2026-08-04_cb94d96c1918472ebb434e5b2c2140dd_icedid_mespinoza_njrat_ryuk

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-04_cb94d96c1918472ebb434e5b2c2140dd_icedid_mespinoza_njrat_ryuk
Size 1.5MB
Sample260804-rggrdaca42
SHA256 d0e265a5aaae1437f4d439044e08ce550d958b93743e27815eb33d42ddd2ab52
MD5 cb94d96c1918472ebb434e5b2c2140dd
SHA1 6bc6f34eb9ed1795b106c89ea81c09c6bd753e94
SHA512 40202fc60f8879674b9d625b22b4454f80ed6608f6306199de73f37ba0ed3985f61b2d24eb9875a7b99165711c35be2d5b38259c46b5cb0f3ac74e1e72f42b40
SSDEEP 12288:lTcDW0DBr+5PCToGcqGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWF:lK9DBr+5POvnQ/tbw/2Mkjy6Fr7g0oF
TLSH
T1EB75E069B7A894E5ED73823C8C528546E77378564B31C79F13A8421E3F376E08E3AB11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-04_cb94d96c1918472ebb434e5b2c2140dd_icedid_mespinoza_njrat_ryuk

File Explorer

2026-08-04_cb94d96c1918472ebb434e5b2c2140dd_icedid_mespinoza_njrat_ryuk

.exe 1.5MB

2026-08-04_cb94d96c1918472ebb434e5b2c2140dd_icedid_mespinoza_njrat_ryuk

IMPHASH e1d1a7ad277faed2b5f0cb9d8be2bd98
SHA256 d0e265a5aaae1437f4d439044e08ce550d958b93743e27815eb33d42ddd2ab52
MD5 cb94d96c1918472ebb434e5b2c2140dd
SHA1 6bc6f34eb9ed1795b106c89ea81c09c6bd753e94
SHA512 40202fc60f8879674b9d625b22b4454f80ed6608f6306199de73f37ba0ed3985f61b2d24eb9875a7b99165711c35be2d5b38259c46b5cb0f3ac74e1e72f42b40
SSDEEP 12288:lTcDW0DBr+5PCToGcqGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWF:lK9DBr+5POvnQ/tbw/2Mkjy6Fr7g0oF
TLSH
T1EB75E069B7A894E5ED73823C8C528546E77378564B31C79F13A8421E3F376E08E3AB11
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

69880

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\cygwin64\tmp\build\source\usbdk\Install\x64\Win10Release\UsbDkController.pdb

usbdkhelper

UsbDk_DeleteAllPersistentRules UsbDk_CloseHiderHandle UsbDk_ClearHideRules UsbDk_AddExtendedHideRule UsbDk_AddHideRule UsbDk_CreateHiderHandle UsbDk_DeleteExtendedPersistentHideRule UsbDk_DeletePersistentHideRule UsbDk_AddExtendedPersistentHideRule UsbDk_AddPersistentHideRule UsbDk_StopRedirect UsbDk_StartRedirect UsbDk_ReleaseDevicesList UsbDk_GetDevicesList UsbDk_ReleaseConfigurationDescriptor UsbDk_GetConfigurationDescriptor UsbDk_UninstallDriver UsbDk_InstallDriver

kernel32

CreateFileW HeapSize WriteConsoleW ReadConsoleW SetStdHandle SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP IsValidCodePage FindNextFileW FindFirstFileExW GetModuleFileNameW SetCurrentDirectoryW GetLastError FindClose WideCharToMultiByte GetStringTypeW MultiByteToWideChar EncodePointer DecodePointer EnterCriticalSection LeaveCriticalSection DeleteCriticalSection SetLastError InitializeCriticalSectionAndSpinCount CreateEventW TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemTimeAsFileTime GetModuleHandleW GetProcAddress CompareStringW LCMapStringW GetLocaleInfoW GetCPInfo CloseHandle SetEvent ResetEvent WaitForSingleObjectEx RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId InitializeSListHead RtlPcToFileHeader RaiseException RtlUnwindEx FreeLibrary LoadLibraryExW HeapAlloc HeapReAlloc HeapFree ExitProcess GetModuleHandleExW GetStdHandle WriteFile GetCommandLineA GetCommandLineW GetACP GetFileType IsValidLocale GetUserDefaultLCID EnumSystemLocalesW FlushFileBuffers GetConsoleCP GetConsoleMode ReadFile SetFilePointerEx GetProcessHeap

shlwapi

PathRemoveFileSpecW

advapi32

SystemFunction036

Name

.text

Size

195KB

Virtual Size

195KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

99KB

Virtual Size

98KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

10KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.gfids

Size

1024B

Virtual Size

852B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

1.2MB

Virtual Size

1.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-04_cb94d96c1918472ebb434e5b2c2140dd_icedid_mespinoza_njrat_ryuk

usbdkhelper

kernel32

shlwapi

advapi32

generic