2026-01-16_5bb6bb5fc213e78cfa3d8146523d7252_icedid_mespinoza_njrat_ryuk[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
2026-01-16_5bb6bb5fc213e78cfa3d8146523d7252_icedid_mespinoza_njrat_ryuk.exe
Size 1.3MB
Sample260821-ej488ssdld
SHA256 d67055907f937caaafc4a9e8f9487bf06a889e1ab7690f4775c9561efb6af551
MD5 5a96fa7e6d63728235664d0b2f741af0
SHA1 380f99f8dc471d4f6f81d34a85a5304389489447
SHA512 a0caa077e482c9b1db3b3590ff192cca44f2bbe931d1cff24496567f340ca3b80d2e48cebe74066b596398d0e47a9bba9511fd8989b9c4b041bd13979c41f054
SSDEEP 24576:1pJb8iKeI6gKTMTJ4+6Ij7SEdId40/J0s6:r5/bIMyt6CWEmdd/o
TLSH
T1E4556B5637A481F9E1BAD17989B2814AE7B274415F31C7CF02A8475E2F37AE04D3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-01-16_5bb6bb5fc213e78cfa3d8146523d7252_icedid_mespinoza_njrat_ryuk.exe

File Explorer

2026-01-16_5bb6bb5fc213e78cfa3d8146523d7252_icedid_mespinoza_njrat_ryuk.exe

.exe 1.3MB

2026-01-16_5bb6bb5fc213e78cfa3d8146523d7252_icedid_mespinoza_njrat_ryuk.exe

IMPHASH b5def8c6f62b3acd2336f9199986a428
SHA256 d67055907f937caaafc4a9e8f9487bf06a889e1ab7690f4775c9561efb6af551
MD5 5a96fa7e6d63728235664d0b2f741af0
SHA1 380f99f8dc471d4f6f81d34a85a5304389489447
SHA512 a0caa077e482c9b1db3b3590ff192cca44f2bbe931d1cff24496567f340ca3b80d2e48cebe74066b596398d0e47a9bba9511fd8989b9c4b041bd13979c41f054
SSDEEP 24576:1pJb8iKeI6gKTMTJ4+6Ij7SEdId40/J0s6:r5/bIMyt6CWEmdd/o
TLSH
T1E4556B5637A481F9E1BAD17989B2814AE7B274415F31C7CF02A8475E2F37AE04D3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

511112

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

E:\B\T\fb964cf2-fefc-470c-b7fb-c148f2b594bd\UBF_1\build\x64\Release\PEFService.pdb

wintrust

WinVerifyTrust

psapi

EnumProcessModules GetModuleInformation GetModuleFileNameExW

kernel32

VerifyVersionInfoW CreateToolhelp32Snapshot Process32FirstW Process32NextW GetExitCodeProcess GetSystemDefaultLocaleName QueryFullProcessImageNameW InitializeSRWLock ReleaseSRWLockExclusive ReleaseSRWLockShared AcquireSRWLockExclusive AcquireSRWLockShared CreateThread OpenProcess GetWindowsDirectoryW GlobalFindAtomW SystemTimeToFileTime LoadLibraryW LockFileEx UnlockFileEx GlobalAddAtomW CopyFileW MoveFileW MoveFileExW ReplaceFileW DeleteFileA SetFileAttributesA GetTempPathA GetTempFileNameA CreateWaitableTimerW SetWaitableTimer FreeLibrary GetTickCount64 GetCurrentProcess GetFileSizeEx OpenMutexW SetPriorityClass TerminateThread VerSetConditionMask lstrlenW LocalFree LocalAlloc WritePrivateProfileStringW WritePrivateProfileStructW FindNextFileW CreateDirectoryW GetCurrentDirectoryW MultiByteToWideChar FormatMessageW LoadLibraryExW GetLocalTime GetFileAttributesW OutputDebugStringW FindFirstFileW SetFilePointer WriteFile FindClose SetLastError GetCurrentProcessId GetCurrentThreadId WideCharToMultiByte FindResourceExW FindResourceW LoadResource LockResource SizeofResource GetModuleFileNameW VirtualQuery InitializeCriticalSectionAndSpinCount GetModuleHandleExW LeaveCriticalSection EnterCriticalSection InitializeCriticalSection ResetEvent SetEvent OpenEventW CreateEventW ReleaseMutex WaitForSingleObject CreateMutexW WaitForSingleObjectEx GetProcessHeap DeleteCriticalSection HeapDestroy GlobalFree GlobalAlloc GetSystemDirectoryW SetEnvironmentVariableW SetEnvironmentVariableA FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP DecodePointer IsValidCodePage FindFirstFileExW SetEndOfFile WriteConsoleW FlushFileBuffers GetTimeZoneInformation GetFileAttributesExW CreateProcessW SetStdHandle EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetTimeFormatW HeapAlloc RaiseException HeapReAlloc GetLastError HeapSize InitializeCriticalSectionEx HeapFree CreateFileW DeleteFileW WaitForMultipleObjectsEx CloseHandle GetProcAddress GetModuleHandleW Sleep CancelWaitableTimer GetSystemInfo VirtualProtect LoadLibraryExA IsDebuggerPresent RtlPcToFileHeader EncodePointer TryEnterCriticalSection DuplicateHandle GetCurrentThread GetExitCodeThread GetStringTypeW QueryPerformanceCounter QueryPerformanceFrequency TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemTimeAsFileTime GetTickCount GetCPInfo CompareStringW LCMapStringW GetLocaleInfoW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent GetStartupInfoW InitializeSListHead CreateTimerQueue SignalObjectAndWait SwitchToThread SetThreadPriority GetThreadPriority GetLogicalProcessorInformation CreateTimerQueueTimer ChangeTimerQueueTimer DeleteTimerQueueTimer GetNumaHighestNodeNumber GetProcessAffinityMask SetThreadAffinityMask RegisterWaitForSingleObject UnregisterWait GetThreadTimes FreeLibraryAndExitThread GetModuleHandleA GetVersionExW VirtualAlloc VirtualFree ReleaseSemaphore InterlockedPopEntrySList InterlockedPushEntrySList InterlockedFlushSList QueryDepthSList UnregisterWaitEx RtlUnwindEx ExitThread GetFileType SetFilePointerEx ReadFile GetConsoleMode ReadConsoleW GetConsoleCP ExitProcess GetStdHandle GetCommandLineA GetCommandLineW GetACP GetDateFormatW

