2026-09-24_055f20545ae41797b5ab8b98a5da6314_icedid_mespinoza_njrat_ryuk

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-24_055f20545ae41797b5ab8b98a5da6314_icedid_mespinoza_njrat_ryuk
Size 538KB
Sample260925-s8xscafc99
SHA256 587b54347913e5709bac4e5b301f656f2910bd773493839c769d8f0641c611f4
MD5 055f20545ae41797b5ab8b98a5da6314
SHA1 cb5d3eb2a5722f761d222cf990a956a68ad3a5ad
SHA512 50be8cfa7e6db351dd971124f76abf889dda4dff2a9201070fd7e303c343d39436accc8fcadb4d8740dd407ef22087f372fd8e4cb08b11547664e4d4b4e31504
SSDEEP 12288:K6+1TfaurHFe01FS5ZjrSXOAGI+irMvt6fDVC9:KBiuRRjS5ZjrSn3Xru0S
TLSH
T1E1C49D45EB6844D4E06A493585629676D276BC1E4BD08FCB22BC771F2F335E0AE3CB21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
2026-09-24_055f20545ae41797b5ab8b98a5da6314_icedid_mespinoza_njrat_ryuk

File Explorer

2026-09-24_055f20545ae41797b5ab8b98a5da6314_icedid_mespinoza_njrat_ryuk

.exe 538KB

2026-09-24_055f20545ae41797b5ab8b98a5da6314_icedid_mespinoza_njrat_ryuk

IMPHASH 4f69d961351291ce53211c75ec5a8ff7
SHA256 587b54347913e5709bac4e5b301f656f2910bd773493839c769d8f0641c611f4
MD5 055f20545ae41797b5ab8b98a5da6314
SHA1 cb5d3eb2a5722f761d222cf990a956a68ad3a5ad
SHA512 50be8cfa7e6db351dd971124f76abf889dda4dff2a9201070fd7e303c343d39436accc8fcadb4d8740dd407ef22087f372fd8e4cb08b11547664e4d4b4e31504
SSDEEP 12288:K6+1TfaurHFe01FS5ZjrSXOAGI+irMvt6fDVC9:KBiuRRjS5ZjrSn3Xru0S
TLSH
T1E1C49D45EB6844D4E06A493585629676D276BC1E4BD08FCB22BC771F2F335E0AE3CB21
MD5 SHA1 SHA512 SSDEEP TLSH

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

7f:0a:bf:c7:1b:25:81:c9:9b:88:67:c4:4e:a4:10:bc:4c:e9:28:a2:7e:93:b8:8f:46:ec:20:97:4e:37:f9:d0

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Intel(R) pGFX,O=Intel Corporation,L=Santa Clara,ST=CA,C=US

Chains

Jan 15, 2018

CN=Intel(R) pGFX,O=Intel Corporation,L=Santa Clara,ST=CA,C=US

Subject

CN=Intel(R) pGFX,O=Intel Corporation,L=Santa Clara,ST=CA,C=US

Serial Number

33:00:00:c1:09:9d:64:be:0c:43:ea:e2:05:00:02:00:00:c1:09

Issuer

CN=Intel External Basic Issuing CA 3B,O=Intel Corporation,L=Santa Clara,ST=CA,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Oct 20, 2017 - Feb 8, 2018

Subject

CN=Intel External Basic Issuing CA 3B,O=Intel Corporation,L=Santa Clara,ST=CA,C=US

Serial Number

61:2c:ff:88:00:01:00:00:00:10

Issuer

CN=Intel External Basic Policy CA,O=Intel Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Feb 8, 2013 - Feb 8, 2018

Subject

CN=Intel External Basic Policy CA,O=Intel Corporation,C=US

Serial Number

79:17:4a:a9:14:17:36:fe:15:a7:ca:9f:2c:ff:45:88

Issuer

CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageServerAuth, ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning, ExtKeyUsageEmailProtection, ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Feb 1, 2013 - May 30, 2020

Subject

CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE

Serial Number

33:00:00:00:35:d8:d5:59:5b:06:71:41:2b:00:00:00:00:00:35

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Aug 15, 2013 - Aug 15, 2023

Subject

CN=QuoVadis Issuing CA G4,O=QuoVadis Limited,C=BM

Serial Number

69:b2:d1:cc:f0:2e:20:dc:c9:5c:62:89:4f:7f:9e:5f:5f:c0:57:bf

Issuer

CN=QuoVadis Root Certification Authority,OU=Root Certification Authority,O=QuoVadis Limited,C=BM

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

May 30, 2014 - Mar 17, 2021

Subject

CN=timestamp.intel.com,OU=Thales TSS ESN:E892-D055-162F+OU=Thales TSS ESN:E892-D055-162F,O=Intel Corporation,L=Santa Clara,ST=CA,C=US

