2026-09-29_1f60dfc2f4fd8390ee9cb5cbf3dd8888_icedid_mespinoza_njrat_ryuk

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-29_1f60dfc2f4fd8390ee9cb5cbf3dd8888_icedid_mespinoza_njrat_ryuk
Size 2.0MB
Sample260930-e8qgdats9l
SHA256 704ab8cdef7e0d2e4c1877a1ffb2b2c34a61252eca44548b6417805eebe20090
MD5 1f60dfc2f4fd8390ee9cb5cbf3dd8888
SHA1 d6887ec399fadbd9353e540f30ea85559ab364df
SHA512 a951cfda62d17deab0df148ed314a3a518f86016081b9d780482bf57443995a0d2bacee29d04cca82483ab162703942c0f5fb82196ffc3574e58a74c4e3fd541
SSDEEP 49152:FBX80qFCv9dsl7jJRnBcOWc1nc03elhzHTr7H:lqotWn7erf3
TLSH
T129A59D4972F836ACE7F64B3595E12137DA36BC96A7F087CB064C315C2E326A04576F22
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-29_1f60dfc2f4fd8390ee9cb5cbf3dd8888_icedid_mespinoza_njrat_ryuk

File Explorer

2026-09-29_1f60dfc2f4fd8390ee9cb5cbf3dd8888_icedid_mespinoza_njrat_ryuk

.exe 2.0MB

2026-09-29_1f60dfc2f4fd8390ee9cb5cbf3dd8888_icedid_mespinoza_njrat_ryuk

IMPHASH c084d2d99e2965d15334229eeaa584c1
SHA256 704ab8cdef7e0d2e4c1877a1ffb2b2c34a61252eca44548b6417805eebe20090
MD5 1f60dfc2f4fd8390ee9cb5cbf3dd8888
SHA1 d6887ec399fadbd9353e540f30ea85559ab364df
SHA512 a951cfda62d17deab0df148ed314a3a518f86016081b9d780482bf57443995a0d2bacee29d04cca82483ab162703942c0f5fb82196ffc3574e58a74c4e3fd541
SSDEEP 49152:FBX80qFCv9dsl7jJRnBcOWc1nc03elhzHTr7H:lqotWn7erf3
TLSH
T129A59D4972F836ACE7F64B3595E12137DA36BC96A7F087CB064C315C2E326A04576F22
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

367920

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_ISOLATION IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\enterp-branch\dev-1824\DevOps\CTI\PRJ\Deploy\Release\CTDPL.PDB

kernel32

ReadFile WriteFile GetTempPathW CreateFileW CloseHandle GetFileSize FindFirstFileW FindNextFileW FindClose GetFileAttributesW Sleep GetCurrentProcessId CreateDirectoryW SizeofResource VirtualAlloc GetSystemDirectoryW ExitThread GetLastError OutputDebugStringW CreateThread LoadResource FindResourceW SetEndOfFile HeapReAlloc HeapSize SetStdHandle GetProcessHeap GlobalUnlock SetEnvironmentVariableA FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetCPInfo GetOEMCP IsValidCodePage FindNextFileA FindFirstFileExA GetStringTypeW GetConsoleCP FlushFileBuffers GetTimeZoneInformation LCMapStringW CompareStringW ReadConsoleW GetConsoleMode SetFilePointerEx HeapAlloc HeapFree GetACP ExitProcess WideCharToMultiByte GlobalLock GlobalFree GlobalAlloc OutputDebugStringA QueryPerformanceCounter FreeLibrary VerSetConditionMask GetProcAddress IsDBCSLeadByte WriteConsoleW GetModuleHandleA GetModuleHandleExW GetModuleFileNameA GetFileType GetStdHandle SetLastError QueryPerformanceFrequency LoadLibraryA MultiByteToWideChar GetLocaleInfoA GetModuleFileNameW RtlUnwindEx LoadLibraryExW TlsFree TlsSetValue TlsGetValue TlsAlloc EnterCriticalSection LeaveCriticalSection DeleteCriticalSection SetEvent ResetEvent WaitForSingleObjectEx CreateEventW GetModuleHandleW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead RtlPcToFileHeader EncodePointer RaiseException InitializeCriticalSectionAndSpinCount

user32

SetCursorPos ReleaseCapture IsWindowUnicode SetProcessDPIAware ReleaseDC SetCursor SetCapture GetForegroundWindow GetKeyboardLayout TrackMouseEvent GetCursorPos GetClientRect wsprintfW MonitorFromPoint DispatchMessageA DestroyWindow CreateWindowExW UnregisterClassW RegisterClassExW ShowWindow TranslateMessage PeekMessageA UpdateWindow OpenClipboard CloseClipboard EmptyClipboard GetClipboardData SetClipboardData DefWindowProcW GetKeyState GetMessageExtraInfo LoadCursorA GetDC ScreenToClient GetCapture ClientToScreen

gdi32

GetDeviceCaps

advapi32

SystemFunction036 RegCreateKeyExW RegCloseKey RegSetKeyValueW RegOpenKeyExW RegSetValueExW

shell32

SHGetSpecialFolderPathW ShellExecuteW

imm32

ImmGetContext ImmReleaseContext ImmSetCompositionWindow ImmSetCandidateWindow

d3d9

Direct3DCreate9

Name

.text

Size

490KB

Virtual Size

489KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

363KB

Virtual Size

363KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

27KB

Virtual Size

26KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gfids

Size

512B

Virtual Size

252B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1.2MB

Virtual Size

1.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-29_1f60dfc2f4fd8390ee9cb5cbf3dd8888_icedid_mespinoza_njrat_ryuk

kernel32

user32

gdi32

advapi32

shell32

imm32

d3d9

generic