2026-08-09_fb9bfc93be21e4e8020842c0c13e63a5_icedid_mespinoza_njrat_ryuk

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-09_fb9bfc93be21e4e8020842c0c13e63a5_icedid_mespinoza_njrat_ryuk
Size 1.6MB
Sample260809-3n3szafm21
SHA256 63c107d1da07be4eef949733bc1fd668d81274eca6d5deffde3cb9a624db79fe
MD5 fb9bfc93be21e4e8020842c0c13e63a5
SHA1 8e59fde99281a97e99bdc80bab6f7e46120cc220
SHA512 e5d130edf5d78dd76c58c2904baa4edd273e2bfdf9022c6c3493340a964f14ed4d8d93d80a78cd66f392a612640dc7b9684316affdfb3e5bd34ad46db5de68a4
SSDEEP 24576:CWhVi9jiUyeB1PaBOuMMrM5AfYLH8AcevDN0FImbwQuq3Wia7gD:dGuUD3ipMMrM5AQgAT76sQuE
TLSH
T18785E01AFA5858F5D467C13CC8774946E7B27C6D0B31C79F23A9421E6E336908D3AB22
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-09_fb9bfc93be21e4e8020842c0c13e63a5_icedid_mespinoza_njrat_ryuk

File Explorer

2026-08-09_fb9bfc93be21e4e8020842c0c13e63a5_icedid_mespinoza_njrat_ryuk

.exe 1.6MB

2026-08-09_fb9bfc93be21e4e8020842c0c13e63a5_icedid_mespinoza_njrat_ryuk

IMPHASH 69d246d58a49e8fa05d0888c52aeac3e
SHA256 63c107d1da07be4eef949733bc1fd668d81274eca6d5deffde3cb9a624db79fe
MD5 fb9bfc93be21e4e8020842c0c13e63a5
SHA1 8e59fde99281a97e99bdc80bab6f7e46120cc220
SHA512 e5d130edf5d78dd76c58c2904baa4edd273e2bfdf9022c6c3493340a964f14ed4d8d93d80a78cd66f392a612640dc7b9684316affdfb3e5bd34ad46db5de68a4
SSDEEP 24576:CWhVi9jiUyeB1PaBOuMMrM5AfYLH8AcevDN0FImbwQuq3Wia7gD:dGuUD3ipMMrM5AQgAT76sQuE
TLSH
T18785E01AFA5858F5D467C13CC8774946E7B27C6D0B31C79F23A9421E6E336908D3AB22
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

80380

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

f:\jnks\workspace\K24_CXP_Production_Build\build2787\SxS\src\x64\Release\SendAFax.pdb

kernel32

TerminateThread GetExitCodeThread GetExitCodeProcess GetProcessHeap DeleteCriticalSection DecodePointer HeapAlloc GetShortPathNameW LocalAlloc SetLastError QueryPerformanceCounter GetModuleFileNameW ExpandEnvironmentStringsW InitializeCriticalSection GetCurrentProcessId MultiByteToWideChar EnterCriticalSection LeaveCriticalSection GetTickCount CreateFileW Sleep SetFilePointer WriteFile CloseHandle OutputDebugStringW GetCurrentThreadId OpenProcess GetFileAttributesExW GetCommandLineW GetTempFileNameW GetLongPathNameW SearchPathW FormatMessageW LocalFree CreateMutexW WaitForSingleObject CreateFileMappingW MapViewOfFile ReleaseMutex UnmapViewOfFile LoadLibraryW GetProcAddress FreeLibrary QueryPerformanceFrequency CreateDirectoryW FindFirstFileW FindNextFileW FindClose WideCharToMultiByte GetPrivateProfileStringW GetPrivateProfileStringA WritePrivateProfileStringW WritePrivateProfileStringA GetStringTypeW EncodePointer CreateEventW TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemTimeAsFileTime GetModuleHandleW CompareStringW LCMapStringW GetLocaleInfoW GetCPInfo RaiseException SetEvent ResetEvent WaitForSingleObjectEx RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent GetStartupInfoW InitializeSListHead RtlPcToFileHeader RtlUnwindEx LoadLibraryExW ExitProcess GetModuleHandleExW GetStdHandle GetACP GetFileType GetDateFormatW GetTimeFormatW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetTimeZoneInformation FlushFileBuffers GetConsoleCP GetConsoleMode ReadFile SetFilePointerEx FindFirstFileExW IsValidCodePage GetOEMCP GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableA CreateThread SetStdHandle ReadConsoleW WriteConsoleW HeapReAlloc GetLastError FreeLibraryAndExitThread GlobalMemoryStatusEx ExitThread GetSystemDefaultLCID GetUserDefaultLangID GetUserDefaultUILanguage GetSystemDefaultUILanguage ProcessIdToSessionId VerifyVersionInfoW GetVersionExW GetComputerNameExW WaitNamedPipeW CreateNamedPipeW MoveFileExW CopyFileW DeleteFileW GetFileAttributesW SetFileAttributesW GetDiskFreeSpaceExW GetCurrentDirectoryW SetCurrentDirectoryW GetTempPathW GetSystemDirectoryW FindResourceExW FindResourceW GetEnvironmentVariableW CreateProcessW OpenFileMappingW OpenEventW OpenMutexW FlushViewOfFile PeekNamedPipe HeapSize InitializeCriticalSectionAndSpinCount HeapFree lstrlenW IsDebuggerPresent GetConsoleWindow GlobalFree GlobalUnlock GlobalLock DisconnectNamedPipe ConnectNamedPipe CreatePipe GetLocalTime GetSystemTime GlobalAlloc LockResource WaitForMultipleObjects LoadResource SizeofResource GetFileSizeEx GetFileTime DeviceIoControl TryEnterCriticalSection

