2026-09-29_c4a79e9f3206263e26586625690b2e76_icedid_mespinoza_ryuk

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-29_c4a79e9f3206263e26586625690b2e76_icedid_mespinoza_ryuk
Size 1.5MB
Sample260929-vk94wabe89
SHA256 bad897167d47ed5aeed887ee61892578fde95a2b3e71f795c71bc3ab51b0f45d
MD5 c4a79e9f3206263e26586625690b2e76
SHA1 30665bebc267436ddcb5c004f8ac72b215781e37
SHA512 a1f3862f956e0ecd0bd6c772eae3f974a3b924aee49c822cc23195fedf4d101516449fa47b8d089a76c89d9311c1e20d943afcc7e304c10710d830d21fc7b02a
SSDEEP 24576:7tgEMGbnLTQ9dsl7+GKiRnkNO/urqW+1n69d+3Vklh+wSy3nW4Qbar7GU:7tq9dsl7jTRnkOWc1nc03elhzHTr7H
TLSH
T142758C5632F83658F7F64F7595F01133CA37FCA6E9F18B994A0C309C1A326618966F22
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-29_c4a79e9f3206263e26586625690b2e76_icedid_mespinoza_ryuk

File Explorer

2026-09-29_c4a79e9f3206263e26586625690b2e76_icedid_mespinoza_ryuk

.exe 1.5MB

2026-09-29_c4a79e9f3206263e26586625690b2e76_icedid_mespinoza_ryuk

IMPHASH 907c7336275c8d39fc6c8a98d0ba664d
SHA256 bad897167d47ed5aeed887ee61892578fde95a2b3e71f795c71bc3ab51b0f45d
MD5 c4a79e9f3206263e26586625690b2e76
SHA1 30665bebc267436ddcb5c004f8ac72b215781e37
SHA512 a1f3862f956e0ecd0bd6c772eae3f974a3b924aee49c822cc23195fedf4d101516449fa47b8d089a76c89d9311c1e20d943afcc7e304c10710d830d21fc7b02a
SSDEEP 24576:7tgEMGbnLTQ9dsl7+GKiRnkNO/urqW+1n69d+3Vklh+wSy3nW4Qbar7GU:7tq9dsl7jTRnkOWc1nc03elhzHTr7H
TLSH
T142758C5632F83658F7F64F7595F01133CA37FCA6E9F18B994A0C309C1A326618966F22
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

13524

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_ISOLATION IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\enterp-branch\dev-1824\DevOps\CTI\PRJ\Deploy\Release\CTDPL.PDB

kernel32

ReadFile WriteFile GetTempPathW CreateFileW CloseHandle GetFileSize FindClose Sleep GetCurrentProcessId CreateDirectoryW SizeofResource VirtualAlloc GetSystemDirectoryW ExitThread GetLastError OutputDebugStringW LoadResource FindResourceW HeapReAlloc HeapSize SetStdHandle GetProcessHeap FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetCPInfo GetOEMCP IsValidCodePage FindNextFileA FindFirstFileExA GetStringTypeW GetConsoleCP FlushFileBuffers LCMapStringW GetConsoleMode SetFilePointerEx HeapAlloc HeapFree GetACP WideCharToMultiByte QueryPerformanceCounter FreeLibrary GetProcAddress ExitProcess WriteConsoleW GetModuleHandleExW GetModuleFileNameA GetFileType GetStdHandle MultiByteToWideChar SetLastError GetModuleFileNameW RtlUnwindEx LoadLibraryExW TlsFree TlsSetValue TlsGetValue EnterCriticalSection LeaveCriticalSection DeleteCriticalSection CreateEventW GetModuleHandleW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead RtlPcToFileHeader EncodePointer RaiseException InitializeCriticalSectionAndSpinCount TlsAlloc

user32

wsprintfW

advapi32

SystemFunction036 RegCreateKeyExW RegCloseKey RegSetKeyValueW RegOpenKeyExW RegSetValueExW

shell32

SHGetSpecialFolderPathW

Name

.text

Size

61KB

Virtual Size

60KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

320KB

Virtual Size

319KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gfids

Size

512B

Virtual Size

224B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1.2MB

Virtual Size

1.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-29_c4a79e9f3206263e26586625690b2e76_icedid_mespinoza_ryuk

kernel32

user32

advapi32

shell32

generic