2026-08-18_f4bcbbb5e731575979afe2de2a60f67d_icedid_mespinoza_njrat_ryuk

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-18_f4bcbbb5e731575979afe2de2a60f67d_icedid_mespinoza_njrat_ryuk
Size 1.5MB
Sample260818-txf6wsdp71
SHA256 6413206dca0e63d1d8e23daa2a85c86b7f36c2b1765ec69686fdf9df9b1aaca1
MD5 f4bcbbb5e731575979afe2de2a60f67d
SHA1 d923c08e80c0c681b9d7135459ee890d7e795a0e
SHA512 46ca606d33df5f4cec44ba6db4271e1be3ac19cb11b0f84f83a348a47c5907a0b85f93cfb9fe594b70348d5fdb24d9956cfd8414850bfc3728fdc5063c0cdc14
SSDEEP 12288:0yVOd/2mcJAmfPNsA9LDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyu:0y+3cSmf1sAiNyBo4kx929bL3Hnx
TLSH
T1E775CF0163E801A9F5F7AA7899F68526DA337C855F38C68E0354416A1FB3F91CD39B23
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-18_f4bcbbb5e731575979afe2de2a60f67d_icedid_mespinoza_njrat_ryuk

File Explorer

2026-08-18_f4bcbbb5e731575979afe2de2a60f67d_icedid_mespinoza_njrat_ryuk

.exe 1.5MB

2026-08-18_f4bcbbb5e731575979afe2de2a60f67d_icedid_mespinoza_njrat_ryuk

IMPHASH b45ae68bf62b66c621cb702832e4dcdf
SHA256 6413206dca0e63d1d8e23daa2a85c86b7f36c2b1765ec69686fdf9df9b1aaca1
MD5 f4bcbbb5e731575979afe2de2a60f67d
SHA1 d923c08e80c0c681b9d7135459ee890d7e795a0e
SHA512 46ca606d33df5f4cec44ba6db4271e1be3ac19cb11b0f84f83a348a47c5907a0b85f93cfb9fe594b70348d5fdb24d9956cfd8414850bfc3728fdc5063c0cdc14
SSDEEP 12288:0yVOd/2mcJAmfPNsA9LDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyu:0y+3cSmf1sAiNyBo4kx929bL3Hnx
TLSH
T1E775CF0163E801A9F5F7AA7899F68526DA337C855F38C68E0354416A1FB3F91CD39B23
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

105612

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

f:\BluetoothDrvWin10RS3.22\sw\src\Maglev_10_0_rs3\App\Bin\x64\Release\AdminService.pdb

bluetoothapis

BluetoothSetLocalServiceInfo BluetoothFindRadioClose BluetoothGetRadioInfo BluetoothFindFirstRadio

ole32

StringFromGUID2 CLSIDFromString

shlwapi

StrCmpW PathRemoveFileSpecW

cfgmgr32

CM_Get_DevNode_Status_Ex CM_Get_Device_ID_ExW CM_Disconnect_Machine CM_Locate_DevNode_ExW CM_Connect_MachineW CM_Get_DevNode_Status CM_Get_Next_Res_Des_Ex CM_Get_Res_Des_Data_Ex CM_Get_First_Log_Conf_Ex CM_Get_Res_Des_Data_Size_Ex CM_Free_Res_Des_Handle CM_Free_Log_Conf_Handle CM_Reenumerate_DevNode_Ex

setupapi

SetupDiGetClassDevsW SetupDiGetDeviceInterfaceDetailW SetupDiCreateDeviceInfoW SetupDiGetClassDescriptionExW SetupDiBuildClassInfoListExW SetupDiClassGuidsFromNameExW SetupDiSetDeviceRegistryPropertyW SetupDiEnumDeviceInterfaces SetupDiGetClassDevsExW SetupDiSetClassInstallParamsW SetupDiGetDeviceInfoListDetailW SetupDiCallClassInstaller SetupDiGetINFClassW SetupDiCreateDeviceInfoList SetupDiEnumDeviceInfo SetupDiDestroyDeviceInfoList SetupDiGetDeviceInstallParamsW SetupDiGetDriverInstallParamsW SetupFindFirstLineW SetupDiSetDeviceInstallParamsW SetupOpenInfFileW SetupGetStringFieldW SetupDiBuildDriverInfoList SetupDiGetDriverInfoDetailW SetupDiEnumDriverInfoW SetupDiDestroyDriverInfoList SetupCloseInfFile SetupDiOpenDeviceInfoW SetupDiGetDeviceRegistryPropertyW SetupDiCreateDeviceInfoListExW SetupDiClassNameFromGuidExW SetupCopyOEMInfW SetupDiOpenClassRegKeyExW

