2026-08-15_5af91639532c0915eee4e5c0e011ec79_icedid_mespinoza_njrat

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-15_5af91639532c0915eee4e5c0e011ec79_icedid_mespinoza_njrat
Size 1.5MB
Sample260815-2f7araaa65
SHA256 08de4a31f0231eba0cf9b9d7fc79eb634e4123f2909b5dd24548a8a5346bdf75
MD5 5af91639532c0915eee4e5c0e011ec79
SHA1 fe165072731d3c6627913097e055beceb0b4b09d
SHA512 da713d12763931220d25346e0855b729a6c092106f23a8cd6a5485eca36543784966fa03105af4a1f4f7c6f9e682cbfa4042e1511127b415af99a027a8f6e654
SSDEEP 12288:j8HoJCWE67jH5IXOm2rcEoeMTRBduCyvhYlkjV21xCy8wJ8ZTC:j8I26ue3oEeTQCo+681EHxC
TLSH
T17175F105B2B41CF5E97B823EC9968615F6727C020B21CBDF0364466A1F77AE19D3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-15_5af91639532c0915eee4e5c0e011ec79_icedid_mespinoza_njrat

File Explorer

2026-08-15_5af91639532c0915eee4e5c0e011ec79_icedid_mespinoza_njrat

.exe 1.5MB

2026-08-15_5af91639532c0915eee4e5c0e011ec79_icedid_mespinoza_njrat

IMPHASH f36e9b9e73e4d459d0c35f73b59dd693
SHA256 08de4a31f0231eba0cf9b9d7fc79eb634e4123f2909b5dd24548a8a5346bdf75
MD5 5af91639532c0915eee4e5c0e011ec79
SHA1 fe165072731d3c6627913097e055beceb0b4b09d
SHA512 da713d12763931220d25346e0855b729a6c092106f23a8cd6a5485eca36543784966fa03105af4a1f4f7c6f9e682cbfa4042e1511127b415af99a027a8f6e654
SSDEEP 12288:j8HoJCWE67jH5IXOm2rcEoeMTRBduCyvhYlkjV21xCy8wJ8ZTC:j8I26ue3oEeTQCo+681EHxC
TLSH
T17175F105B2B41CF5E97B823EC9968615F6727C020B21CBDF0364466A1F77AE19D3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

71796

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\chunyung.RTDOMAIN\Documents\Visual Studio 2008\Projects\RtkAudioService_88\x64\Release\RtkAudioService.pdb

setupapi

SetupDiGetDeviceInterfaceDetailW SetupDiDestroyDeviceInfoList SetupDiGetDeviceRegistryPropertyW CM_Get_Res_Des_Data_Size CM_Get_Next_Res_Des CM_Free_Res_Des_Handle CM_Get_Device_IDW CM_Get_First_Log_Conf CM_Get_Res_Des_Data CM_Get_DevNode_Status SetupDiEnumDeviceInterfaces SetupDiGetClassDevsW SetupDiEnumDeviceInfo SetupDiGetDeviceInstanceIdW CM_Get_Parent

kernel32

HeapFree InitializeCriticalSectionAndSpinCount HeapSize GetLastError HeapReAlloc RaiseException HeapAlloc HeapDestroy DeleteCriticalSection GetProcessHeap SizeofResource DeviceIoControl WaitForSingleObject CreateFileW OpenProcess CreateToolhelp32Snapshot GetExitCodeThread ProcessIdToSessionId Process32NextW LockResource Process32FirstW CloseHandle FindResourceExW LoadResource FindResourceW GetConsoleMode WTSGetActiveConsoleSessionId CreateProcessW GetModuleHandleW MultiByteToWideChar WaitForMultipleObjects CreateEventW SetEvent CreateThread ResetEvent GetSystemDirectoryW Sleep LoadLibraryW FreeLibrary SetWaitableTimer EnterCriticalSection CreateWaitableTimerW LeaveCriticalSection LocalAlloc CancelWaitableTimer LocalFree GetConsoleCP FlushFileBuffers ReadConsoleW ReadFile CompareStringW LCMapStringW FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetProcAddress GetOEMCP SetEndOfFile WriteConsoleW SetFilePointerEx SetStdHandle SetEnvironmentVariableW GetStringTypeW FreeEnvironmentStringsW GetEnvironmentStringsW GetCPInfo GetFileType GetACP GetCommandLineW GetCommandLineA WriteFile GetStdHandle GetModuleFileNameW GetSystemInfo VirtualProtect VirtualQuery LoadLibraryExA GetCurrentThreadId DuplicateHandle GetCurrentProcess IsDebuggerPresent OutputDebugStringW WaitForSingleObjectEx RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent GetStartupInfoW QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime InitializeSListHead WideCharToMultiByte RtlPcToFileHeader EncodePointer TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW RtlUnwindEx SetLastError ExitProcess GetModuleHandleExW

user32

RegisterDeviceNotificationW UnregisterDeviceNotification

advapi32

SetServiceStatus RegCreateKeyExW RegSetValueExW StartServiceCtrlDispatcherW RegNotifyChangeKeyValue LookupPrivilegeValueW AdjustTokenPrivileges RegCloseKey SetTokenInformation OpenProcessToken RegOpenKeyExW CreateProcessAsUserW DuplicateTokenEx RegQueryValueExW RegisterServiceCtrlHandlerExW

shell32

SHGetFolderPathW

ole32

CoTaskMemFree PropVariantClear CoSetProxyBlanket CoInitializeSecurity CoInitializeEx StringFromGUID2 CoCreateInstance CoUninitialize

oleaut32

VariantInit SysFreeString SysAllocString SafeArrayUnaccessData SafeArrayAccessData VariantChangeType VariantClear

Name

.text

Size

156KB

Virtual Size

156KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

71KB

Virtual Size

71KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

9KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gfids

Size

512B

Virtual Size

228B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1.3MB

Virtual Size

1.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-15_5af91639532c0915eee4e5c0e011ec79_icedid_mespinoza_njrat

setupapi

kernel32

user32

advapi32

shell32

ole32

oleaut32

generic