2026-09-25_fb67f4cf85931d7b5497b1a66faf7aa2_icedid_mespinoza_njrat_ryuk

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-25_fb67f4cf85931d7b5497b1a66faf7aa2_icedid_mespinoza_njrat_ryuk
Size 493KB
Sample260925-vecw7asx9l
SHA256 1b64d222196011f27d0b1c049afa2ce791e82e4d25cd113c4ccfc1ab320af0d4
MD5 fb67f4cf85931d7b5497b1a66faf7aa2
SHA1 22488fe6d3f2d2951a5ea777cdd1ab488204e7d9
SHA512 d16b5c137fc72ff3b34749aead5369cdca08bce7faa2ff3710e71f85739f5290f6dd5862e2cbdeab64db6f29a95ecfffeae1f2ef3bbfd0cd9a95c7b855592d05
SSDEEP 6144:coTSYecpONWU2FtvhpluPiKbLjivVEaZqv4T51/2JWohHiE2Zh/9gmpCa+y:9WY13vvhNKLev5AWoIF/pIy
TLSH
T1D7B45B58A75444E1E1B6C13888939843E672BC015B71EBDF1298E73A2F777E19D3AF20
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-25_fb67f4cf85931d7b5497b1a66faf7aa2_icedid_mespinoza_njrat_ryuk

File Explorer

2026-09-25_fb67f4cf85931d7b5497b1a66faf7aa2_icedid_mespinoza_njrat_ryuk

.exe 493KB

2026-09-25_fb67f4cf85931d7b5497b1a66faf7aa2_icedid_mespinoza_njrat_ryuk

IMPHASH 66c18af3876a0e335a2274a7192f3b5c
SHA256 1b64d222196011f27d0b1c049afa2ce791e82e4d25cd113c4ccfc1ab320af0d4
MD5 fb67f4cf85931d7b5497b1a66faf7aa2
SHA1 22488fe6d3f2d2951a5ea777cdd1ab488204e7d9
SHA512 d16b5c137fc72ff3b34749aead5369cdca08bce7faa2ff3710e71f85739f5290f6dd5862e2cbdeab64db6f29a95ecfffeae1f2ef3bbfd0cd9a95c7b855592d05
SSDEEP 6144:coTSYecpONWU2FtvhpluPiKbLjivVEaZqv4T51/2JWohHiE2Zh/9gmpCa+y:9WY13vvhNKLev5AWoIF/pIy
TLSH
T1D7B45B58A75444E1E1B6C13888939843E672BC015B71EBDF1298E73A2F777E19D3AF20
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

160368

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\Workspace\nisraely\gitlab\cphs\IntelCpHeciSvc\x64\one_core_release\IntelCpHeciSvc.pdb

api-ms-win-core-processenvironment-l1-1-0

ExpandEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle GetCommandLineW GetEnvironmentStringsW GetCommandLineA GetStdHandle

api-ms-win-core-file-l1-1-0

GetFileType FindFirstFileExW SetEndOfFile SetFilePointerEx CreateDirectoryW FindClose FlushFileBuffers FindNextFileW CreateFileW ReadFile WriteFile

api-ms-win-core-errorhandling-l1-1-0

SetUnhandledExceptionFilter GetLastError UnhandledExceptionFilter RaiseException SetLastError

api-ms-win-core-profile-l1-1-0

QueryPerformanceFrequency QueryPerformanceCounter

api-ms-win-core-synch-l1-1-0

WaitForMultipleObjectsEx ResetEvent InitializeCriticalSectionEx DeleteCriticalSection LeaveCriticalSection SetEvent TryEnterCriticalSection EnterCriticalSection InitializeCriticalSection InitializeCriticalSectionAndSpinCount CreateEventW WaitForSingleObjectEx WaitForSingleObject

api-ms-win-core-processthreads-l1-1-0

ExitProcess GetCurrentProcessId GetStartupInfoW GetCurrentThreadId TerminateProcess GetCurrentProcess CreateThread TlsFree TlsSetValue TlsGetValue TlsAlloc ResumeThread

