2026-10-16_eb3a62eb1696899ee5f3359554331b88_icedid_mespinoza_njrat_ryuk

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-16_eb3a62eb1696899ee5f3359554331b88_icedid_mespinoza_njrat_ryuk
Size 280KB
Sample261017-eak41ahv4s
SHA256 9a119c83b04e3c6ff0f25a776e07bded4984115aa1f52d75fdbcbd64d8f980d7
MD5 eb3a62eb1696899ee5f3359554331b88
SHA1 75678d142d50c754ebf67c899cb2f752848c0c0c
SHA512 fca99f9dce263bb6e25920acb168c0b65590353d4a121fa9a9de4586cdb9f164a1c33ed7c721d49d59bf9f932de1193e8f8628c566f76481931c21b2348602aa
SSDEEP 6144:BmcS2I+HvgZ/wtc/rxKUn/1mAgxgRixk0USohFn0Cb:9S2tI9wsxKQ0wSo77b
TLSH
T18C546B19B7A91CF5E873813CCD528545E6B278160B31D6EF03A4436A6F376E09E3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-16_eb3a62eb1696899ee5f3359554331b88_icedid_mespinoza_njrat_ryuk

File Explorer

2026-10-16_eb3a62eb1696899ee5f3359554331b88_icedid_mespinoza_njrat_ryuk

.exe 280KB

2026-10-16_eb3a62eb1696899ee5f3359554331b88_icedid_mespinoza_njrat_ryuk

IMPHASH b9b2c1fc9bf0e67f4bf45c7286e4ff86
SHA256 9a119c83b04e3c6ff0f25a776e07bded4984115aa1f52d75fdbcbd64d8f980d7
MD5 eb3a62eb1696899ee5f3359554331b88
SHA1 75678d142d50c754ebf67c899cb2f752848c0c0c
SHA512 fca99f9dce263bb6e25920acb168c0b65590353d4a121fa9a9de4586cdb9f164a1c33ed7c721d49d59bf9f932de1193e8f8628c566f76481931c21b2348602aa
SSDEEP 6144:BmcS2I+HvgZ/wtc/rxKUn/1mAgxgRixk0USohFn0Cb:9S2tI9wsxKQ0wSo77b
TLSH
T18C546B19B7A91CF5E873813CCD528545E6B278160B31D6EF03A4436A6F376E09E3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

62972

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Service64.pdb

windivert

WinDivertHelperCalcChecksums WinDivertOpen WinDivertSend WinDivertHelperParsePacket WinDivertRecvEx WinDivertClose

kernel32

SetEvent CloseHandle CreateThread CancelIo CreateFileW GetOverlappedResult InitializeCriticalSectionEx GetLastError RaiseException DecodePointer LocalFree DeleteCriticalSection GetConsoleMode GetConsoleCP GetExitCodeThread CreateEventW WaitForSingleObject FindResourceW LoadResource LockResource SizeofResource SetFilePointerEx FlushFileBuffers WriteConsoleW IsValidCodePage GetOEMCP GetEnvironmentStringsW Sleep CompareStringW HeapSize SetStdHandle SetEnvironmentVariableA FindNextFileA FindFirstFileExA FindClose WideCharToMultiByte EnterCriticalSection LeaveCriticalSection EncodePointer MultiByteToWideChar SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemTimeAsFileTime GetModuleHandleW GetProcAddress LCMapStringW GetLocaleInfoW GetStringTypeW GetCPInfo ResetEvent WaitForSingleObjectEx RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId InitializeSListHead OutputDebugStringW RtlPcToFileHeader RtlUnwindEx FreeLibrary LoadLibraryExW HeapAlloc HeapReAlloc HeapFree ExitProcess GetModuleHandleExW GetModuleFileNameA GetStdHandle WriteFile GetCommandLineA GetCommandLineW GetACP GetFileType IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetProcessHeap FreeEnvironmentStringsW

advapi32

DeregisterEventSource SetServiceStatus RegisterServiceCtrlHandlerW StartServiceCtrlDispatcherW RegisterEventSourceW ReportEventW

ole32

CoCreateInstance CoInitializeSecurity CoInitializeEx CoUninitialize

oleaut32

VariantInit SysFreeString SysAllocString VariantClear

Name

.text

Size

169KB

Virtual Size

168KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

89KB

Virtual Size

89KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

9KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.gfids

Size

512B

Virtual Size

504B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-16_eb3a62eb1696899ee5f3359554331b88_icedid_mespinoza_njrat_ryuk

windivert

kernel32

advapi32

ole32

oleaut32

generic