Serial Number

17:a7:17:a0:16:72:36:ef:9b:1e:c2:c6:65:fa:8c:20:28:ad:7f:75

Issuer

CN=QuoVadis Issuing CA G4,O=QuoVadis Limited,C=BM

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Apr 24, 2015 - Apr 24, 2018

Minor OS version

Major OS version

Entry point

118624

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

wtsapi32

WTSUnRegisterSessionNotification WTSRegisterSessionNotification

kernel32

DecodePointer CloseHandle SetLastError SetEvent WaitForSingleObject CreateMutexW CreateEventW Sleep CreateThread GetCurrentThreadId LockResource GlobalAlloc GlobalUnlock GlobalLock GlobalHandle GlobalFree MulDiv lstrcmpW HeapDestroy HeapAlloc HeapReAlloc HeapFree HeapSize GetProcessHeap OpenEventW GetCurrentProcessId CreateProcessW ProcessIdToSessionId GetSystemDirectoryW FindResourceExW LoadLibraryW WTSGetActiveConsoleSessionId GetLocaleInfoW GetSystemDefaultUILanguage GetUserDefaultUILanguage GetSystemDefaultLangID IsDebuggerPresent OutputDebugStringW EncodePointer InitializeSListHead InterlockedPopEntrySList InterlockedPushEntrySList GetCurrentProcess FlushInstructionCache VirtualAlloc VirtualFree GetCommandLineW DeleteCriticalSection GetStringTypeW LCMapStringW CompareStringW GetFileType GetACP GetModuleHandleExW ExitProcess WriteFile GetStdHandle VirtualQuery VirtualProtect GetSystemInfo TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount RtlUnwindEx RtlPcToFileHeader GetStartupInfoW GetSystemTimeAsFileTime QueryPerformanceCounter IsProcessorFeaturePresent TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext WaitForSingleObjectEx ResetEvent LocalFree WideCharToMultiByte FindFirstFileExW MultiByteToWideChar lstrcmpiW FindResourceW SizeofResource LoadResource LoadLibraryExW GetProcAddress GetModuleHandleW GetModuleFileNameW LoadLibraryExA FreeLibrary ReadFile ReadConsoleW SetEndOfFile WriteConsoleW InitializeCriticalSectionEx LeaveCriticalSection EnterCriticalSection GetLastError RaiseException SetFilePointerEx GetTimeZoneInformation FindClose GetConsoleCP FlushFileBuffers CreateFileW SetStdHandle SetEnvironmentVariableA FreeEnvironmentStringsW GetEnvironmentStringsW FindNextFileW IsValidCodePage GetOEMCP GetCPInfo GetCommandLineA GetConsoleMode

user32

LoadImageW LoadIconW GetCursorPos MessageBoxW SetWindowContextHelpId GetWindowRect SetForegroundWindow SetMenuDefaultItem TrackPopupMenuEx MapDialogRect GetDisplayConfigBufferSizes SetDisplayConfig GetSubMenu GetSystemMetrics KillTimer QueryDisplayConfig MsgWaitForMultipleObjects MapVirtualKeyExW GetKeyNameTextW SendDlgItemMessageW CreateDialogParamW IsWindowVisible ShowWindow PostQuitMessage UnregisterDeviceNotification RegisterDeviceNotificationW UnregisterHotKey RegisterHotKey GetKeyboardLayout GetKeyboardLayoutList ActivateKeyboardLayout LoadKeyboardLayoutW LoadCursorW GetWindow GetClassNameW SetTimer GetParent GetDesktopWindow SetWindowLongPtrW GetWindowLongPtrW SetWindowLongW GetWindowLongW FillRect GetSysColor ScreenToClient ClientToScreen GetClientRect GetWindowTextLengthW GetWindowTextW SetWindowTextW RedrawWindow InvalidateRgn InvalidateRect EndPaint BeginPaint DestroyAcceleratorTable CreateAcceleratorTableW ReleaseCapture SetCapture GetFocus SetFocus CharUpperW CreateDialogIndirectParamW SetWindowPos MoveWindow DestroyWindow IsChild IsWindow CreateWindowExW GetClassInfoExW RegisterClassExW CallWindowProcW DefWindowProcW PostThreadMessageW DispatchMessageW TranslateMessage GetMessageW RegisterWindowMessageW CharNextW GetDlgItem UnregisterClassW SendMessageW FindWindowW ReleaseDC GetDC InsertMenuW DestroyMenu CreatePopupMenu PostMessageW EndDialog

advapi32

RegCloseKey RegDeleteKeyW RegDeleteValueW RegEnumKeyExW RegOpenKeyExW RegQueryInfoKeyW RegSetValueExW RegQueryValueExW ConvertStringSecurityDescriptorToSecurityDescriptorW RegCreateKeyExW

ole32

OleUninitialize OleInitialize CoInitialize StringFromGUID2 CLSIDFromProgID CLSIDFromString CoReleaseServerProcess CoAddRefServerProcess OleLockRunning CoRevokeClassObject CoRegisterClassObject CoGetClassObject CoUninitialize CreateStreamOnHGlobal CoTaskMemFree CoTaskMemRealloc CoTaskMemAlloc OleRun CoCreateInstance CoInitializeEx CoResumeClassObjects

shell32

SHCreateItemFromParsingName Shell_NotifyIconW

oleaut32

SysAllocStringLen SysFreeString SysStringLen SysStringByteLen SysAllocStringByteLen SafeArrayDestroy SafeArrayUnlock VarUI4FromStr LoadTypeLi LoadRegTypeLi VariantInit VariantClear GetErrorInfo RegisterTypeLi UnRegisterTypeLi OleCreateFontIndirect SysAllocString

shlwapi

StrStrW

gdi32

DeleteObject BitBlt CreateCompatibleBitmap CreateCompatibleDC CreateSolidBrush DeleteDC GetStockObject SelectObject GetObjectW GetDeviceCaps

Name

.text

Size

240KB

Virtual Size

240KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

96KB

Virtual Size

96KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

23KB

Virtual Size

100KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

13KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

148KB

Virtual Size

148KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-24_055f20545ae41797b5ab8b98a5da6314_icedid_mespinoza_njrat_ryuk

PE Signature issue

wtsapi32

kernel32

user32

advapi32

ole32

shell32

oleaut32

shlwapi

gdi32

generic