2026-09-24_c18e8594d3387b0c43cb7f52dede8a6a_cobalt-strike_icedid_mespinoza_njrat_ryuk

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-24_c18e8594d3387b0c43cb7f52dede8a6a_cobalt-strike_icedid_mespinoza_njrat_ryuk
Size 4.0MB
Sample260924-3psdmahe39
SHA256 dbd17081e3a9f306884fd76781d1f44b6e29ce126e8363ec87ab616576a15ff7
MD5 c18e8594d3387b0c43cb7f52dede8a6a
SHA1 58190313325d2873acfe5f9cebb0970c6b1fd79b
SHA512 376068f79015c5304d6d175357704e3b66a44eb0580986816943ae468cf5afa8881e2de38bca0390b5f3b090a4d07dd46b77d37b7009fe0229b4a1e09f07f01e
SSDEEP 49152:XhUx+wsOsVDrLqGUV6HVwQDJDPbplfLuMz2GG6ZEBAqWQZ1HmOUZkkCfGH/4DyyM:Xy8csVDy6H2QBZ2GG6ZEuqWQ/y7dKCZ
TLSH
T100168C57E19200E9C159C131DF2AD232BB767C4D57F56AB73280BAE13E72E903A2E705
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-24_c18e8594d3387b0c43cb7f52dede8a6a_cobalt-strike_icedid_mespinoza_njrat_ryuk

File Explorer

2026-09-24_c18e8594d3387b0c43cb7f52dede8a6a_cobalt-strike_icedid_mespinoza_njrat_ryuk

.exe 4.0MB

2026-09-24_c18e8594d3387b0c43cb7f52dede8a6a_cobalt-strike_icedid_mespinoza_njrat_ryuk

IMPHASH 914df116317bc8a6befe38fea11ffb87
SHA256 dbd17081e3a9f306884fd76781d1f44b6e29ce126e8363ec87ab616576a15ff7
MD5 c18e8594d3387b0c43cb7f52dede8a6a
SHA1 58190313325d2873acfe5f9cebb0970c6b1fd79b
SHA512 376068f79015c5304d6d175357704e3b66a44eb0580986816943ae468cf5afa8881e2de38bca0390b5f3b090a4d07dd46b77d37b7009fe0229b4a1e09f07f01e
SSDEEP 49152:XhUx+wsOsVDrLqGUV6HVwQDJDPbplfLuMz2GG6ZEBAqWQZ1HmOUZkkCfGH/4DyyM:Xy8csVDy6H2QBZ2GG6ZEuqWQ/y7dKCZ
TLSH
T100168C57E19200E9C159C131DF2AD232BB767C4D57F56AB73280BAE13E72E903A2E705
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

