2026-08-09_0f386dfdb41b006db2517c6419097066_icedid_mespinoza_njrat_ryuk

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-09_0f386dfdb41b006db2517c6419097066_icedid_mespinoza_njrat_ryuk
Size 1.6MB
Sample260809-sapn3stsdv
SHA256 b1e278349db7e6b991f9fbc10d8c8b46b66186b456412e0db34113ce9dbcb712
MD5 0f386dfdb41b006db2517c6419097066
SHA1 ffe994134365ba757dafe4ec722451b179d8cfb8
SHA512 e96168712b5c011974b1ece0d3ace967c556bb51f0b0e59822e0e3e808c8bb15e4e6dee61baf1cf75f3cb7d905a456a8b72ec856b24bc316e61e12ec9059477b
SSDEEP 24576:FC+AENEXW1fcDFZUB3aLKa7wIayHTNyBo4kx929bL3Hnx:XEXW1fcDjUB3aLxwI4B+kn3Hnx
TLSH
T17675E105EBE404F4E1B3AA34C9B54506DA737C8A5B70C79F33A9856B2F776908D38722
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-09_0f386dfdb41b006db2517c6419097066_icedid_mespinoza_njrat_ryuk

File Explorer

2026-08-09_0f386dfdb41b006db2517c6419097066_icedid_mespinoza_njrat_ryuk

.exe 1.6MB

2026-08-09_0f386dfdb41b006db2517c6419097066_icedid_mespinoza_njrat_ryuk

IMPHASH 6acfd07fb8e784f60f58db66852ed830
SHA256 b1e278349db7e6b991f9fbc10d8c8b46b66186b456412e0db34113ce9dbcb712
MD5 0f386dfdb41b006db2517c6419097066
SHA1 ffe994134365ba757dafe4ec722451b179d8cfb8
SHA512 e96168712b5c011974b1ece0d3ace967c556bb51f0b0e59822e0e3e808c8bb15e4e6dee61baf1cf75f3cb7d905a456a8b72ec856b24bc316e61e12ec9059477b
SSDEEP 24576:FC+AENEXW1fcDFZUB3aLKa7wIayHTNyBo4kx929bL3Hnx:XEXW1fcDjUB3aLxwI4B+kn3Hnx
TLSH
T17675E105EBE404F4E1B3AA34C9B54506DA737C8A5B70C79F33A9856B2F776908D38722
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

195680

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\Projects\WinRAR\rar\build\unrar64\Release\UnRAR.pdb

kernel32

DeviceIoControl SetFileTime CloseHandle CreateDirectoryW RemoveDirectoryW CreateFileW DeleteFileW CreateHardLinkW GetShortPathNameW GetLongPathNameW MoveFileW ReadFile FlushFileBuffers SetEndOfFile SetFilePointer GetDriveTypeW GetDiskFreeSpaceExW SetFileAttributesW GetFileAttributesW GetVolumeInformationW ExpandEnvironmentStringsW FindClose FindFirstFileW FindNextFileW GetVersionExW GetModuleFileNameW GetCurrentDirectoryW GetFullPathNameW FoldStringW SetErrorMode GetModuleHandleW FreeLibrary LoadLibraryW LoadLibraryExW GetProcAddress GetCurrentProcessId GetCurrentThread GetCurrentProcess SetThreadExecutionState CreateEventW GetSystemDirectoryW SetPriorityClass GetProcessAffinityMask CreateThread InitializeCriticalSection EnterCriticalSection LeaveCriticalSection DeleteCriticalSection SetEvent ResetEvent ReleaseSemaphore WaitForSingleObject CreateSemaphoreW GetSystemTime SystemTimeToTzSpecificLocalTime TzSpecificLocalTimeToSystemTime SystemTimeToFileTime FileTimeToLocalFileTime LocalFileTimeToFileTime FileTimeToSystemTime GetCPInfo IsDBCSLeadByte MultiByteToWideChar WideCharToMultiByte CompareStringW SetFilePointerEx GetProcessHeap HeapSize SetEnvironmentVariableA FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP IsValidCodePage FindNextFileA SetConsoleCtrlHandler FormatMessageW Sleep SetLastError GetLastError WriteConsoleW ReadConsoleW SetConsoleMode GetConsoleMode WriteFile GetStdHandle GetFileType SetThreadPriority GetCommandLineW FindFirstFileExA SetStdHandle GetConsoleCP RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent WaitForSingleObjectEx IsDebuggerPresent GetStartupInfoW QueryPerformanceCounter GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead RtlUnwindEx RtlPcToFileHeader RaiseException EncodePointer InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree ExitProcess GetModuleHandleExW QueryPerformanceFrequency GetModuleFileNameA GetCommandLineA GetACP HeapFree HeapAlloc HeapReAlloc GetStringTypeW LCMapStringW

user32

CharLowerW CharUpperW MessageBeep ExitWindowsEx CharToOemBuffW CharToOemA OemToCharBuffA OemToCharA LoadStringW

advapi32

FreeSid AllocateAndInitializeSid RegQueryValueExW RegOpenKeyExW RegCloseKey LookupPrivilegeValueW SetFileSecurityW AdjustTokenPrivileges OpenProcessToken CheckTokenMembership

shell32

SHGetSpecialFolderLocation SHGetPathFromIDListW SHGetMalloc

powrprof

SetSuspendState

Name

.text

Size

267KB

Virtual Size

266KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

72KB

Virtual Size

72KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

11KB

Virtual Size

100KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

11KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

31KB

Virtual Size

30KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

1.2MB

Virtual Size

1.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-09_0f386dfdb41b006db2517c6419097066_icedid_mespinoza_njrat_ryuk

kernel32

user32

advapi32

shell32

powrprof

generic