2026-08-22_42279fc4dc4a3fb5254e1de750bf0926_cobalt-strike_icedid_mespinoza_njrat_ryuk

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-22_42279fc4dc4a3fb5254e1de750bf0926_cobalt-strike_icedid_mespinoza_njrat_ryuk
Size 506KB
Sample260823-lberyavfmf
SHA256 5f723ff6a508633edd88f43ea7743596c8aa400db29ae6b24549d94e97484148
MD5 42279fc4dc4a3fb5254e1de750bf0926
SHA1 c327985627e7f2356b42c1e358661f88163873e0
SHA512 5ee982fe20aaf55a85e424193bbe408143e38426507ab05c6725fd6fb4cc66336af9f6f49de95f2ff10a3cf2e7f10c4d62b0f834a3c782ca39969c24570aae78
SSDEEP 6144:NiBlwsmAQIPvTmaEVmP02yCUE+cw0wIceA4D55qv4t/uBmohChYgXP6RIedV+:NiBlwBAQIXqaE0yCgqwXeAVmoEAldU
TLSH
T1ECB46B58A75441E0D1B2C23888539947E67178018BB1DBDF12A8E73E2F77BE19D3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

2026-08-22_42279fc4dc4a3fb5254e1de750bf0926_cobalt-strike_icedid_mespinoza_njrat_ryuk

.exe 506KB

2026-08-22_42279fc4dc4a3fb5254e1de750bf0926_cobalt-strike_icedid_mespinoza_njrat_ryuk

IMPHASH 997697ab724741456c3bab642ada075e
SHA256 5f723ff6a508633edd88f43ea7743596c8aa400db29ae6b24549d94e97484148
MD5 42279fc4dc4a3fb5254e1de750bf0926
SHA1 c327985627e7f2356b42c1e358661f88163873e0
SHA512 5ee982fe20aaf55a85e424193bbe408143e38426507ab05c6725fd6fb4cc66336af9f6f49de95f2ff10a3cf2e7f10c4d62b0f834a3c782ca39969c24570aae78
SSDEEP 6144:NiBlwsmAQIPvTmaEVmP02yCUE+cw0wIceA4D55qv4t/uBmohChYgXP6RIedV+:NiBlwBAQIXqaE0yCgqwXeAVmoEAldU
TLSH
T1ECB46B58A75441E0D1B2C23888539947E67178018BB1DBDF12A8E73E2F77BE19D3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Digest

ab:c0:90:82:7e:4b:6e:b4:28:b4:b5:8e:e9:54:77:07:e0:26:6e:f7:81:4a:94:eb:45:74:1f:26:70:4c:dd:7a

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jul 29, 2022

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Digest

ab:c0:90:82:7e:4b:6e:b4:28:b4:b5:8e:e9:54:77:07:e0:26:6e:f7:81:4a:94:eb:45:74:1f:26:70:4c:dd:7a

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Intel Corporation,O=Intel Corporation,L=Santa Clara,ST=California,C=US

Chains

Jul 21, 2022

CN=Intel Corporation,O=Intel Corporation,L=Santa Clara,ST=California,C=US

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Subject

CN=Intel Corporation,O=Intel Corporation,L=Santa Clara,ST=California,C=US

Serial Number

63:f8:00:10:50:1d:2b:4b:6c:5f:d1:00:46:65:ff:e7

Issuer

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Mar 31, 2021 - Mar 31, 2023

Subject

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning, ExtKeyUsageTimeStamping

Timespan

Nov 2, 2018 - Dec 31, 2030

Subject

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Serial Number

33:00:00:00:44:b7:3f:fc:ef:5a:cf:a2:7a:00:00:00:00:00:44

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jul 22, 2015 - Jul 22, 2025

Subject

CN=Sectigo RSA Time Stamping Signer #3,O=Sectigo Limited,ST=Manchester,C=GB

Serial Number

90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 11, 2022 - Aug 10, 2033

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 2, 2019 - Jan 18, 2038

Subject

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:dc:34:1a:52:0f:bb:cf:3d:8c:00:00:00:00:00:dc

Issuer

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Mar 10, 2022 - Mar 8, 2023

Subject

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0b:aa:c1:00:00:00:00:00:09

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 18, 2012 - Apr 18, 2027

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft Operations Puerto Rico+OU=Thales TSS ESN:60BC-E383-2635,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:a6:59:45:83:39:4d:9e:eb:4b:00:01:00:00:01:a6

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 2, 2022 - May 11, 2023

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 30, 2021 - Sep 30, 2030

Minor OS version

Major OS version

Entry point

170336

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

d:\Workspace\nisraely\gitlab\cphs\IntelCpHeciSvc\x64\one_core_release_registry\IntelCpHeciSvc.pdb

api-ms-win-core-processenvironment-l1-1-0

GetEnvironmentStringsW FreeEnvironmentStringsW GetCommandLineW SetStdHandle ExpandEnvironmentStringsW GetCommandLineA GetStdHandle

api-ms-win-core-file-l1-1-0

CreateDirectoryW SetEndOfFile FlushFileBuffers SetFilePointerEx FindNextFileW FindFirstFileExW CreateFileW ReadFile WriteFile GetFileType FindClose

api-ms-win-core-errorhandling-l1-1-0

SetUnhandledExceptionFilter SetLastError UnhandledExceptionFilter RaiseException GetLastError

api-ms-win-core-profile-l1-1-0

QueryPerformanceFrequency QueryPerformanceCounter

api-ms-win-core-synch-l1-1-0

WaitForSingleObjectEx ResetEvent EnterCriticalSection InitializeCriticalSection LeaveCriticalSection TryEnterCriticalSection CreateEventW WaitForMultipleObjectsEx WaitForSingleObject SetEvent InitializeCriticalSectionAndSpinCount InitializeCriticalSectionEx DeleteCriticalSection

