2026-10-22_91fb0ee97b771f6a894a879be8de65c1_icedid_mespinoza_njrat_ryuk

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-22_91fb0ee97b771f6a894a879be8de65c1_icedid_mespinoza_njrat_ryuk
Size 1.7MB
Sample261024-e9588afx8y
SHA256 8b676bc308ab1052f7ddd7ddf32aba3db5b2eafdae15f7a25117a193478490e5
MD5 91fb0ee97b771f6a894a879be8de65c1
SHA1 e9f87c1e77c7015dcda2a7d8b425a68c7068fc2a
SHA512 e78287377cfb69e18a8fa056e378dc3d3a417c88ee2fdbbc63e008b30ba98f902129f591f8cfe6adc8c5c3dccc53601fbf749d3a6a9ad6e2f9b0c2528f9f9505
SSDEEP 24576:NMA7qy/ccqNgPgGnQ/tbw/2Mkjy6Fr7g0oh:NMALpqNotQ/lFTjN4
TLSH
T1A185CF59AB5840E1E1B6C23888539942E7727C115B71EBDF1398E23A2F377D19E3AF10
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-22_91fb0ee97b771f6a894a879be8de65c1_icedid_mespinoza_njrat_ryuk

File Explorer

2026-10-22_91fb0ee97b771f6a894a879be8de65c1_icedid_mespinoza_njrat_ryuk

.exe 1.7MB

2026-10-22_91fb0ee97b771f6a894a879be8de65c1_icedid_mespinoza_njrat_ryuk

IMPHASH 6f5c0db94888579840ca838fd2a3500d
SHA256 8b676bc308ab1052f7ddd7ddf32aba3db5b2eafdae15f7a25117a193478490e5
MD5 91fb0ee97b771f6a894a879be8de65c1
SHA1 e9f87c1e77c7015dcda2a7d8b425a68c7068fc2a
SHA512 e78287377cfb69e18a8fa056e378dc3d3a417c88ee2fdbbc63e008b30ba98f902129f591f8cfe6adc8c5c3dccc53601fbf749d3a6a9ad6e2f9b0c2528f9f9505
SSDEEP 24576:NMA7qy/ccqNgPgGnQ/tbw/2Mkjy6Fr7g0oh:NMALpqNotQ/lFTjN4
TLSH
T1A185CF59AB5840E1E1B6C23888539942E7727C115B71EBDF1398E23A2F377D19E3AF10
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

162016

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\Workspace\sgorenbo\9.5_COMMON\SW\Src\Apps\PAVP2\PAVP30\IntelCpHeciSvc\x64\Release\IntelCpHeciSvc.pdb

setupapi

SetupDiGetClassDevsW SetupDiGetDeviceInterfaceDetailW SetupDiEnumDeviceInterfaces SetupDiDestroyDeviceInfoList

kernel32

ReadFile WriteFile GetOverlappedResult DeviceIoControl GetCommandLineW DecodePointer HeapAlloc HeapFree GetProcessHeap GetCurrentProcess GetCurrentThread LocalFree WriteConsoleW ReadConsoleW CreateFileW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetOEMCP IsValidCodePage FindNextFileW FindFirstFileExW FindClose Sleep MultiByteToWideChar lstrcmpiW FindResourceW SizeofResource LoadResource LoadLibraryExW GetProcAddress GetModuleHandleW GetModuleFileNameW FreeLibrary OpenProcess ResumeThread CreateThread CreateEventW WaitForMultipleObjectsEx WaitForSingleObject SetEvent InitializeCriticalSectionEx GetLastError RaiseException SetEndOfFile CloseHandle GetCurrentThreadId DeleteCriticalSection LeaveCriticalSection EnterCriticalSection InitializeCriticalSection QueryPerformanceFrequency QueryPerformanceCounter ExpandEnvironmentStringsW ExitThread FreeLibraryAndExitThread SetStdHandle HeapSize EnumSystemLocalesW GetUserDefaultLCID RtlUnwindEx IsValidLocale SetFilePointerEx GetConsoleMode GetConsoleCP FlushFileBuffers GetFileType GetACP GetStdHandle ExitProcess HeapReAlloc RtlPcToFileHeader OutputDebugStringW InitializeSListHead GetCurrentProcessId GetStartupInfoW IsDebuggerPresent IsProcessorFeaturePresent TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext WaitForSingleObjectEx ResetEvent GetCPInfo GetLocaleInfoW LCMapStringW WideCharToMultiByte GetStringTypeW EncodePointer SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemTimeAsFileTime GetModuleHandleExW

user32

RegisterDeviceNotificationW UnregisterDeviceNotification LoadStringW RegisterWindowMessageW GetMessageA GetMessageW TranslateMessage DispatchMessageA DispatchMessageW PeekMessageW PostThreadMessageW CharUpperW MsgWaitForMultipleObjectsEx IsWindowUnicode MessageBoxW CharNextW

advapi32

RegQueryValueExW ConvertStringSecurityDescriptorToSecurityDescriptorW StartServiceCtrlDispatcherW SetServiceStatus RegisterServiceCtrlHandlerExW QueryServiceConfigW OpenServiceW OpenSCManagerW DeleteService CreateServiceW ControlService CloseServiceHandle ChangeServiceConfigW RegSetValueExA RegQueryValueExA RegOpenKeyW SetSecurityDescriptorOwner SetSecurityDescriptorGroup MakeAbsoluteSD IsValidSid InitializeSecurityDescriptor GetTokenInformation GetSecurityDescriptorLength GetLengthSid CopySid OpenThreadToken OpenProcessToken RegSetValueExW RegQueryInfoKeyW RegOpenKeyExW RegEnumKeyExW RegDeleteValueW RegDeleteKeyW RegCreateKeyExW RegCloseKey

ole32

CoTaskMemAlloc CoTaskMemRealloc CoTaskMemFree CoInitializeEx CoRegisterClassObject CoRevokeClassObject CoResumeClassObjects CoAddRefServerProcess CoReleaseServerProcess CoMarshalInterThreadInterfaceInStream CoGetInterfaceAndReleaseStream CoInitializeSecurity CoCreateInstance StringFromGUID2 CoInitialize CoUninitialize

oleaut32

UnRegisterTypeLi RegisterTypeLi SysAllocString VariantClear VariantInit SafeArrayGetVartype SafeArrayCopy SafeArrayUnlock SafeArrayLock SafeArrayGetLBound SafeArrayGetUBound SafeArrayRedim SafeArrayDestroy SafeArrayCreate LoadRegTypeLi LoadTypeLi VarUI4FromStr SysStringLen SysFreeString

Name

.text

Size

287KB

Virtual Size

287KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

142KB

Virtual Size

141KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

8KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

16KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

1.2MB

Virtual Size

1.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-22_91fb0ee97b771f6a894a879be8de65c1_icedid_mespinoza_njrat_ryuk

setupapi

kernel32

user32

advapi32

ole32

oleaut32

generic