user32

UnregisterPowerSettingNotification RegisterPowerSettingNotification wsprintfW

advapi32

AddAccessDeniedAce GetLengthSid IsValidSid InitializeAcl EqualSid AllocateAndInitializeSid OpenProcessToken LookupAccountSidW RegQueryInfoKeyW RegSetValueExW StartServiceCtrlDispatcherW RegisterServiceCtrlHandlerExW SetServiceStatus UnregisterTraceGuids TraceEvent RegisterTraceGuidsW GetTraceLoggerHandle GetTraceEnableLevel GetTraceEnableFlags RegQueryValueExA RegSetValueExA FreeSid AddAccessAllowedAce SetSecurityDescriptorDacl GetSecurityDescriptorDacl CryptSetProvParam CryptAcquireContextW CryptEncrypt SetEntriesInAclW CryptDecrypt ConvertStringSidToSidW CryptCreateHash CryptDestroyHash InitializeSecurityDescriptor CryptImportKey CryptGetProvParam CryptReleaseContext CryptDestroyKey CryptExportKey CryptGenKey RegEnumValueW OpenServiceW OpenSCManagerW StartServiceW QueryServiceStatusEx CloseServiceHandle RegDeleteValueA RegOpenKeyExA RegSetKeySecurity RegQueryValueExW RegOpenKeyExW RegNotifyChangeKeyValue RegGetKeySecurity RegFlushKey RegEnumKeyExW RegDeleteValueW RegDeleteKeyW RegCreateKeyExW RegCloseKey GetTokenInformation

shell32

SHGetKnownFolderPath SHCreateDirectoryExW

ole32

CoSetProxyBlanket CoGetClassObject CoCreateInstance StringFromGUID2 CLSIDFromString CoUninitialize CoInitializeEx CoTaskMemFree

oleaut32

VariantClear SysAllocStringByteLen SysStringLen SysAllocString SysFreeString VariantInit

shlwapi

PathFindExtensionW PathStripToRootW PathRemoveFileSpecW PathAppendW PathAddExtensionA PathFileExistsA PathFindFileNameA PathFileExistsW PathRemoveExtensionA PathRemoveFileSpecA SHDeleteKeyW

crypt32

CryptMsgOpenToDecode CryptMsgClose CryptMsgUpdate CryptMsgGetParam CertCloseStore CertGetSubjectCertificateFromStore CertFreeCertificateContext CertGetCertificateContextProperty CertGetNameStringW CryptQueryObject CertGetCertificateChain CertFreeCertificateChain CertVerifyCertificateChainPolicy CryptDecodeObject

Name

.text

Size

852KB

Virtual Size

851KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

357KB

Virtual Size

357KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

22KB

Virtual Size

35KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

51KB

Virtual Size

51KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.gfids

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

24KB

Virtual Size

24KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

generic

count=13, id=241, version=40116,

count=184, id=243, version=40116,

count=27, id=242, version=40116,

count=1, id=208, version=65501,

count=1, id=199, version=41118,

count=8, id=259, version=24123,

count=43, id=260, version=24123,

count=2, id=261, version=23013,

count=1, id=209, version=65501,

count=1, id=206, version=65501,

count=359, id=1, productName=Unmarked objects,

count=23, id=203, version=65501,

count=130, id=261, version=24123,

count=2, id=260, productName=VS2015 UPD3.1 build 24215, version=24215,

count=41, id=261, productName=VS2015 UPD3.1 build 24215, version=24215,

count=77, id=265, version=24215,

count=1, id=255, productName=VS2015 UPD3 build 24210, version=24210,

count=1, id=151,

count=1, id=258, productName=VS2015 UPD3.1 build 24215, version=24215,