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-processthreads-l1-1-1

OpenProcess IsProcessorFeaturePresent

api-ms-win-core-libraryloader-l1-2-0

LoadResource LoadLibraryExW GetModuleHandleExW LoadStringW GetModuleFileNameW GetModuleHandleW GetProcAddress SizeofResource FreeLibrary

api-ms-win-core-libraryloader-l1-2-1

FindResourceW

api-ms-win-core-string-obsolete-l1-1-0

lstrcmpiW

api-ms-win-core-string-l2-1-0

CharUpperW CharNextW

api-ms-win-core-string-l1-1-0

WideCharToMultiByte GetStringTypeW MultiByteToWideChar

api-ms-win-core-registry-l1-1-0

RegCreateKeyExW RegDeleteValueW RegQueryValueExW RegEnumKeyExW RegQueryInfoKeyW RegOpenKeyExW RegCloseKey RegSetValueExW

api-ms-win-core-registry-l2-1-0

RegDeleteKeyW

api-ms-win-core-com-l1-1-0

CoAddRefServerProcess CoReleaseServerProcess CoResumeClassObjects CoTaskMemFree CoTaskMemRealloc CoTaskMemAlloc CoRevokeClassObject CoRegisterClassObject CoInitializeEx CoUninitialize CoInitializeSecurity CoCreateInstance

oleaut32

SafeArrayGetLBound SysFreeString SysStringLen VarUI4FromStr LoadTypeLi LoadRegTypeLi SafeArrayCreate SafeArrayDestroy SafeArrayRedim VariantClear VariantInit SafeArrayGetVartype SafeArrayCopy SafeArrayUnlock SafeArrayLock SafeArrayGetUBound

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-sysinfo-l1-1-0

GetVersionExW GetSystemTimeAsFileTime

api-ms-win-devices-config-l1-1-1

CM_Register_Notification CM_Unregister_Notification CM_Get_Device_Interface_List_SizeW CM_Get_Device_Interface_ListW

api-ms-win-core-io-l1-1-0

GetOverlappedResult DeviceIoControl

api-ms-win-core-util-l1-1-0

EncodePointer DecodePointer

api-ms-win-core-heap-l1-1-0

HeapSize HeapFree HeapReAlloc HeapAlloc GetProcessHeap

api-ms-win-security-base-l1-1-0

MakeAbsoluteSD

api-ms-win-service-management-l2-1-0

ChangeServiceConfigW QueryServiceConfigW

api-ms-win-service-management-l1-1-0

CloseServiceHandle OpenServiceW CreateServiceW OpenSCManagerW DeleteService

api-ms-win-service-winsvc-l1-1-0

ControlService

api-ms-win-service-core-l1-1-0

RegisterServiceCtrlHandlerExW StartServiceCtrlDispatcherW SetServiceStatus

api-ms-win-security-sddl-l1-1-0

ConvertStringSecurityDescriptorToSecurityDescriptorW

user32

GetMessageW DispatchMessageW PostThreadMessageW TranslateMessage

api-ms-win-core-localization-l1-2-0

GetOEMCP GetACP IsValidCodePage GetLocaleInfoW LCMapStringW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetCPInfo

api-ms-win-core-rtlsupport-l1-1-0

RtlCaptureContext RtlVirtualUnwind RtlPcToFileHeader RtlUnwindEx RtlLookupFunctionEntry

api-ms-win-core-debug-l1-1-0

IsDebuggerPresent OutputDebugStringW

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

api-ms-win-core-console-l1-1-0

GetConsoleMode ReadConsoleW WriteConsoleW GetConsoleCP

Name

.text

Size

289KB

Virtual Size

289KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

144KB

Virtual Size

144KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

8KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

16KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-25_fb67f4cf85931d7b5497b1a66faf7aa2_icedid_mespinoza_njrat_ryuk

api-ms-win-core-processenvironment-l1-1-0

api-ms-win-core-file-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-processthreads-l1-1-1

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-libraryloader-l1-2-1

api-ms-win-core-string-obsolete-l1-1-0

api-ms-win-core-string-l2-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-registry-l1-1-0

api-ms-win-core-registry-l2-1-0

api-ms-win-core-com-l1-1-0

oleaut32

api-ms-win-core-synch-l1-2-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-devices-config-l1-1-1

api-ms-win-core-io-l1-1-0

api-ms-win-core-util-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-security-base-l1-1-0

api-ms-win-service-management-l2-1-0

api-ms-win-service-management-l1-1-0

api-ms-win-service-winsvc-l1-1-0

api-ms-win-service-core-l1-1-0

api-ms-win-security-sddl-l1-1-0

user32

api-ms-win-core-localization-l1-2-0

api-ms-win-core-rtlsupport-l1-1-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-interlocked-l1-1-0

api-ms-win-core-console-l1-1-0

generic