2026-08-22_8104b46f440e9ff45ae426968ab3855f_icedid_mespinoza_njrat

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-22_8104b46f440e9ff45ae426968ab3855f_icedid_mespinoza_njrat
Size 1.7MB
Sample260823-glb2ksem5v
SHA256 6f5eefb639c590269b30f65837baf3c93abd83ff00d59d9f5f1de121c2a7fef0
MD5 8104b46f440e9ff45ae426968ab3855f
SHA1 6f9cf0adf6a4aad622520b2b7d6356e41e323149
SHA512 d964948ba5d6c1e7d8a7b44e6f43d29c62e7775ccedeb84c9a8726fb7b7a9f248646f9327c5be9f71ddfbcb0a3d3f23608299b92071d05607eb4538db089b9d7
SSDEEP 12288:88HoJ0WE67jHgyCJIzF2zwAy10JjnOhiD4msiXM4JuR7cMm53FtrpMFu:88Iw6RCaEzwAyujOhcid/RrmpF
TLSH
T12985F15673A80DF9E977823A8D928205E7B23C421B71CBDF1364426A1F376E19D3E721
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-22_8104b46f440e9ff45ae426968ab3855f_icedid_mespinoza_njrat

File Explorer

2026-08-22_8104b46f440e9ff45ae426968ab3855f_icedid_mespinoza_njrat

.exe 1.7MB

2026-08-22_8104b46f440e9ff45ae426968ab3855f_icedid_mespinoza_njrat

IMPHASH f36e9b9e73e4d459d0c35f73b59dd693
SHA256 6f5eefb639c590269b30f65837baf3c93abd83ff00d59d9f5f1de121c2a7fef0
MD5 8104b46f440e9ff45ae426968ab3855f
SHA1 6f9cf0adf6a4aad622520b2b7d6356e41e323149
SHA512 d964948ba5d6c1e7d8a7b44e6f43d29c62e7775ccedeb84c9a8726fb7b7a9f248646f9327c5be9f71ddfbcb0a3d3f23608299b92071d05607eb4538db089b9d7
SSDEEP 12288:88HoJ0WE67jHgyCJIzF2zwAy10JjnOhiD4msiXM4JuR7cMm53FtrpMFu:88Iw6RCaEzwAyujOhcid/RrmpF
TLSH
T12985F15673A80DF9E977823A8D928205E7B23C421B71CBDF1364426A1F376E19D3E721
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

71796

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\chunyung.RTDOMAIN\Documents\Visual Studio 2008\Projects\RtkAudioService_88\x64\Release\RtkAudioService.pdb

setupapi

SetupDiGetDeviceInterfaceDetailW SetupDiDestroyDeviceInfoList SetupDiGetDeviceRegistryPropertyW CM_Get_Res_Des_Data_Size CM_Get_Next_Res_Des CM_Free_Res_Des_Handle CM_Get_Device_IDW CM_Get_First_Log_Conf CM_Get_Res_Des_Data CM_Get_DevNode_Status SetupDiEnumDeviceInterfaces SetupDiGetClassDevsW SetupDiEnumDeviceInfo SetupDiGetDeviceInstanceIdW CM_Get_Parent

kernel32

HeapFree InitializeCriticalSectionAndSpinCount HeapSize GetLastError HeapReAlloc RaiseException HeapAlloc HeapDestroy DeleteCriticalSection GetProcessHeap SizeofResource DeviceIoControl WaitForSingleObject CreateFileW OpenProcess CreateToolhelp32Snapshot GetExitCodeThread ProcessIdToSessionId Process32NextW LockResource Process32FirstW CloseHandle FindResourceExW LoadResource FindResourceW GetConsoleMode WTSGetActiveConsoleSessionId CreateProcessW GetModuleHandleW MultiByteToWideChar WaitForMultipleObjects CreateEventW SetEvent CreateThread ResetEvent GetSystemDirectoryW Sleep LoadLibraryW FreeLibrary SetWaitableTimer EnterCriticalSection CreateWaitableTimerW LeaveCriticalSection LocalAlloc CancelWaitableTimer LocalFree GetConsoleCP FlushFileBuffers ReadConsoleW ReadFile CompareStringW LCMapStringW FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetProcAddress GetOEMCP SetEndOfFile WriteConsoleW SetFilePointerEx SetStdHandle SetEnvironmentVariableW GetStringTypeW FreeEnvironmentStringsW GetEnvironmentStringsW GetCPInfo GetFileType GetACP GetCommandLineW GetCommandLineA WriteFile GetStdHandle GetModuleFileNameW GetSystemInfo VirtualProtect VirtualQuery LoadLibraryExA GetCurrentThreadId DuplicateHandle GetCurrentProcess IsDebuggerPresent OutputDebugStringW WaitForSingleObjectEx RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent GetStartupInfoW QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime InitializeSListHead WideCharToMultiByte RtlPcToFileHeader EncodePointer TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW RtlUnwindEx SetLastError ExitProcess GetModuleHandleExW

user32

RegisterDeviceNotificationW UnregisterDeviceNotification

advapi32

SetServiceStatus RegCreateKeyExW RegSetValueExW StartServiceCtrlDispatcherW RegNotifyChangeKeyValue LookupPrivilegeValueW AdjustTokenPrivileges RegCloseKey SetTokenInformation OpenProcessToken RegOpenKeyExW CreateProcessAsUserW DuplicateTokenEx RegQueryValueExW RegisterServiceCtrlHandlerExW

shell32

SHGetFolderPathW

ole32

CoTaskMemFree PropVariantClear CoSetProxyBlanket CoInitializeSecurity CoInitializeEx StringFromGUID2 CoCreateInstance CoUninitialize

oleaut32

VariantInit SysFreeString SysAllocString SafeArrayUnaccessData SafeArrayAccessData VariantChangeType VariantClear

Name

.text

Size

156KB

Virtual Size

156KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

71KB

Virtual Size

71KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

9KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gfids

Size

512B

Virtual Size

228B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1.5MB

Virtual Size

1.5MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-22_8104b46f440e9ff45ae426968ab3855f_icedid_mespinoza_njrat

setupapi

kernel32

user32

advapi32

shell32

ole32

oleaut32

generic