3435904

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

mxvnc.pdb

kernel32

AcquireSRWLockExclusive AcquireSRWLockShared AssignProcessToJobObject CancelIoEx CancelSynchronousIo CloseHandle CompareStringW ConnectNamedPipe CreateEventA CreateEventW CreateFileMappingW CreateFileW CreateIoCompletionPort CreateJobObjectW CreateMutexW CreateNamedPipeW CreatePipe CreateThread CreateToolhelp32Snapshot DeleteCriticalSection DeleteFileW DeleteProcThreadAttributeList DisconnectNamedPipe DuplicateHandle EncodePointer EnterCriticalSection ExitProcess FileTimeToSystemTime FindClose FindFirstFileExW FindNextFileW FlsAlloc FlsFree FlsGetValue FlsSetValue FlushFileBuffers FormatMessageA FreeConsole FreeEnvironmentStringsW FreeLibrary GetACP GetCPInfo GetCommandLineA GetCommandLineW GetConsoleMode GetConsoleOutputCP GetCurrentDirectoryW GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetEnvironmentStringsW GetEnvironmentVariableW GetFileAttributesW GetFileInformationByHandle GetFileInformationByHandleEx GetFileSizeEx GetFileType GetFinalPathNameByHandleW GetLastError GetLocalTime GetModuleFileNameW GetModuleHandleExW GetModuleHandleW GetNativeSystemInfo GetOEMCP GetProcAddress GetProcessHeap GetProcessId GetQueuedCompletionStatusEx GetStartupInfoW GetStdHandle GetStringTypeW GetSystemTimeAsFileTime GetTickCount64 GetTimeZoneInformation GetWindowsDirectoryW GlobalAlloc GlobalFree GlobalLock GlobalMemoryStatusEx GlobalSize GlobalUnlock InitOnceExecuteOnce InitializeConditionVariable InitializeCriticalSection InitializeCriticalSectionEx InitializeProcThreadAttributeList InitializeSListHead InitializeSRWLock InterlockedPopEntrySList InterlockedPushEntrySList IsDebuggerPresent IsProcessorFeaturePresent IsValidCodePage K32EnumProcessModules K32GetModuleFileNameExA K32GetModuleInformation LCMapStringW LeaveCriticalSection LoadLibraryExW LoadLibraryW LocalAlloc LocalFree MapViewOfFile MoveFileExW MultiByteToWideChar OpenEventW OpenFileMappingW OpenMutexW OpenProcess PeekNamedPipe PostQueuedCompletionStatus Process32FirstW Process32NextW ProcessIdToSessionId QueryPerformanceCounter QueryPerformanceFrequency RaiseException ReadConsoleW ReadFile ReleaseMutex ReleaseSRWLockExclusive ReleaseSRWLockShared ResetEvent RtlCaptureContext RtlCaptureStackBackTrace RtlLookupFunctionEntry RtlPcToFileHeader RtlUnwind RtlUnwindEx RtlVirtualUnwind SetConsoleCtrlHandler SetEndOfFile SetEnvironmentVariableW SetEvent SetFileInformationByHandle SetFilePointerEx SetFileTime SetHandleInformation SetInformationJobObject SetLastError SetStdHandle SetThreadPriority SetUnhandledExceptionFilter Sleep SleepConditionVariableCS SleepConditionVariableSRW SystemTimeToTzSpecificLocalTime TerminateProcess TlsAlloc TlsGetValue TlsSetValue TryAcquireSRWLockExclusive UnhandledExceptionFilter UnmapViewOfFile UpdateProcThreadAttribute VirtualAlloc VirtualFree VirtualProtect VirtualQuery WTSGetActiveConsoleSessionId WaitForMultipleObjects WaitForSingleObject WaitForSingleObjectEx WaitNamedPipeW WakeAllConditionVariable WakeConditionVariable WideCharToMultiByte WriteConsoleW WriteFile lstrlenA

advapi32

AdjustTokenPrivileges AllocateAndInitializeSid ChangeServiceConfig2W ChangeServiceConfigW CheckTokenMembership CloseServiceHandle ControlService ConvertStringSecurityDescriptorToSecurityDescriptorA ConvertStringSecurityDescriptorToSecurityDescriptorW CreateProcessAsUserW CreateProcessWithTokenW CreateServiceW CreateWellKnownSid DeleteService DeregisterEventSource DuplicateToken DuplicateTokenEx EqualSid EventRegister EventUnregister EventWriteString FreeSid GetTokenInformation GetUserNameW ImpersonateLoggedOnUser IsWellKnownSid LogonUserW LookupPrivilegeValueW OpenProcessToken OpenSCManagerW OpenServiceW OpenThreadToken RegCloseKey RegCreateKeyExA RegCreateKeyExW RegDeleteValueA RegDeleteValueW RegFlushKey RegGetValueA RegOpenKeyExA RegOpenKeyExW RegQueryValueExW RegSetValueExA RegSetValueExW RegisterEventSourceW RegisterServiceCtrlHandlerExW ReportEventW RevertToSelf SetServiceStatus SetThreadToken SetTokenInformation StartServiceCtrlDispatcherW

