2026-10-22_0b910d8c3e593ec9c71928bb57a0f5a9_icedid_mespinoza_njrat_ryuk

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-22_0b910d8c3e593ec9c71928bb57a0f5a9_icedid_mespinoza_njrat_ryuk
Size 1.3MB
Sample261024-112qbsxtev
SHA256 1bf0b5c1bfbc13bde59c50e9e3677e5b3da0c3f86012ba371f8d14c9b48912ab
MD5 0b910d8c3e593ec9c71928bb57a0f5a9
SHA1 5cae2f810dcec909fa45a4cf86dbc4fe384327a8
SHA512 cf8f923ca586cfb509cf1dfda5c5a6311445ccc112fa732969c549d1b7098708fd33e5339e1771dbd244f37c15aa5d3ee2a445c1bb4d858b43b36bc2b6580444
SSDEEP 24576:+uKxZ8VxWKAaNUF3P+iMod87mLWNNrIQsqjnhMgeiCl7G0nehbGZpbD:+uC8VxnUF3P+97ma3Dmg27RnWGj
TLSH
T1E355CF19B7A941E5E073923A89628251EBB2BC111B31D7DF5254B32F1F33AD44F3A722
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-22_0b910d8c3e593ec9c71928bb57a0f5a9_icedid_mespinoza_njrat_ryuk

File Explorer

2026-10-22_0b910d8c3e593ec9c71928bb57a0f5a9_icedid_mespinoza_njrat_ryuk

.exe 1.3MB

2026-10-22_0b910d8c3e593ec9c71928bb57a0f5a9_icedid_mespinoza_njrat_ryuk

IMPHASH e2d623988e22fa541ef045f179f9f95f
SHA256 1bf0b5c1bfbc13bde59c50e9e3677e5b3da0c3f86012ba371f8d14c9b48912ab
MD5 0b910d8c3e593ec9c71928bb57a0f5a9
SHA1 5cae2f810dcec909fa45a4cf86dbc4fe384327a8
SHA512 cf8f923ca586cfb509cf1dfda5c5a6311445ccc112fa732969c549d1b7098708fd33e5339e1771dbd244f37c15aa5d3ee2a445c1bb4d858b43b36bc2b6580444
SSDEEP 24576:+uKxZ8VxWKAaNUF3P+iMod87mLWNNrIQsqjnhMgeiCl7G0nehbGZpbD:+uC8VxnUF3P+97ma3Dmg27RnWGj
TLSH
T1E355CF19B7A941E5E073923A89628251EBB2BC111B31D7DF5254B32F1F33AD44F3A722
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

258424

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

advapi32

RegCloseKey RegOpenKeyExW RegQueryValueExW DuplicateToken OpenProcessToken GetTokenInformation RegCreateKeyExW RegDeleteValueW RegSetValueExW

comdlg32

ChooseColorW GetSaveFileNameW GetOpenFileNameW

psapi

GetProcessImageFileNameW

shlwapi

SHDeleteKeyW PathFileExistsW

kernel32

DeleteFileW VerSetConditionMask GetProcAddress OpenProcess GetCurrentProcess GetCurrentProcessId GetCurrentThreadId GetLastError InitializeCriticalSection EnterCriticalSection LeaveCriticalSection DeleteCriticalSection Sleep MulDiv lstrcpyW LoadLibraryW GetModuleFileNameW GetModuleHandleW OutputDebugStringA GetTempPathW SetPriorityClass VerifyVersionInfoW lstrlenW GlobalReAlloc lstrcpyA lstrlenA WideCharToMultiByte ReleaseMutex CreateMutexW GetVersionExW MultiByteToWideChar WriteConsoleW FlushFileBuffers CreateFileW SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA FindNextFileA FindFirstFileExA FindClose GetProcessHeap SetFilePointerEx ReadConsoleW GetConsoleMode GetConsoleCP GetOEMCP IsValidCodePage EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetFileType WriteFile GetStdHandle GetModuleFileNameA GetModuleHandleExW ExitProcess HeapFree HeapReAlloc HeapAlloc MoveFileExW ReadFile GetACP GetFileAttributesExW LoadLibraryExW FreeLibrary RaiseException RtlPcToFileHeader RtlUnwindEx LocalFree InitializeSListHead QueryPerformanceCounter GetStartupInfoW IsDebuggerPresent IsProcessorFeaturePresent TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext WaitForSingleObjectEx ResetEvent GetCPInfo GetLocaleInfoW LCMapStringW CompareStringW GetStringTypeW GetSystemTimeAsFileTime TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount SetLastError DecodePointer EncodePointer SetEndOfFile HeapSize LockResource LoadResource SizeofResource WritePrivateProfileSectionW GetPrivateProfileSectionW WritePrivateProfileStringW GetPrivateProfileStringW FindResourceW CreateEventW GetTickCount CloseHandle WaitForSingleObject SetEvent CreateThread GlobalFree GlobalUnlock GlobalLock GlobalSize GlobalAlloc SetStdHandle

