2026-07-30_aa134aa6305a101d3743815a710ad9d5_cobalt-strike_icedid_mespinoza_ryuk

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-30_aa134aa6305a101d3743815a710ad9d5_cobalt-strike_icedid_mespinoza_ryuk
Size 334KB
Sample260730-3fm3jssthw
SHA256 b1bcf2bfdfb43f07bf8028b144fecc69af8ce7738c063c32d9aef4888ce9562b
MD5 aa134aa6305a101d3743815a710ad9d5
SHA1 c470003ff01f10632ad34d204c97f9a6d07a8066
SHA512 69772ea678c335f3934f373d96a54d8b80bdc2d96a54dd65365ada6ae4d6aace980f7189dc5dd6c5b688757a5b81d5af78bf6bfa61fdece483b26cac0e8c3db0
SSDEEP 6144:oFoPH/Rdn+ptP9NZy9ELE2DuwAohOm9hWb9CzV0:oFoP/Dn+ptP9vyC9yo1ws0
TLSH
T19E740605A29408E4FB3687398862D08596727C790BB0D6DFD234763A6E731D39D3B72E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

2026-07-30_aa134aa6305a101d3743815a710ad9d5_cobalt-strike_icedid_mespinoza_ryuk

.exe 334KB

2026-07-30_aa134aa6305a101d3743815a710ad9d5_cobalt-strike_icedid_mespinoza_ryuk

IMPHASH 41f72046cc6b64a20f76648690ba605c
SHA256 b1bcf2bfdfb43f07bf8028b144fecc69af8ce7738c063c32d9aef4888ce9562b
MD5 aa134aa6305a101d3743815a710ad9d5
SHA1 c470003ff01f10632ad34d204c97f9a6d07a8066
SHA512 69772ea678c335f3934f373d96a54d8b80bdc2d96a54dd65365ada6ae4d6aace980f7189dc5dd6c5b688757a5b81d5af78bf6bfa61fdece483b26cac0e8c3db0
SSDEEP 6144:oFoPH/Rdn+ptP9NZy9ELE2DuwAohOm9hWb9CzV0:oFoP/Dn+ptP9vyC9yo1ws0
TLSH
T19E740605A29408E4FB3687398862D08596727C790BB0D6DFD234763A6E731D39D3B72E
MD5 SHA1 SHA512 SSDEEP TLSH

Digest

d9:2c:c3:45:55:ca:d4:7f:7b:14:bc:7c:49:e8:5d:7a:ac:91:90:a3:39:8f:e7:31:3e:7c:cb:10:52:6f:cc:f5

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=5984112,CN=GoTo Technologies USA\, LLC,O=GoTo Technologies USA\, LLC,L=Boston,ST=Massachusetts,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

Chains

Jul 28, 2026

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

Serial Number

0e:ad:3a:3f:fa:70:c0:a2:0a:e2:36:81:89:93:51:53

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Aug 21, 2025 - Aug 22, 2028

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

87040

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\build.tc\agent\work\771734dc8677b927\release\lib\x64_Release_MT_vs2015\LMISupportM64.pdb

kernel32

LoadLibraryA GetProcAddress GetModuleFileNameA FreeLibrary GetCurrentDirectoryA SetCurrentDirectoryA OpenProcess ExitProcess GetCurrentProcessId CloseHandle WriteConsoleW CreateFileW SetFilePointerEx GetConsoleMode GetConsoleCP HeapSize SetStdHandle FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP IsValidCodePage FindNextFileW FindFirstFileExW GetProcessHeap GetFileType GetACP GetStdHandle GetModuleFileNameW HeapReAlloc HeapFree HeapAlloc GetModuleHandleExW FreeLibraryAndExitThread ExitThread LoadLibraryExW RtlPcToFileHeader RtlUnwindEx InitializeSListHead GetStartupInfoW IsDebuggerPresent GetLastError SetLastError RaiseException Sleep TlsAlloc TlsGetValue TlsSetValue TlsFree SetErrorMode GetCurrentProcess GetVersion GetModuleHandleA GetCurrentThread LocalFree GetSystemTimeAsFileTime GetTickCount FileTimeToSystemTime SystemTimeToFileTime GetTimeZoneInformation WaitForSingleObject SetThreadPriority ResumeThread SetEvent ResetEvent ReleaseMutex FindClose FlushFileBuffers GetFileSize GetFileTime ReadFile SetFilePointer WriteFile InitializeCriticalSection EnterCriticalSection LeaveCriticalSection DeleteCriticalSection QueryPerformanceCounter WaitForMultipleObjects CreateEventW CreateThread GetModuleHandleW CreateFileMappingW OpenFileMappingW MapViewOfFile UnmapViewOfFile LoadLibraryW IsWow64Process CreateToolhelp32Snapshot Thread32First Thread32Next GetCurrentThreadId WideCharToMultiByte MultiByteToWideChar GetStringTypeW EncodePointer DecodePointer InitializeCriticalSectionAndSpinCount LCMapStringW GetCPInfo WaitForSingleObjectEx RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent

user32

GetSystemMetrics CharNextExA RegisterWindowMessageW PostThreadMessageW LoadStringW GetMessageW TranslateMessage DispatchMessageW DefWindowProcW PostQuitMessage RegisterClassExW CreateWindowExW DestroyWindow ShowWindow DialogBoxParamW EndDialog SetTimer KillTimer LoadAcceleratorsW TranslateAcceleratorW UpdateWindow BeginPaint EndPaint LoadCursorW SetWindowLongPtrW GetWindowLongPtrW LoadIconW SetLayeredWindowAttributes CallWindowProcW SendMessageW

ws2_32

closesocket socket WSACleanup WSAStartup

version

VerQueryValueA GetFileVersionInfoA

advapi32

RegCloseKey OpenProcessToken GetTokenInformation OpenThreadToken ConvertSidToStringSidW RegQueryValueExW RegCreateKeyExW

ole32

CoCreateGuid CoInitialize CoUninitialize

Name

.text

Size

147KB

Virtual Size

146KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

106KB

Virtual Size

105KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

7KB

Virtual Size

28KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

9KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

49KB

Virtual Size

49KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-30_aa134aa6305a101d3743815a710ad9d5_cobalt-strike_icedid_mespinoza_ryuk

kernel32

user32

ws2_32

version

advapi32

ole32

generic