2026-08-04_9a6a8bcf05f497e43b9d3be02eac17a7_icedid_mespinoza_njrat_ryuk

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-04_9a6a8bcf05f497e43b9d3be02eac17a7_icedid_mespinoza_njrat_ryuk
Size 1.5MB
Sample260804-r6ptaace32
SHA256 d74e5db6b229e5ddc790d34c4aa4e861674f09cd59b320e8f95f31e3ae2625f1
MD5 9a6a8bcf05f497e43b9d3be02eac17a7
SHA1 00b89deeada66e88c02765d50cc495e7f8ba250a
SHA512 bd477c0e6945b56c1ec379222a8f1572c17c217b16c0fa8fca78f1c0478e2caeec9ce51c28b58c40720a4ea3bde2377a45e956dd706dfa50ffbcaeb69a9e7b5b
SSDEEP 12288:VTcDW0DBr+5PCToGcEGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWR:1K9DBr+5POVnQ/tbw/2Mkjy6Fr7g0oR
TLSH
T17575E069B7A894E5ED73823C8C528546E77378564B31C79F13A8421E3F376E08E3AB11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-04_9a6a8bcf05f497e43b9d3be02eac17a7_icedid_mespinoza_njrat_ryuk

File Explorer

2026-08-04_9a6a8bcf05f497e43b9d3be02eac17a7_icedid_mespinoza_njrat_ryuk

.exe 1.5MB

2026-08-04_9a6a8bcf05f497e43b9d3be02eac17a7_icedid_mespinoza_njrat_ryuk

IMPHASH e1d1a7ad277faed2b5f0cb9d8be2bd98
SHA256 d74e5db6b229e5ddc790d34c4aa4e861674f09cd59b320e8f95f31e3ae2625f1
MD5 9a6a8bcf05f497e43b9d3be02eac17a7
SHA1 00b89deeada66e88c02765d50cc495e7f8ba250a
SHA512 bd477c0e6945b56c1ec379222a8f1572c17c217b16c0fa8fca78f1c0478e2caeec9ce51c28b58c40720a4ea3bde2377a45e956dd706dfa50ffbcaeb69a9e7b5b
SSDEEP 12288:VTcDW0DBr+5PCToGcEGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWR:1K9DBr+5POVnQ/tbw/2Mkjy6Fr7g0oR
TLSH
T17575E069B7A894E5ED73823C8C528546E77378564B31C79F13A8421E3F376E08E3AB11
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

69880

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\cygwin64\tmp\build\source\usbdk\Install\x64\Win10Release\UsbDkController.pdb

usbdkhelper

UsbDk_DeleteAllPersistentRules UsbDk_CloseHiderHandle UsbDk_ClearHideRules UsbDk_AddExtendedHideRule UsbDk_AddHideRule UsbDk_CreateHiderHandle UsbDk_DeleteExtendedPersistentHideRule UsbDk_DeletePersistentHideRule UsbDk_AddExtendedPersistentHideRule UsbDk_AddPersistentHideRule UsbDk_StopRedirect UsbDk_StartRedirect UsbDk_ReleaseDevicesList UsbDk_GetDevicesList UsbDk_ReleaseConfigurationDescriptor UsbDk_GetConfigurationDescriptor UsbDk_UninstallDriver UsbDk_InstallDriver

kernel32

CreateFileW HeapSize WriteConsoleW ReadConsoleW SetStdHandle SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP IsValidCodePage FindNextFileW FindFirstFileExW GetModuleFileNameW SetCurrentDirectoryW GetLastError FindClose WideCharToMultiByte GetStringTypeW MultiByteToWideChar EncodePointer DecodePointer EnterCriticalSection LeaveCriticalSection DeleteCriticalSection SetLastError InitializeCriticalSectionAndSpinCount CreateEventW TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemTimeAsFileTime GetModuleHandleW GetProcAddress CompareStringW LCMapStringW GetLocaleInfoW GetCPInfo CloseHandle SetEvent ResetEvent WaitForSingleObjectEx RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId InitializeSListHead RtlPcToFileHeader RaiseException RtlUnwindEx FreeLibrary LoadLibraryExW HeapAlloc HeapReAlloc HeapFree ExitProcess GetModuleHandleExW GetStdHandle WriteFile GetCommandLineA GetCommandLineW GetACP GetFileType IsValidLocale GetUserDefaultLCID EnumSystemLocalesW FlushFileBuffers GetConsoleCP GetConsoleMode ReadFile SetFilePointerEx GetProcessHeap

shlwapi

PathRemoveFileSpecW

advapi32

SystemFunction036

Name

.text

Size

195KB

Virtual Size

195KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

99KB

Virtual Size

98KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

10KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.gfids

Size

1024B

Virtual Size

852B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

1.2MB

Virtual Size

1.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-04_9a6a8bcf05f497e43b9d3be02eac17a7_icedid_mespinoza_njrat_ryuk

usbdkhelper

kernel32

shlwapi

advapi32

generic