2026-08-23_5fa6e16c6173c663117f6d7a135602df_icedid_mespinoza_njrat_ryuk_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-23_5fa6e16c6173c663117f6d7a135602df_icedid_mespinoza_njrat_ryuk_vidar
Size 1.9MB
Sample260824-msdfwassas
SHA256 32644b1b94738d1dc07b8b524d1d7c7bcec4802df444f25ef95818a9fdf66590
MD5 5fa6e16c6173c663117f6d7a135602df
SHA1 500e7707a04e34ca75db03c6459ec89af17d2d59
SHA512 66cc8d7b4520edbc0e65e43c1ca0fa747068d5cc38c8f1c2f17e2e5e9f55ca44de5fef422f421d45b74768791977e8c84197f5e1133257e500c33ca4f9024387
SSDEEP 24576:pYRM7Y2cb+cREoYz7KEMdX6keYnAcerW:6+LcnRBYPKEnSG
TLSH
T18795E01BE25514F9E06BC279CB528801EAB17C450B25AAEF2354D3361F77AE44F3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-23_5fa6e16c6173c663117f6d7a135602df_icedid_mespinoza_njrat_ryuk_vidar

File Explorer

2026-08-23_5fa6e16c6173c663117f6d7a135602df_icedid_mespinoza_njrat_ryuk_vidar

.exe 1.9MB

2026-08-23_5fa6e16c6173c663117f6d7a135602df_icedid_mespinoza_njrat_ryuk_vidar

IMPHASH 6a8bffcb635443fadba2b7b98db52eda
SHA256 32644b1b94738d1dc07b8b524d1d7c7bcec4802df444f25ef95818a9fdf66590
MD5 5fa6e16c6173c663117f6d7a135602df
SHA1 500e7707a04e34ca75db03c6459ec89af17d2d59
SHA512 66cc8d7b4520edbc0e65e43c1ca0fa747068d5cc38c8f1c2f17e2e5e9f55ca44de5fef422f421d45b74768791977e8c84197f5e1133257e500c33ca4f9024387
SSDEEP 24576:pYRM7Y2cb+cREoYz7KEMdX6keYnAcerW:6+LcnRBYPKEnSG
TLSH
T18795E01BE25514F9E06BC279CB528801EAB17C450B25AAEF2354D3361F77AE44F3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

188048

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

elevation_service.exe.pdb

advapi32

AddAce CopySid GetAclInformation GetLengthSid GetSecurityDescriptorControl GetSecurityDescriptorDacl GetSecurityDescriptorGroup GetSecurityDescriptorOwner GetSecurityDescriptorSacl GetSidLengthRequired GetSidSubAuthority InitializeAcl InitializeSecurityDescriptor InitializeSid IsValidSid MakeAbsoluteSD RegisterServiceCtrlHandlerW SetSecurityDescriptorDacl SetSecurityDescriptorGroup SetSecurityDescriptorOwner SetServiceStatus StartServiceCtrlDispatcherW

kernel32

AcquireSRWLockExclusive CloseHandle CreateEventW CreateFileW DecodePointer DeleteCriticalSection DeleteFileW EncodePointer EnterCriticalSection EnumSystemLocalesW ExitProcess FindClose FindFirstFileExW FindNextFileW FlushFileBuffers FormatMessageA FreeEnvironmentStringsW FreeLibrary GetACP GetCPInfo GetCommandLineA GetCommandLineW GetConsoleCP GetConsoleMode GetCurrentDirectoryW GetCurrentProcess GetCurrentProcessId GetCurrentThreadId GetEnvironmentStringsW GetEnvironmentVariableW GetFileType GetLastError GetLocalTime GetLocaleInfoW GetModuleFileNameW GetModuleHandleExW GetModuleHandleW GetNativeSystemInfo GetOEMCP GetProcAddress GetProcessHeap GetStartupInfoW GetStdHandle GetStringTypeW GetSystemInfo GetSystemTimeAsFileTime GetTickCount GetUserDefaultLCID HeapAlloc HeapCreate HeapDestroy HeapFree HeapReAlloc HeapSetInformation HeapSize InitializeCriticalSectionAndSpinCount InitializeSListHead IsDebuggerPresent IsProcessorFeaturePresent IsValidCodePage IsValidLocale LCMapStringW LeaveCriticalSection LoadLibraryExA LoadLibraryExW LocalFree MultiByteToWideChar OutputDebugStringA OutputDebugStringW QueryPerformanceCounter QueryPerformanceFrequency RaiseException ReadConsoleW ReadFile ReleaseSRWLockExclusive ResetEvent RtlCaptureContext RtlCaptureStackBackTrace RtlLookupFunctionEntry RtlPcToFileHeader RtlUnwindEx RtlVirtualUnwind SetEvent SetFilePointerEx SetLastError SetStdHandle SetUnhandledExceptionFilter Sleep SwitchToThread TerminateProcess TlsAlloc TlsFree TlsGetValue TlsSetValue TryAcquireSRWLockExclusive UnhandledExceptionFilter VirtualProtect VirtualQuery WaitForSingleObject WaitForSingleObjectEx WideCharToMultiByte WriteConsoleW WriteFile

ole32

CoAddRefServerProcess CoInitializeEx CoInitializeSecurity CoRegisterClassObject CoReleaseServerProcess CoResumeClassObjects CoRevokeClassObject CoUninitialize

shell32

CommandLineToArgvW

winmm

timeGetTime

Name

.text

Size

299KB

Virtual Size

299KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

99KB

Virtual Size

99KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

19KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

14KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.00cfg

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

1.5MB

Virtual Size

1.5MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-23_5fa6e16c6173c663117f6d7a135602df_icedid_mespinoza_njrat_ryuk_vidar

advapi32

kernel32

ole32

shell32

winmm

generic