2026-09-10_9560c33017140264c931cdda0ff8b604_icedid_mespinoza_njrat_ryuk

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-10_9560c33017140264c931cdda0ff8b604_icedid_mespinoza_njrat_ryuk
Size 1.6MB
Sample260910-qpv4ashb45
SHA256 ec28f615fe7e4deac21034af023397365df4d972a55d0c746397f25f92b5ecb0
MD5 9560c33017140264c931cdda0ff8b604
SHA1 54d46073ea63f01efadcd6022e34e828b934926a
SHA512 e4c7fc99bc4a60ef2e9a4aa193eb478471126d60833b26ec6a3ddb976f395123bb36d307366decf4e403153719f00e352b34188c37a201ca3fe2d03d41c7539c
SSDEEP 12288:YiBlwBAQIXqaE02CgqwXeAVmoEAlCLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbP:YiBE0qqwXeAVmYHNyBo4kx929bL3Hnx
TLSH
T1AC85D058A74841E0E1B6C23888538946E6717C014BB1DBDF5398E73E2F7BBE19D3AB11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-10_9560c33017140264c931cdda0ff8b604_icedid_mespinoza_njrat_ryuk

File Explorer

2026-09-10_9560c33017140264c931cdda0ff8b604_icedid_mespinoza_njrat_ryuk

.exe 1.6MB

2026-09-10_9560c33017140264c931cdda0ff8b604_icedid_mespinoza_njrat_ryuk

IMPHASH 997697ab724741456c3bab642ada075e
SHA256 ec28f615fe7e4deac21034af023397365df4d972a55d0c746397f25f92b5ecb0
MD5 9560c33017140264c931cdda0ff8b604
SHA1 54d46073ea63f01efadcd6022e34e828b934926a
SHA512 e4c7fc99bc4a60ef2e9a4aa193eb478471126d60833b26ec6a3ddb976f395123bb36d307366decf4e403153719f00e352b34188c37a201ca3fe2d03d41c7539c
SSDEEP 12288:YiBlwBAQIXqaE02CgqwXeAVmoEAlCLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbP:YiBE0qqwXeAVmYHNyBo4kx929bL3Hnx
TLSH
T1AC85D058A74841E0E1B6C23888538946E6717C014BB1DBDF5398E73E2F7BBE19D3AB11
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

170336

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

d:\Workspace\nisraely\gitlab\cphs\IntelCpHeciSvc\x64\one_core_release_registry\IntelCpHeciSvc.pdb

api-ms-win-core-processenvironment-l1-1-0

GetEnvironmentStringsW FreeEnvironmentStringsW GetCommandLineW SetStdHandle ExpandEnvironmentStringsW GetCommandLineA GetStdHandle

api-ms-win-core-file-l1-1-0

CreateDirectoryW SetEndOfFile FlushFileBuffers SetFilePointerEx FindNextFileW FindFirstFileExW CreateFileW ReadFile WriteFile GetFileType FindClose

api-ms-win-core-errorhandling-l1-1-0

SetUnhandledExceptionFilter SetLastError UnhandledExceptionFilter RaiseException GetLastError

api-ms-win-core-profile-l1-1-0

QueryPerformanceFrequency QueryPerformanceCounter

api-ms-win-core-synch-l1-1-0

WaitForSingleObjectEx ResetEvent EnterCriticalSection InitializeCriticalSection LeaveCriticalSection TryEnterCriticalSection CreateEventW WaitForMultipleObjectsEx WaitForSingleObject SetEvent InitializeCriticalSectionAndSpinCount InitializeCriticalSectionEx DeleteCriticalSection

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcess TerminateProcess ResumeThread CreateThread GetStartupInfoW GetCurrentProcessId TlsFree TlsSetValue TlsAlloc GetCurrentThreadId ExitProcess OpenProcessToken TlsGetValue

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-processthreads-l1-1-1

OpenProcess IsProcessorFeaturePresent

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleExW LoadStringW GetProcAddress GetModuleFileNameW FreeLibrary LoadLibraryExW LoadResource SizeofResource GetModuleHandleW

api-ms-win-core-libraryloader-l1-2-1

FindResourceW

api-ms-win-core-string-obsolete-l1-1-0

lstrcmpiW

api-ms-win-core-string-l2-1-0

CharNextW CharUpperW

api-ms-win-core-string-l1-1-0

WideCharToMultiByte MultiByteToWideChar GetStringTypeW

api-ms-win-core-registry-l1-1-0

RegCloseKey RegOpenKeyExW RegCreateKeyExW RegQueryInfoKeyW RegQueryValueExW RegSetValueExA RegDeleteValueW RegQueryValueExA RegSetValueExW RegEnumKeyExW