powrprof

CallNtPowerInformation

kernel32

GetACP GetCommandLineW GetCommandLineA GetStdHandle MultiByteToWideChar GetModuleHandleExW SetLastError RtlUnwindEx LoadLibraryExW TlsFree TlsSetValue ReadFile FindFirstFileW SetLocalTime GetCurrentProcess SetDynamicTimeZoneInformation DeviceIoControl GetModuleFileNameW FindClose WaitForSingleObject CreateFileW OpenEventW ResumeThread CreateEventW GetExitCodeThread Sleep GetLastError OutputDebugStringW SetEvent FileTimeToSystemTime TerminateThread GetEnvironmentStringsW DeleteFileW GlobalFree CloseHandle LoadLibraryW CreateThread ResetEvent GetLocalTime GetProcAddress GlobalLock ExitProcess SystemTimeToFileTime GetModuleHandleW GetTickCount GlobalUnlock GetFullPathNameW FindNextFileW lstrlenW GetFileAttributesW GetWindowsDirectoryW SizeofResource HeapFree GetSystemPowerStatus InitializeCriticalSectionEx GetVersionExW HeapSize GetPrivateProfileStringW LockResource HeapReAlloc RaiseException FindResourceExW LoadResource FindResourceW HeapAlloc HeapDestroy DeleteCriticalSection GetProcessHeap GetPrivateProfileSectionW GetNativeSystemInfo FormatMessageW LocalFree GetDateFormatW WideCharToMultiByte WriteFile GetCurrentThreadId GetCurrentProcessId TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount EncodePointer RtlPcToFileHeader InitializeSListHead GetSystemTimeAsFileTime QueryPerformanceCounter GetStartupInfoW IsDebuggerPresent IsProcessorFeaturePresent FreeEnvironmentStringsW SetEnvironmentVariableA SetEnvironmentVariableW GetFileType CompareStringW LCMapStringW GetStringTypeW GetExitCodeProcess CreateProcessA GetFileAttributesExW FindFirstFileExW IsValidCodePage GetOEMCP FreeLibrary GetCPInfo SetStdHandle FlushFileBuffers GetConsoleCP GetConsoleMode SetFilePointerEx WriteConsoleW GlobalAlloc TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext WaitForSingleObjectEx EnterCriticalSection LeaveCriticalSection

user32

DispatchMessageW GetMessageW TranslateMessage CharPrevW UnregisterDeviceNotification LoadStringW RegisterDeviceNotificationW PostThreadMessageW CharNextW

advapi32

RegEnumValueW OpenServiceW RegDeleteValueW StartServiceCtrlDispatcherW RegQueryValueExA RegOpenKeyExA InitiateSystemShutdownExW QueryServiceStatus RegDeleteKeyExW RegEnumKeyExW LookupPrivilegeValueW RegisterServiceCtrlHandlerExW AdjustTokenPrivileges CreateServiceW RegCloseKey RegQueryInfoKeyW CloseServiceHandle OpenSCManagerW SetServiceStatus ChangeServiceConfig2W RegCreateKeyExW DeleteService ControlService RegDeleteTreeW RegSetValueExW OpenProcessToken StartServiceW RegOpenKeyExW RegGetValueW RegQueryValueExW

shell32

ShellExecuteW SHGetSpecialFolderPathW

version

VerQueryValueW GetFileVersionInfoSizeW GetFileVersionInfoW

Name

.text

Size

194KB

Virtual Size

193KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

98KB

Virtual Size

98KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

10KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.gfids

Size

512B

Virtual Size

236B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

47KB

Virtual Size

46KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

1.2MB

Virtual Size

1.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-18_f4bcbbb5e731575979afe2de2a60f67d_icedid_mespinoza_njrat_ryuk

bluetoothapis

ole32

shlwapi

cfgmgr32

setupapi

powrprof

kernel32

user32

advapi32

shell32

version

generic