shell32

DragQueryFileW SHGetFileInfoW SHGetKnownFolderPath SHGetStockIconInfo

ole32

CoInitializeEx CoTaskMemFree CoUninitialize OleInitialize OleUninitialize

ws2_32

WSACleanup WSAGetLastError WSAGetOverlappedResult WSAIoctl WSARecv WSASend WSASocketW WSAStartup bind closesocket getpeername getsockname htonl htons inet_ntop inet_pton listen ntohs setsockopt shutdown

crypt32

CryptProtectData CryptUnprotectData

user32

AppendMenuW CallWindowProcW ClientToScreen CloseClipboard CloseDesktop CreatePopupMenu CreateWindowExW DefWindowProcW DestroyIcon DestroyMenu DestroyWindow DispatchMessageW DrawIconEx DrawTextW EmptyClipboard EnableWindow EndMenu EnumDisplayDevicesW EnumDisplayMonitors EnumDisplaySettingsW FillRect GetClientRect GetClipboardData GetClipboardSequenceNumber GetCursorInfo GetCursorPos GetDC GetDlgItem GetIconInfo GetLastActivePopup GetMessageW GetMonitorInfoW GetParent GetSysColor GetSysColorBrush GetSystemMetrics GetThreadDesktop GetUserObjectInformationA GetUserObjectInformationW GetWindow GetWindowLongPtrW GetWindowTextW InvalidateRect IsClipboardFormatAvailable IsDialogMessageW IsWindow LoadCursorW LoadIconW LoadImageW MapVirtualKeyW MessageBoxW MoveWindow MsgWaitForMultipleObjects MsgWaitForMultipleObjectsEx OpenClipboard OpenDesktopW OpenInputDesktop PeekMessageW PostMessageW PostQuitMessage PostThreadMessageW RegisterClassExW ReleaseDC ScreenToClient SendInput SendMessageW SetClipboardData SetCursorPos SetFocus SetMenuDefaultItem SetThreadDesktop SetTimer SetWindowLongPtrW SetWindowPos SetWindowTextW ShowWindow SystemParametersInfoW TrackPopupMenu TranslateMessage UpdateWindow VkKeyScanW

gdi32

BitBlt CreateCompatibleDC CreateDIBSection CreateFontIndirectW CreateFontW CreateSolidBrush DeleteDC DeleteObject GetDIBits GetObjectW GetStockObject SelectObject SetBkColor SetBkMode SetTextColor

wtsapi32

WTSFreeMemory WTSQuerySessionInformationW WTSQueryUserToken

comctl32

ImageList_Draw

ntdll

NtCreateFile NtSetInformationFile RtlNtStatusToDosError

d3d11

CreateDirect3D11DeviceFromDXGIDevice D3D11CreateDevice

dxgi

CreateDXGIFactory1

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory RoInitialize RoUninitialize

api-ms-win-core-winrt-string-l1-1-0

WindowsCreateString WindowsDeleteString

userenv

CreateEnvironmentBlock DestroyEnvironmentBlock

api-ms-win-mm-time-l1-1-0

timeGetTime

Name

.text

Size

3.3MB

Virtual Size

3.3MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

505KB

Virtual Size

505KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

61KB

Virtual Size

1.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

49KB

Virtual Size

49KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

433B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

121KB

Virtual Size

120KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

13KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-24_c18e8594d3387b0c43cb7f52dede8a6a_cobalt-strike_icedid_mespinoza_njrat_ryuk

kernel32

advapi32

shell32

ole32

ws2_32

crypt32

user32

gdi32

wtsapi32

comctl32

ntdll

d3d11

dxgi

api-ms-win-core-winrt-l1-1-0

api-ms-win-core-winrt-string-l1-1-0

userenv

api-ms-win-mm-time-l1-1-0

generic