2026-09-28_c4ae1f62c8756f06735582117e7df885_icedid_mespinoza_njrat_ryuk_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-28_c4ae1f62c8756f06735582117e7df885_icedid_mespinoza_njrat_ryuk_vidar
Size 1.5MB
Sample260928-n7lapsshkc
SHA256 f4bcac30b073c91fa4038649a0aace27a1c904b5b90032f3f81b7f43e6e4c8ac
MD5 c4ae1f62c8756f06735582117e7df885
SHA1 aff1450aa5994f67d23764507cc99eaa3b84f430
SHA512 e2cf75e68d819dde56a154c0b95fb14630fb1cb27059e4fa4804ae28d299f9efa210ab7635b6bca2f7d3c80b769d5520c642b89f10c798220fc71bd40756a6cc
SSDEEP 24576:5JF5aF7OLIqXhsqjnhMgeiCl7G0nehbGZpbD:5JjaF7OLIiDmg27RnWGj
TLSH
T10B75E115F3A458F9D06AC434CA46C206EA72BC9B0F65A6DF3392425D3F772E48E39721
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-28_c4ae1f62c8756f06735582117e7df885_icedid_mespinoza_njrat_ryuk_vidar

File Explorer

2026-09-28_c4ae1f62c8756f06735582117e7df885_icedid_mespinoza_njrat_ryuk_vidar

.exe 1.5MB

2026-09-28_c4ae1f62c8756f06735582117e7df885_icedid_mespinoza_njrat_ryuk_vidar

IMPHASH d60bf30f74bba35d9d15e46493f687c8
SHA256 f4bcac30b073c91fa4038649a0aace27a1c904b5b90032f3f81b7f43e6e4c8ac
MD5 c4ae1f62c8756f06735582117e7df885
SHA1 aff1450aa5994f67d23764507cc99eaa3b84f430
SHA512 e2cf75e68d819dde56a154c0b95fb14630fb1cb27059e4fa4804ae28d299f9efa210ab7635b6bca2f7d3c80b769d5520c642b89f10c798220fc71bd40756a6cc
SSDEEP 24576:5JF5aF7OLIqXhsqjnhMgeiCl7G0nehbGZpbD:5JjaF7OLIiDmg27RnWGj
TLSH
T10B75E115F3A458F9D06AC434CA46C206EA72BC9B0F65A6DF3392425D3F772E48E39721
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

117504

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

installer_helper.exe.pdb

shell32

SHBindToParent SHParseDisplayName

user32

CreatePopupMenu CreateWindowExW DefWindowProcW DestroyMenu DestroyWindow DispatchMessageW GetMenuItemCount GetMenuItemInfoW GetMessageW LoadCursorW LoadStringW PostMessageW PostQuitMessage RegisterClassW SetTimer TranslateMessage

kernel32

AcquireSRWLockExclusive CloseHandle CompareStringW CreateEventW CreateFileW DecodePointer DeleteCriticalSection EncodePointer EnterCriticalSection EnumSystemLocalesW ExitProcess FindClose FindFirstFileExW FindNextFileW FlushFileBuffers FreeEnvironmentStringsW FreeLibrary GetACP GetCPInfo GetCommandLineA GetCommandLineW GetConsoleCP GetConsoleMode GetCurrentProcess GetCurrentProcessId GetCurrentThreadId GetDateFormatW GetEnvironmentStringsW GetFileSizeEx GetFileType GetLastError GetLocaleInfoW GetModuleFileNameW GetModuleHandleExW GetModuleHandleW GetOEMCP GetProcAddress GetProcessHeap GetStartupInfoW GetStdHandle GetStringTypeW GetSystemTimeAsFileTime GetTimeFormatW GetTimeZoneInformation GetUserDefaultLCID HeapAlloc HeapFree HeapReAlloc HeapSize InitializeCriticalSectionAndSpinCount InitializeSListHead IsDebuggerPresent IsProcessorFeaturePresent IsValidCodePage IsValidLocale LCMapStringW LeaveCriticalSection LoadLibraryExW LoadLibraryW MultiByteToWideChar QueryPerformanceCounter RaiseException ReadConsoleW ReadFile ReleaseSRWLockExclusive ResetEvent RtlCaptureContext RtlLookupFunctionEntry RtlPcToFileHeader RtlUnwindEx RtlVirtualUnwind SetEnvironmentVariableW SetEvent SetFilePointerEx SetLastError SetStdHandle SetUnhandledExceptionFilter SleepConditionVariableSRW TerminateProcess TlsAlloc TlsFree TlsGetValue TlsSetValue UnhandledExceptionFilter WaitForSingleObjectEx WakeAllConditionVariable WideCharToMultiByte WriteConsoleW WriteFile

ole32

CoInitialize CoTaskMemFree CoUninitialize

Name

.text

Size

247KB

Virtual Size

246KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

81KB

Virtual Size

80KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

8KB

Virtual Size

19KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

13KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.00cfg

Size

512B

Virtual Size

32B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1024B

Virtual Size

920B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

1.2MB

Virtual Size

1.8MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-28_c4ae1f62c8756f06735582117e7df885_icedid_mespinoza_njrat_ryuk_vidar

shell32

user32

kernel32

ole32

generic