user32

ShowWindow GetAsyncKeyState MsgWaitForMultipleObjectsEx SystemParametersInfoW DestroyIcon LoadIconW AllowSetForegroundWindow GetSystemMetrics SetTimer MsgWaitForMultipleObjects GetKeyState SendMessageCallbackW ExitWindowsEx PeekMessageW GetMessageW RegisterWindowMessageW GetProcessWindowStation SetProcessWindowStation CloseWindowStation OpenWindowStationW GetThreadDesktop CloseDesktop SetThreadDesktop OpenDesktopW WaitForInputIdle

gdi32

StartPage DeleteDC EndDoc CreateDCW StartDocW TextOutW EndPage

shlwapi

PathFindExtensionW PathRemoveFileSpecW PathIsDirectoryW PathIsFileSpecW PathFindFileNameW

psapi

EnumProcesses GetModuleBaseNameW EnumProcessModules GetModuleFileNameExW

winspool.drv

AddPrinterW GetJobW OpenPrinterW DeletePrinter SetPrinterW AddPrinterDriverW EnumPrinterDriversW GetPrinterDriverW GetPrinterDriverDirectoryW DeletePrinterDriverExW StartDocPrinterW StartPagePrinter WritePrinter EndPagePrinter EndDocPrinter DocumentPropertiesW GetPrinterDataExW SetPrinterDataExW FindFirstPrinterChangeNotification FindNextPrinterChangeNotification FindClosePrinterChangeNotification ClosePrinter EnumMonitorsW AddMonitorW DeleteMonitorW EnumPortsW XcvDataW EnumPrintersW ord203 ord204 EnumJobsW GetPrinterW SetJobW

advapi32

RegCreateKeyExW RegCloseKey RegOpenKeyExW RegEnumKeyExW OpenProcessToken CheckTokenMembership RegQueryValueExW RegDeleteKeyW RegDeleteValueW RegEnumValueW RegQueryInfoKeyW RegSetValueExW GetUserNameW

shell32

CommandLineToArgvW ShellExecuteW ExtractIconW ShellExecuteExW SHGetFolderPathW SHGetSpecialFolderPathW

ole32

CoInitialize CoUninitialize CLSIDFromString CoCreateInstance

oleaut32

SysFreeString SysAllocString

version

GetFileVersionInfoW GetFileVersionInfoSizeW VerQueryValueW

secur32

GetUserNameExW

Name

.text

Size

229KB

Virtual Size

228KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

118KB

Virtual Size

118KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

8KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

12KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.gfids

Size

1024B

Virtual Size

760B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

54KB

Virtual Size

54KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

1.2MB

Virtual Size

1.9MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-09_fb9bfc93be21e4e8020842c0c13e63a5_icedid_mespinoza_njrat_ryuk

kernel32

user32

gdi32

shlwapi

psapi

winspool.drv

advapi32

shell32

ole32

oleaut32

version

secur32

generic