user32

RegisterClassExW PostQuitMessage DispatchMessageW TranslateMessage GetMessageW RegisterWindowMessageW CallNextHookEx SetForegroundWindow ToAsciiEx BringWindowToTop TrackPopupMenu GetMenuDefaultItem DestroyMenu LoadMenuW GetSystemMetrics CallWindowProcW SetWindowLongPtrW GetWindowLongPtrW GetSysColor CreateDialogParamW DefWindowProcW SetMenuDefaultItem CheckMenuItem FindWindowW RegisterRawInputDevices GetRawInputData IsDialogMessageW LoadStringW UnhookWindowsHookEx SetWindowsHookExW GetSubMenu RegisterShellHookWindow DrawTextA GetDC ReleaseDC IsClipboardFormatAvailable GetClipboardOwner LockWindowUpdate GetWindowTextA SetWindowTextA DestroyIcon CreateIconIndirect OpenClipboard CloseClipboard SendMessageA GetTabbedTextExtentW SetFocus DrawTextW SetWindowPos DestroyWindow CreateWindowExW LoadIconW LoadCursorW SetCursor RedrawWindow GetWindowDC UpdateWindow KillTimer SetTimer ReleaseCapture SetCapture ShowWindow DrawIconEx PtInRect FillRect InvalidateRect EndDialog GetWindowRect EnableWindow MoveWindow SetWindowTextW SendDlgItemMessageW GetDlgItem GetGUIThreadInfo LoadImageW GetWindowThreadProcessId EnumWindows FindWindowExW WindowFromPoint ScreenToClient GetCursorPos MessageBeep MessageBoxW GetClientRect GetWindowTextW GetForegroundWindow IsWindowUnicode IsWindow SendMessageW GetProcessWindowStation SetProcessWindowStation CloseWindowStation OpenWindowStationW GetThreadDesktop CloseDesktop SetThreadDesktop OpenDesktopW MapVirtualKeyExW VkKeyScanExW GetKeyboardLayout GetKeyboardLayoutNameW ActivateKeyboardLayout LoadKeyboardLayoutW SendInput VkKeyScanW GetKeyboardState GetAsyncKeyState GetKeyState PostMessageW EmptyClipboard GetClipboardFormatNameW RegisterClipboardFormatW GetClipboardData SetClipboardData DialogBoxParamW

gdi32

CreateFontW DeleteDC DeleteObject AddFontMemResourceEx SelectObject SetBkMode SetTextColor CreateDIBSection GetDeviceCaps CreateSolidBrush CreatePen GetStockObject Rectangle GetTextExtentPoint32W SetBkColor TextOutW BitBlt CreateCompatibleBitmap LineTo MoveToEx GetObjectW GetTextExtentPoint32A CreateCompatibleDC

shell32

ShellExecuteW SHGetFolderPathW Shell_NotifyIconW

ole32

CoInitializeEx CoCreateInstance CoUninitialize CoInitialize CoTaskMemFree CoTaskMemAlloc

oleaut32

SysAllocString SysFreeString VariantInit VariantClear

version

VerQueryValueW GetFileVersionInfoW GetFileVersionInfoSizeW

Name

.text

Size

419KB

Virtual Size

418KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

174KB

Virtual Size

173KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

28KB

Virtual Size

73KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

23KB

Virtual Size

23KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.gfids

Size

512B

Virtual Size

380B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

152KB

Virtual Size

151KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

572KB

Virtual Size

576KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-22_0b910d8c3e593ec9c71928bb57a0f5a9_icedid_mespinoza_njrat_ryuk

advapi32

comdlg32

psapi

shlwapi

kernel32

user32

gdi32

shell32

ole32

oleaut32

version

generic