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcess TerminateProcess ResumeThread CreateThread GetStartupInfoW GetCurrentProcessId TlsFree TlsSetValue TlsAlloc GetCurrentThreadId ExitProcess OpenProcessToken TlsGetValue

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-processthreads-l1-1-1

OpenProcess IsProcessorFeaturePresent

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleExW LoadStringW GetProcAddress GetModuleFileNameW FreeLibrary LoadLibraryExW LoadResource SizeofResource GetModuleHandleW

api-ms-win-core-libraryloader-l1-2-1

FindResourceW

api-ms-win-core-string-obsolete-l1-1-0

lstrcmpiW

api-ms-win-core-string-l2-1-0

CharNextW CharUpperW

api-ms-win-core-string-l1-1-0

WideCharToMultiByte MultiByteToWideChar GetStringTypeW

api-ms-win-core-registry-l1-1-0

RegCloseKey RegOpenKeyExW RegCreateKeyExW RegQueryInfoKeyW RegQueryValueExW RegSetValueExA RegDeleteValueW RegQueryValueExA RegSetValueExW RegEnumKeyExW

api-ms-win-core-registry-l2-1-0

RegDeleteKeyW

api-ms-win-core-com-l1-1-0

CoResumeClassObjects CoAddRefServerProcess CoReleaseServerProcess CoTaskMemAlloc CoCreateInstance StringFromGUID2 CoTaskMemFree CoInitializeSecurity CoUninitialize CoInitializeEx CoTaskMemRealloc CoRevokeClassObject CoRegisterClassObject

oleaut32

SysStringLen SysFreeString LoadRegTypeLi VarUI4FromStr SafeArrayCreate SafeArrayDestroy SafeArrayRedim SafeArrayGetUBound SafeArrayGetLBound RegisterTypeLi SysAllocString SafeArrayLock SafeArrayUnlock SafeArrayCopy SafeArrayGetVartype VariantInit VariantClear LoadTypeLi

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-sysinfo-l1-1-0

GetVersionExW GetSystemTimeAsFileTime

api-ms-win-devices-config-l1-1-1

CM_Unregister_Notification CM_Get_Device_Interface_ListW CM_Register_Notification CM_Get_Device_Interface_List_SizeW

api-ms-win-core-io-l1-1-0

DeviceIoControl GetOverlappedResult

api-ms-win-core-util-l1-1-0

DecodePointer EncodePointer

api-ms-win-core-heap-l1-1-0

HeapAlloc HeapFree GetProcessHeap HeapReAlloc HeapSize

api-ms-win-security-base-l1-1-0

GetSecurityDescriptorLength MakeAbsoluteSD AdjustTokenPrivileges

api-ms-win-core-heap-l2-1-0

LocalFree

api-ms-win-security-lsalookup-l2-1-0

LookupPrivilegeValueW

api-ms-win-service-management-l2-1-0

ChangeServiceConfigW QueryServiceConfigW

api-ms-win-service-management-l1-1-0

OpenServiceW CloseServiceHandle CreateServiceW DeleteService OpenSCManagerW

api-ms-win-service-winsvc-l1-1-0

ControlService

api-ms-win-service-core-l1-1-0

SetServiceStatus StartServiceCtrlDispatcherW RegisterServiceCtrlHandlerExW

api-ms-win-security-sddl-l1-1-0

ConvertStringSecurityDescriptorToSecurityDescriptorW

user32

DispatchMessageW TranslateMessage GetMessageW PostThreadMessageW

api-ms-win-core-localization-l1-2-0

IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetCPInfo GetLocaleInfoW LCMapStringW GetOEMCP GetACP IsValidCodePage

api-ms-win-core-rtlsupport-l1-1-0

RtlVirtualUnwind RtlUnwindEx RtlPcToFileHeader RtlLookupFunctionEntry RtlCaptureContext

api-ms-win-core-debug-l1-1-0

IsDebuggerPresent OutputDebugStringW

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

api-ms-win-core-console-l1-1-0

WriteConsoleW GetConsoleCP GetConsoleMode ReadConsoleW

Name

.text

Size

300KB

Virtual Size

300KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

148KB

Virtual Size

147KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

8KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

16KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-22_42279fc4dc4a3fb5254e1de750bf0926_cobalt-strike_icedid_mespinoza_njrat_ryuk

api-ms-win-core-processenvironment-l1-1-0

api-ms-win-core-file-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-processthreads-l1-1-1

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-libraryloader-l1-2-1

api-ms-win-core-string-obsolete-l1-1-0

api-ms-win-core-string-l2-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-registry-l1-1-0

api-ms-win-core-registry-l2-1-0

api-ms-win-core-com-l1-1-0

oleaut32

api-ms-win-core-synch-l1-2-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-devices-config-l1-1-1

api-ms-win-core-io-l1-1-0

api-ms-win-core-util-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-security-base-l1-1-0

api-ms-win-core-heap-l2-1-0

api-ms-win-security-lsalookup-l2-1-0

api-ms-win-service-management-l2-1-0

api-ms-win-service-management-l1-1-0

api-ms-win-service-winsvc-l1-1-0

api-ms-win-service-core-l1-1-0

api-ms-win-security-sddl-l1-1-0

user32

api-ms-win-core-localization-l1-2-0

api-ms-win-core-rtlsupport-l1-1-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-interlocked-l1-1-0

api-ms-win-core-console-l1-1-0

generic