cf8436736ddfc43c7f26b0e06bdb9f0fb5f1d1b6ae
SSDEEP 196608:f9NKm9wgwqVwlNtZCYin8VSBlmD2erjlf2/LsVNd+9:VMm9wiMGF8VSBlU7rxf7VNd+9
TLSH
T10A276B17A6F0C44CEC27D0F8AA06BF939571F4278B3928C7B59EADB45CA8CD55978302
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-28_0aa80693834e22ac5c284f04f6e84d33_icedid_mespinoza_njrat

File Explorer

2026-07-28_0aa80693834e22ac5c284f04f6e84d33_icedid_mespinoza_njrat

.exe 19.5MB

2026-07-28_0aa80693834e22ac5c284f04f6e84d33_icedid_mespinoza_njrat

IMPHASH 786434f9061a77c7f1bfa29365ff4397
SHA256 c618e135af43dff4f2d33457f0cae98177eb8436e1c1ad4e5cc30dfee1d345c2
MD5 0aa80693834e22ac5c284f04f6e84d33
SHA1 778c892119037b4243912f0ef4c7808f59ff862b
SHA512 97a0be0bd686c2a804d8a5cff6a12820860dafb4aa2522a6ad7387a9faadeb66373612a5802507ade64253cf8436736ddfc43c7f26b0e06bdb9f0fb5f1d1b6ae
SSDEEP 196608:f9NKm9wgwqVwlNtZCYin8VSBlmD2erjlf2/LsVNd+9:VMm9wiMGF8VSBlU7rxf7VNd+9
TLSH
T10A276B17A6F0C44CEC27D0F8AA06BF939571F4278B3928C7B59EADB45CA8CD55978302
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

19444692

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

powrprof

PowerGetActiveScheme

oleaut32

SysAllocString SysFreeString VariantClear VariantInit

user32

EnumDisplayDevicesA EnumDisplaySettingsA EnumWindows GetDC GetSystemMetrics GetWindowThreadProcessId IsIconic IsWindowVisible ReleaseDC

ntdll

NtAssignProcessToJobObject NtCreateDirectoryObjectEx NtCreateJobObject NtCreateUserProcess NtDeviceIoControlFile NtImpersonateThread NtOpenDirectoryObject NtOpenEvent NtOpenFile NtQueryInformationJobObject NtQuerySystemInformation NtSetEvent NtSetInformationFile NtSetInformationJobObject NtTerminateJobObject NtTerminateProcess NtWaitForSingleObject RtlCaptureContext RtlCreateUnicodeString RtlFreeUnicodeString RtlImageNtHeader RtlLookupFunctionEntry RtlPcToFileHeader RtlUnwindEx RtlVirtualUnwind

gdiplus

GdipCreateBitmapFromHBITMAP GdipDisposeImage GdipGetImageEncoders GdipGetImageEncodersSize GdipSaveImageToStream GdiplusStartup

crypt32

CertFindExtension CertGetNameStringA CryptDecodeObjectEx

hid

HidD_FreePreparsedData HidD_GetAttributes HidD_GetHidGuid HidD_GetPreparsedData HidD_GetProductString HidP_GetCaps

gdi32

BitBlt CreateCompatibleBitmap CreateCompatibleDC D3DKMTCloseAdapter D3DKMTOpenAdapterFromLuid D3DKMTQueryAdapterInfo DeleteDC DeleteObject GetStockObject SelectObject

setupapi

SetupDiDestroyDeviceInfoList SetupDiEnumDeviceInterfaces SetupDiGetClassDevsA SetupDiGetDeviceInterfaceDetailA

dwmapi

DwmGetCompositionTimingInfo DwmIsCompositionEnabled

ole32

CoInitializeSecurity CoSetProxyBlanket CoTaskMemFree CreateStreamOnHGlobal GetHGlobalFromStream OleInitialize OleUninitialize

advapi32

ConvertSidToStringSidA EventRegister EventSetInformation EventUnregister EventWriteTransfer OpenThreadToken QueryServiceStatusEx RegCloseKey RegCreateKeyExW RegEnumKeyExA RegGetValueW RegOpenKeyExA RegOpenKeyExW RegQueryValueExA RegQueryValueExW RevertToSelf SetThreadToken

winhttp

WinHttpWebSocketClose WinHttpWebSocketCompleteUpgrade WinHttpWebSocketReceive WinHttpWebSocketSend

kernel32

AcquireSRWLockExclusive CloseHandle CompareStringW CreateFileMappingW CreateFileW CreateMutexExW CreateSemaphoreExW CreateThread DebugBreak DeleteCriticalSection EncodePointer EnterCriticalSection ExitProcess ExitThread FindClose FindFirstFileExW FindNextFileW FlushFileBuffers FormatMessageW FreeEnvironmentStringsW FreeLibrary FreeLibraryAndExitThread GetACP GetCPInfo GetCommandLineA GetCommandLineW GetConsoleCP GetConsoleMode GetCurrentProcess GetCurrentProcessId GetCurrentThreadId GetDiskFreeSpaceExA GetDriveTypeA GetEnvironmentStringsW GetEnvironmentVariableW GetFileAttributesW GetFileSizeEx GetFileType GetFirmwareEnvironmentVariableA GetLastError GetLogicalDrives GetModuleFileNameA GetModuleFileNameW GetModuleHandleExW GetModuleHandleW GetOEMCP GetProcAddress GetProcessHeap GetProcessId GetStartupInfoW GetStdHandle GetStringTypeW GetSystemTime GetSystemTimeAsFileTime GetThreadId GetTimeZoneInformation GlobalLock GlobalMemoryStatusEx GlobalSize GlobalUnlock HeapAlloc HeapFree HeapReAlloc HeapSize InitializeCriticalSectionAndSpinCount InitializeSListHead IsDebuggerPresent IsProcessorFeaturePresent IsValidCodePage LCMapStringW LeaveCriticalSection LoadLibraryA LoadLibraryExW LoadLibraryW LocalFree MapViewOfFile MultiByteToWideChar OpenSemaphoreW OpenThread OutputDebugStringA OutputDebugStringW QueryPerformanceCounter RaiseException ReadConsoleW ReadFile ReleaseSRWLockExclusive ReleaseSemaphore SetEndOfFile SetEnvironmentVariableA SetFilePointerEx SetLastError SetStdHandle SetUnhandledExceptionFilter SleepConditionVariableSRW TerminateProcess TlsAlloc TlsFree TlsGetValue TlsSetValue TryAcquireSRWLockExclusive UnhandledExceptionFilter UnmapViewOfFile WaitForSingleObjectEx WakeAllConditionVariable WideCharToMultiByte WriteConsoleW WriteFile

Name

.crt

Size

18.7MB

Virtual Size

18.7MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.didat

Size

252KB

Virtual Size

252KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.luvwcyp

Size

32KB

Virtual Size

115KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

59KB

Virtual Size

58KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.init

Size

512B

Virtual Size

136B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.arrigg

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.xdata

Size

512B

Virtual Size

500B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

445KB

Virtual Size

445KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

94KB

Virtual Size

94KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.kyt

Size

1024B

Virtual Size

921B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xsctfu

Size

1KB

Virtual Size

209B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-28_0aa80693834e22ac5c284f04f6e84d33_icedid_mespinoza_njrat

powrprof

oleaut32

user32

ntdll

gdiplus

crypt32

hid

gdi32

setupapi

dwmapi

ole32

advapi32

winhttp

kernel32

generic