2026-08-09_fec344ccf1f1c304ede592709b9da9cf_icedid_mespinoza_njrat_ryuk

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-09_fec344ccf1f1c304ede592709b9da9cf_icedid_mespinoza_njrat_ryuk
Size 1.6MB
Sample260809-3nwdwsfm2y
SHA256 4a1094af9150f30b7a32c429807791b6293a8817e9a9fb6c1f09b88c29a9ee45
MD5 fec344ccf1f1c304ede592709b9da9cf
SHA1 41a1e1993bd0425abca8504298e752a4f48fc498
SHA512 b9ba7e2bf2e08d379a221ec31bc38258915f5ca61c54e6506486a021a0351a02fd9070ef93a1cb2d4857dbd72109a80935c585eaa413059e06ca930557986ea3
SSDEEP 24576:SbjJVIUpm7y7JIXojFvZ+xcb4Czn9ZYHHaAfYLH8AcevDN0FImbwQuq3Wia7gD:Sh3p+2vZmcbFj9ZRAQgAT76sQuE
TLSH
T1B075AE1DAE9841E5E073C578C9A28586F7B1785A4F319BCF0296535E2F336E08D7E322
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-09_fec344ccf1f1c304ede592709b9da9cf_icedid_mespinoza_njrat_ryuk

File Explorer

2026-08-09_fec344ccf1f1c304ede592709b9da9cf_icedid_mespinoza_njrat_ryuk

.exe 1.6MB

2026-08-09_fec344ccf1f1c304ede592709b9da9cf_icedid_mespinoza_njrat_ryuk

IMPHASH aaa539a5c616f9eeb4e2fd2610763ddf
SHA256 4a1094af9150f30b7a32c429807791b6293a8817e9a9fb6c1f09b88c29a9ee45
MD5 fec344ccf1f1c304ede592709b9da9cf
SHA1 41a1e1993bd0425abca8504298e752a4f48fc498
SHA512 b9ba7e2bf2e08d379a221ec31bc38258915f5ca61c54e6506486a021a0351a02fd9070ef93a1cb2d4857dbd72109a80935c585eaa413059e06ca930557986ea3
SSDEEP 24576:SbjJVIUpm7y7JIXojFvZ+xcb4Czn9ZYHHaAfYLH8AcevDN0FImbwQuq3Wia7gD:Sh3p+2vZmcbFj9ZRAQgAT76sQuE
TLSH
T1B075AE1DAE9841E5E073C578C9A28586F7B1785A4F319BCF0296535E2F336E08D7E322
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

372228

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

f:\jnks\workspace\K24_CXP_Production_Build\build2787\SxS\src\x64\Release\HPPAHelper.pdb