api-ms-win-core-registry-l2-1-0

RegDeleteKeyW

api-ms-win-core-com-l1-1-0

CoResumeClassObjects CoAddRefServerProcess CoReleaseServerProcess CoTaskMemAlloc CoCreateInstance StringFromGUID2 CoTaskMemFree CoInitializeSecurity CoUninitialize CoInitializeEx CoTaskMemRealloc CoRevokeClassObject CoRegisterClassObject

oleaut32

SysStringLen SysFreeString LoadRegTypeLi VarUI4FromStr SafeArrayCreate SafeArrayDestroy SafeArrayRedim SafeArrayGetUBound SafeArrayGetLBound RegisterTypeLi SysAllocString SafeArrayLock SafeArrayUnlock SafeArrayCopy SafeArrayGetVartype VariantInit VariantClear LoadTypeLi

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-sysinfo-l1-1-0

GetVersionExW GetSystemTimeAsFileTime

api-ms-win-devices-config-l1-1-1

CM_Unregister_Notification CM_Get_Device_Interface_ListW CM_Register_Notification CM_Get_Device_Interface_List_SizeW

api-ms-win-core-io-l1-1-0

DeviceIoControl GetOverlappedResult

api-ms-win-core-util-l1-1-0

DecodePointer EncodePointer

api-ms-win-core-heap-l1-1-0

HeapAlloc HeapFree GetProcessHeap HeapReAlloc HeapSize

api-ms-win-security-base-l1-1-0

GetSecurityDescriptorLength MakeAbsoluteSD AdjustTokenPrivileges

api-ms-win-core-heap-l2-1-0

LocalFree

api-ms-win-security-lsalookup-l2-1-0

LookupPrivilegeValueW

api-ms-win-service-management-l2-1-0

ChangeServiceConfigW QueryServiceConfigW

api-ms-win-service-management-l1-1-0

OpenServiceW CloseServiceHandle CreateServiceW DeleteService OpenSCManagerW

api-ms-win-service-winsvc-l1-1-0

ControlService

api-ms-win-service-core-l1-1-0

SetServiceStatus StartServiceCtrlDispatcherW RegisterServiceCtrlHandlerExW

api-ms-win-security-sddl-l1-1-0

ConvertStringSecurityDescriptorToSecurityDescriptorW

user32

DispatchMessageW TranslateMessage GetMessageW PostThreadMessageW

api-ms-win-core-localization-l1-2-0

IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetCPInfo GetLocaleInfoW LCMapStringW GetOEMCP GetACP IsValidCodePage

api-ms-win-core-rtlsupport-l1-1-0

RtlVirtualUnwind RtlUnwindEx RtlPcToFileHeader RtlLookupFunctionEntry RtlCaptureContext

api-ms-win-core-debug-l1-1-0

IsDebuggerPresent OutputDebugStringW

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

api-ms-win-core-console-l1-1-0

WriteConsoleW GetConsoleCP GetConsoleMode ReadConsoleW

Name

.text

Size

300KB

Virtual Size

300KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

148KB

Virtual Size

147KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

8KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

16KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

1.2MB

Virtual Size

1.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-10_9560c33017140264c931cdda0ff8b604_icedid_mespinoza_njrat_ryuk

api-ms-win-core-processenvironment-l1-1-0

api-ms-win-core-file-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-processthreads-l1-1-1

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-libraryloader-l1-2-1

api-ms-win-core-string-obsolete-l1-1-0

api-ms-win-core-string-l2-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-registry-l1-1-0

api-ms-win-core-registry-l2-1-0

api-ms-win-core-com-l1-1-0

oleaut32

api-ms-win-core-synch-l1-2-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-devices-config-l1-1-1

api-ms-win-core-io-l1-1-0

api-ms-win-core-util-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-security-base-l1-1-0

api-ms-win-core-heap-l2-1-0

api-ms-win-security-lsalookup-l2-1-0

api-ms-win-service-management-l2-1-0

api-ms-win-service-management-l1-1-0

api-ms-win-service-winsvc-l1-1-0

api-ms-win-service-core-l1-1-0

api-ms-win-security-sddl-l1-1-0

user32

api-ms-win-core-localization-l1-2-0

api-ms-win-core-rtlsupport-l1-1-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-interlocked-l1-1-0

api-ms-win-core-console-l1-1-0

generic