2026-09-04_196ac737e0672ac901e8f38e06f0456e_icedid_mespinoza_njrat_ryuk_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-04_196ac737e0672ac901e8f38e06f0456e_icedid_mespinoza_njrat_ryuk_vidar
Size 1.9MB
Sample260905-vxq7jaygmc
SHA256 265e8cc9246e568b109d1eb8f5bf6fe97bceb30a53d7f30404d9481b71fa5a34
MD5 196ac737e0672ac901e8f38e06f0456e
SHA1 4ce4e8997a055155ecc43b60b316c48fc0a64576
SHA512 6a1dde2f5daeb5875a9dcb802a2f339cb31cc14bfe91081d529db70dbf8c6c6e57d0e7045a1b382c5d924c1405dc6fda8fe914c5811c2a4f750068993c39ba7d
SSDEEP 12288:tUGqQLlK62UJip77YPmRcbo7cREwgvSOY0Fp/IHH+LvG1k4nLW+x2Tb0VLMj8SLx:SYRk7Y2cb+cRE3Y0Fp/TGLR2Tb0x4
TLSH
T1E495D01BE25910FDE067D2788B528901EAB17C150B21EAEF1395D7361F36AE44F3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-04_196ac737e0672ac901e8f38e06f0456e_icedid_mespinoza_njrat_ryuk_vidar

File Explorer

2026-09-04_196ac737e0672ac901e8f38e06f0456e_icedid_mespinoza_njrat_ryuk_vidar

.exe 1.9MB

2026-09-04_196ac737e0672ac901e8f38e06f0456e_icedid_mespinoza_njrat_ryuk_vidar

IMPHASH 6a8bffcb635443fadba2b7b98db52eda
SHA256 265e8cc9246e568b109d1eb8f5bf6fe97bceb30a53d7f30404d9481b71fa5a34
MD5 196ac737e0672ac901e8f38e06f0456e
SHA1 4ce4e8997a055155ecc43b60b316c48fc0a64576
SHA512 6a1dde2f5daeb5875a9dcb802a2f339cb31cc14bfe91081d529db70dbf8c6c6e57d0e7045a1b382c5d924c1405dc6fda8fe914c5811c2a4f750068993c39ba7d
SSDEEP 12288:tUGqQLlK62UJip77YPmRcbo7cREwgvSOY0Fp/IHH+LvG1k4nLW+x2Tb0VLMj8SLx:SYRk7Y2cb+cRE3Y0Fp/TGLR2Tb0x4
TLSH
T1E495D01BE25910FDE067D2788B528901EAB17C150B21EAEF1395D7361F36AE44F3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

188048

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

elevation_service.exe.pdb

advapi32

AddAce CopySid GetAclInformation GetLengthSid GetSecurityDescriptorControl GetSecurityDescriptorDacl GetSecurityDescriptorGroup GetSecurityDescriptorOwner GetSecurityDescriptorSacl GetSidLengthRequired GetSidSubAuthority InitializeAcl InitializeSecurityDescriptor InitializeSid IsValidSid MakeAbsoluteSD RegisterServiceCtrlHandlerW SetSecurityDescriptorDacl SetSecurityDescriptorGroup SetSecurityDescriptorOwner SetServiceStatus StartServiceCtrlDispatcherW

kernel32

AcquireSRWLockExclusive CloseHandle CreateEventW CreateFileW DecodePointer DeleteCriticalSection DeleteFileW EncodePointer EnterCriticalSection EnumSystemLocalesW ExitProcess FindClose FindFirstFileExW FindNextFileW FlushFileBuffers FormatMessageA FreeEnvironmentStringsW FreeLibrary GetACP GetCPInfo GetCommandLineA GetCommandLineW GetConsoleCP GetConsoleMode GetCurrentDirectoryW GetCurrentProcess GetCurrentProcessId GetCurrentThreadId GetEnvironmentStringsW GetEnvironmentVariableW GetFileType GetLastError GetLocalTime GetLocaleInfoW GetModuleFileNameW GetModuleHandleExW GetModuleHandleW GetNativeSystemInfo GetOEMCP GetProcAddress GetProcessHeap GetStartupInfoW GetStdHandle GetStringTypeW GetSystemInfo GetSystemTimeAsFileTime GetTickCount GetUserDefaultLCID HeapAlloc HeapCreate HeapDestroy HeapFree HeapReAlloc HeapSetInformation HeapSize InitializeCriticalSectionAndSpinCount InitializeSListHead IsDebuggerPresent IsProcessorFeaturePresent IsValidCodePage IsValidLocale LCMapStringW LeaveCriticalSection LoadLibraryExA LoadLibraryExW LocalFree MultiByteToWideChar OutputDebugStringA OutputDebugStringW QueryPerformanceCounter QueryPerformanceFrequency RaiseException ReadConsoleW ReadFile ReleaseSRWLockExclusive ResetEvent RtlCaptureContext RtlCaptureStackBackTrace RtlLookupFunctionEntry RtlPcToFileHeader RtlUnwindEx RtlVirtualUnwind SetEvent SetFilePointerEx SetLastError SetStdHandle SetUnhandledExceptionFilter Sleep SwitchToThread TerminateProcess TlsAlloc TlsFree TlsGetValue TlsSetValue TryAcquireSRWLockExclusive UnhandledExceptionFilter VirtualProtect VirtualQuery WaitForSingleObject WaitForSingleObjectEx WideCharToMultiByte WriteConsoleW WriteFile

ole32

CoAddRefServerProcess CoInitializeEx CoInitializeSecurity CoRegisterClassObject CoReleaseServerProcess CoResumeClassObjects CoRevokeClassObject CoUninitialize

shell32

CommandLineToArgvW

winmm

timeGetTime

Name

.text

Size

299KB

Virtual Size

299KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

99KB

Virtual Size

99KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

19KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

14KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.00cfg

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

1.5MB

Virtual Size

1.5MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-04_196ac737e0672ac901e8f38e06f0456e_icedid_mespinoza_njrat_ryuk_vidar

advapi32

kernel32

ole32

shell32

winmm

generic