kernel32

GetProcessHeap DeleteCriticalSection DecodePointer HeapAlloc RaiseException HeapReAlloc HeapSize InitializeCriticalSectionAndSpinCount HeapFree GetSystemWow64DirectoryW WriteConsoleW ReadConsoleW SetStdHandle SetEnvironmentVariableA GetCommandLineA GetOEMCP IsValidCodePage FindFirstFileExW SetFilePointerEx GetConsoleMode GetConsoleCP FlushFileBuffers GetTimeZoneInformation SetLastError QueryPerformanceCounter GetModuleFileNameW ExpandEnvironmentStringsW InitializeCriticalSection GetCurrentProcessId MultiByteToWideChar EnterCriticalSection LeaveCriticalSection GetTickCount CreateFileW Sleep SetFilePointer WriteFile CloseHandle OutputDebugStringW GetCurrentThreadId OpenProcess GetFileAttributesExW GetCommandLineW GetTempFileNameW GetLongPathNameW SearchPathW FormatMessageW LocalFree CreateMutexW WaitForSingleObject CreateFileMappingW MapViewOfFile ReleaseMutex UnmapViewOfFile LoadLibraryW GetProcAddress FreeLibrary QueryPerformanceFrequency LockResource GlobalAlloc GlobalLock GlobalUnlock GlobalFree GlobalMemoryStatusEx LocalAlloc GetShortPathNameW GetCurrentProcess GetExitCodeProcess CreateThread TerminateThread GetExitCodeThread TryEnterCriticalSection SetEvent ResetEvent WaitForMultipleObjects LoadResource SizeofResource GetFileSizeEx DeviceIoControl FindClose GetFileTime GetSystemTime GetLocalTime CreatePipe ConnectNamedPipe DisconnectNamedPipe PeekNamedPipe FlushViewOfFile OpenMutexW CreateEventW OpenEventW OpenFileMappingW CreateProcessW GetStartupInfoW GetEnvironmentVariableW FindResourceW FindResourceExW GetSystemDirectoryW GetTempPathW SetCurrentDirectoryW GetCurrentDirectoryW GetDiskFreeSpaceExW CreateDirectoryW SetFileAttributesW GetFileAttributesW DeleteFileW FindFirstFileW FindNextFileW CopyFileW MoveFileExW CreateNamedPipeW WaitNamedPipeW GetComputerNameExW GetVersionExW VerifyVersionInfoW ProcessIdToSessionId WideCharToMultiByte GetLocaleInfoW GetSystemDefaultUILanguage GetUserDefaultUILanguage GetUserDefaultLangID GetSystemDefaultLCID GetUserDefaultLCID ReadFile SetEndOfFile CreateToolhelp32Snapshot Process32FirstW Process32NextW GetFullPathNameW GetPrivateProfileStringW GetPrivateProfileStringA WritePrivateProfileStringW WritePrivateProfileStringA GetStringTypeW EncodePointer TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemTimeAsFileTime GetModuleHandleW CompareStringW LCMapStringW GetCPInfo IsDebuggerPresent GetEnvironmentStringsW FreeEnvironmentStringsW DebugBreak OutputDebugStringA VerSetConditionMask WaitForSingleObjectEx RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent InitializeSListHead SignalObjectAndWait SwitchToThread SetThreadPriority GetThreadPriority GetLogicalProcessorInformation CreateTimerQueueTimer ChangeTimerQueueTimer DeleteTimerQueueTimer GetNumaHighestNodeNumber GetProcessAffinityMask SetThreadAffinityMask RegisterWaitForSingleObject UnregisterWait GetCurrentThread GetThreadTimes FreeLibraryAndExitThread GetModuleHandleA LoadLibraryExW VirtualAlloc VirtualFree VirtualProtect DuplicateHandle ReleaseSemaphore InterlockedPopEntrySList InterlockedPushEntrySList InterlockedFlushSList QueryDepthSList UnregisterWaitEx CreateTimerQueue RtlPcToFileHeader RtlUnwindEx ExitThread GetModuleHandleExW ExitProcess GetStdHandle GetACP GetFileType GetDateFormatW GetTimeFormatW IsValidLocale EnumSystemLocalesW GetLastError

user32

SetProcessWindowStation DestroyIcon LoadIconW AllowSetForegroundWindow GetSystemMetrics SetTimer MsgWaitForMultipleObjects WaitForInputIdle GetAsyncKeyState MsgWaitForMultipleObjectsEx GetKeyState OpenDesktopW SetThreadDesktop CloseDesktop GetThreadDesktop OpenWindowStationW CloseWindowStation SendMessageCallbackW GetProcessWindowStation RegisterWindowMessageW GetMessageW PeekMessageW ExitWindowsEx SystemParametersInfoW

ole32

CoTaskMemFree CoUninitialize CoInitialize OleRun CoCreateInstance CLSIDFromString

oleaut32

VariantClear SysFreeString GetErrorInfo VariantInit SysAllocString

shlwapi

PathIsDirectoryW PathRemoveFileSpecW PathFindExtensionW PathIsFileSpecW PathCombineW PathFileExistsW PathFindFileNameW

psapi

GetModuleBaseNameW EnumProcesses EnumProcessModules GetModuleFileNameExW

version

GetFileVersionInfoSizeW VerQueryValueW GetFileVersionInfoW

advapi32

GetUserNameW RegOpenKeyExW RegCloseKey RegCreateKeyExW RegQueryValueExW OpenProcessToken CheckTokenMembership AllocateAndInitializeSid FreeSid SetEntriesInAclW SetNamedSecurityInfoW RegDeleteKeyW RegSetValueExW RegQueryInfoKeyW RegEnumValueW RegDeleteValueW RegEnumKeyExW

shell32

ShellExecuteExW ExtractIconW ShellExecuteW SHGetFolderPathW SHCreateDirectoryExW CommandLineToArgvW SHGetSpecialFolderPathW

secur32

GetUserNameExW

Name

.text

Size

698KB

Virtual Size

697KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

305KB

Virtual Size

305KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

19KB

Virtual Size

33KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

39KB

Virtual Size

38KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.gfids

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

572KB

Virtual Size

576KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-09_fec344ccf1f1c304ede592709b9da9cf_icedid_mespinoza_njrat_ryuk

kernel32

user32

ole32

oleaut32

shlwapi

psapi

version

advapi32

shell32

secur32

generic