2026-08-20_2133b647e2921af8fde53aaf6b26729d_icedid_mespinoza_njrat_ryuk

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-20_2133b647e2921af8fde53aaf6b26729d_icedid_mespinoza_njrat_ryuk
Size 5.8MB
Sample260821-a5secazbla
SHA256 d53351155e1ade3fb66aca16c351ddd0ea7cc0b547aaa1df8c992665c395c901
MD5 2133b647e2921af8fde53aaf6b26729d
SHA1 d4bbc505fab0684c03e29130f02a8107d82085bf
SHA512 7374786bb3915b0ac7885d5bad6ab4e2e526b22356529f7b9065501d5e38573c6a0c05a2238d553f3cabc70080b5ab936b2de5fd74a827909dd662a61684d1fe
SSDEEP 49152:brattcXIsfbyOMYzQTQJHqMw7QuIibdvPFw4FbMcWtSWq8thDL2tsUClADzQ1mxi:2WCwitOqwiE77
TLSH
T18856B41BA36A21E5C17BC03C95935B22FC6130E9473967E75681866A2B70FF8BD3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-20_2133b647e2921af8fde53aaf6b26729d_icedid_mespinoza_njrat_ryuk

File Explorer

2026-08-20_2133b647e2921af8fde53aaf6b26729d_icedid_mespinoza_njrat_ryuk

.exe 5.8MB

2026-08-20_2133b647e2921af8fde53aaf6b26729d_icedid_mespinoza_njrat_ryuk

IMPHASH ee6a55e192ac11c086649fdb404f1dcb
SHA256 d53351155e1ade3fb66aca16c351ddd0ea7cc0b547aaa1df8c992665c395c901
MD5 2133b647e2921af8fde53aaf6b26729d
SHA1 d4bbc505fab0684c03e29130f02a8107d82085bf
SHA512 7374786bb3915b0ac7885d5bad6ab4e2e526b22356529f7b9065501d5e38573c6a0c05a2238d553f3cabc70080b5ab936b2de5fd74a827909dd662a61684d1fe
SSDEEP 49152:brattcXIsfbyOMYzQTQJHqMw7QuIibdvPFw4FbMcWtSWq8thDL2tsUClADzQ1mxi:2WCwitOqwiE77
TLSH
T18856B41BA36A21E5C17BC03C95935B22FC6130E9473967E75681866A2B70FF8BD3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

3680592

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\source\repo\engine\trunk\db\norm\compiler-test\build\windows_clang_x86_64_Debug\test\Debug\compiler_test_1\compiler_test_1.pdb

shell32

SHGetKnownFolderPath

ole32

CoTaskMemFree

kernel32

AcquireSRWLockExclusive AreFileApisANSI CloseHandle CompareStringEx CompareStringW CopyFile2 CreateDirectoryExW CreateDirectoryW CreateEventA CreateFile2 CreateFileA CreateFileW CreateHardLinkW CreatePipe CreateProcessA CreateSymbolicLinkW DecodePointer DeleteCriticalSection DeviceIoControl EncodePointer EnterCriticalSection EnumSystemLocalesW ExitProcess FindClose FindFirstFileExW FindFirstFileW FindNextFileW FlsAlloc FlsFree FlsGetValue FlsSetValue FlushFileBuffers FlushProcessWriteBuffers FormatMessageA FreeEnvironmentStringsW FreeLibrary GetACP GetCPInfo GetCommandLineA GetCommandLineW GetConsoleMode GetConsoleOutputCP GetCurrentDirectoryW GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetDateFormatW GetDiskFreeSpaceExA GetDiskFreeSpaceExW GetEnvironmentStringsW GetExitCodeProcess GetFileAttributesExA GetFileAttributesExW GetFileAttributesW GetFileInformationByHandle GetFileInformationByHandleEx GetFileSizeEx GetFileType GetFinalPathNameByHandleW GetFullPathNameW GetLastError GetLocaleInfoEx GetLocaleInfoW GetLogicalDriveStringsA GetModuleFileNameA GetModuleFileNameW GetModuleHandleExW GetModuleHandleW GetOEMCP GetProcAddress GetProcessHeap GetStartupInfoW GetStdHandle GetStringTypeW GetSystemInfo GetSystemTimeAsFileTime GetTempPathW GetTickCount64 GetTimeFormatW GetTimeZoneInformation GetUserDefaultLCID GetVolumeInformationA GetVolumeInformationByHandleW HeapAlloc HeapFree HeapQueryInformation HeapReAlloc HeapSize HeapValidate InitializeCriticalSectionEx InitializeSListHead InterlockedFlushSList InterlockedPushEntrySList IsDebuggerPresent IsProcessorFeaturePresent IsThreadAFiber IsValidCodePage IsValidLocale LCMapStringEx LCMapStringW LeaveCriticalSection LoadLibraryExW LocalFree MoveFileExW MultiByteToWideChar OutputDebugStringA OutputDebugStringW PeekNamedPipe QueryPerformanceCounter RaiseException ReadConsoleW ReadFile ReleaseSRWLockExclusive RtlCaptureContext RtlCaptureStackBackTrace RtlLookupFunctionEntry RtlPcToFileHeader RtlUnwind RtlUnwindEx RtlVirtualUnwind SetConsoleCtrlHandler SetCurrentDirectoryW SetEndOfFile SetEnvironmentVariableA SetEnvironmentVariableW SetFileAttributesW SetFileInformationByHandle SetFilePointerEx SetFileTime SetHandleInformation SetLastError SetStdHandle SetUnhandledExceptionFilter SleepConditionVariableSRW TerminateProcess UnhandledExceptionFilter VirtualAllocEx VirtualFreeEx VirtualProtect WaitForSingleObject WakeAllConditionVariable WideCharToMultiByte WriteConsoleW WriteFile

bcrypt

BCryptGenRandom

Name

.text

Size

4.3MB

Virtual Size

4.3MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.1MB

Virtual Size

1.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

27KB

Virtual Size

35KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

369KB

Virtual Size

369KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_RDATA

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_guard_c

Size

512B

Virtual Size

36B

Characteristics

Name

_guard_d

Size

512B

Virtual Size

36B

Characteristics

Name

memcmp_

Size

512B

Virtual Size

88B

Characteristics

Name

memcpy_

Size

512B

Virtual Size

332B

Characteristics

Name

memset_

Size

512B

Virtual Size

120B

Characteristics

Name

.rsrc

Size

512B

Virtual Size

464B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-20_2133b647e2921af8fde53aaf6b26729d_icedid_mespinoza_njrat_ryuk

shell32

ole32

kernel32

bcrypt

generic