2026-10-22_85c0be023f06aae9c529d92a2ab4237b_icedid_mespinoza_njrat_ryuk

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-22_85c0be023f06aae9c529d92a2ab4237b_icedid_mespinoza_njrat_ryuk
Size 1.3MB
Sample261024-gv1fjaed49
SHA256 e4488fa4832d02f3c1f219a3f04da8a68a2610bc2248f8353c33983ef11f5acf
MD5 85c0be023f06aae9c529d92a2ab4237b
SHA1 674b3f182fdec7692a0a7c1e0315d3b0275a8b3b
SHA512 1ef53bbc847db9e7efdf53f1e4cfffb5367b028544f28b9ccad2f2c439ab1ac07d56c21312bbd67bf55b3c304a04973bd5f0de54b10f304110aea1c884887901
SSDEEP 12288:3O/KZBMw5sEGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWD:3jjf5bnQ/tbw/2Mkjy6Fr7g0oD
TLSH
T13955F6E6D2CC3778C3656CF484B0082F933B3D4E460286D557E678E68B3A56A8BFD215
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-22_85c0be023f06aae9c529d92a2ab4237b_icedid_mespinoza_njrat_ryuk

File Explorer

2026-10-22_85c0be023f06aae9c529d92a2ab4237b_icedid_mespinoza_njrat_ryuk

.exe 1.3MB

2026-10-22_85c0be023f06aae9c529d92a2ab4237b_icedid_mespinoza_njrat_ryuk

IMPHASH 7ce333127d54334622f00b7d4015ce9a
SHA256 e4488fa4832d02f3c1f219a3f04da8a68a2610bc2248f8353c33983ef11f5acf
MD5 85c0be023f06aae9c529d92a2ab4237b
SHA1 674b3f182fdec7692a0a7c1e0315d3b0275a8b3b
SHA512 1ef53bbc847db9e7efdf53f1e4cfffb5367b028544f28b9ccad2f2c439ab1ac07d56c21312bbd67bf55b3c304a04973bd5f0de54b10f304110aea1c884887901
SSDEEP 12288:3O/KZBMw5sEGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWD:3jjf5bnQ/tbw/2Mkjy6Fr7g0oD
TLSH
T13955F6E6D2CC3778C3656CF484B0082F933B3D4E460286D557E678E68B3A56A8BFD215
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

34692

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

E:\build_que\pm-driver-VM5\run\x64\release\LPlatSvc.pdb

kernel32

WTSGetActiveConsoleSessionId GetCurrentProcess TerminateProcess GetTickCount FreeLibraryAndExitThread ResumeThread ExitThread TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount WriteConsoleW SetFilePointerEx GetConsoleMode GetConsoleCP FreeLibrary SetStdHandle FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetCPInfo GetOEMCP IsValidCodePage GetProcAddress LoadLibraryExW DisconnectNamedPipe ReadFile ConnectNamedPipe CreateNamedPipeW WaitNamedPipeW SetEvent WaitForSingleObject LocalAlloc GetCurrentProcessId ProcessIdToSessionId CreateThread Sleep CreateMutexW ResetEvent WaitForMultipleObjects CreateEventW GetModuleFileNameW lstrlenW CloseHandle WriteFile GetCurrentThreadId LocalFree lstrcmpiW DeviceIoControl CreateFileW SetLastError FindNextFileW FindFirstFileExW FindClose GetLastError FlushFileBuffers LCMapStringW GetStringTypeW GetFileType RtlUnwindEx GetACP ExitProcess WideCharToMultiByte MultiByteToWideChar GetStdHandle HeapFree InitializeCriticalSectionEx HeapSize HeapReAlloc RaiseException HeapAlloc HeapDestroy DeleteCriticalSection GetProcessHeap GetSystemPowerStatus CallNamedPipeW CreateToolhelp32Snapshot Process32FirstW Process32NextW CreateProcessW OpenMutexW ReleaseMutex EnterCriticalSection LeaveCriticalSection WaitForSingleObjectEx GetModuleHandleW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent QueryPerformanceCounter GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW OutputDebugStringW RtlPcToFileHeader EncodePointer GetModuleHandleExW

user32

GetMessageW TranslateMessage LoadAcceleratorsW LoadStringW RegisterPowerSettingNotification GetRawInputData GetRawInputDeviceInfoW SendMessageW TranslateAcceleratorW EndDialog PostQuitMessage EndPaint BeginPaint DefWindowProcW DestroyWindow DialogBoxParamW RegisterRawInputDevices UpdateWindow ShowWindow DispatchMessageW LoadIconW LoadCursorW RegisterClassExW CreateWindowExW FindWindowW

advapi32

LookupPrivilegeValueW RegisterServiceCtrlHandlerExW ChangeServiceConfigW StartServiceW QueryServiceStatusEx DeleteService QueryServiceStatus CreateServiceW DuplicateTokenEx AdjustTokenPrivileges CreateProcessAsUserW RevertToSelf ImpersonateLoggedOnUser SetTokenInformation OpenProcessToken RegQueryValueExW RegOpenKeyExW RegCloseKey RegSetValueExW RegCreateKeyExW ControlService CloseServiceHandle OpenServiceW OpenSCManagerW DeregisterEventSource ReportEventW RegisterEventSourceW SetServiceStatus StartServiceCtrlDispatcherW

shell32

CommandLineToArgvW

wtsapi32

WTSQueryUserToken WTSQuerySessionInformationW

userenv

CreateEnvironmentBlock

hid

HidD_GetAttributes

setupapi

SetupDiDestroyDeviceInfoList SetupDiGetDeviceRegistryPropertyW SetupDiGetClassDevsW SetupDiEnumDeviceInterfaces SetupDiGetDeviceInterfaceDetailW

shlwapi

PathFindExtensionW

powrprof

GetCurrentPowerPolicies CallNtPowerInformation

ole32

CoCreateInstance CoInitializeEx CoUninitialize CoInitializeSecurity

oleaut32

VariantInit VariantClear SysAllocString SysFreeString SysStringByteLen SysAllocStringByteLen

Name

.text

Size

107KB

Virtual Size

106KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

57KB

Virtual Size

57KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

7KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.gfids

Size

512B

Virtual Size

248B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

556KB

Virtual Size

555KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

568KB

Virtual Size

572KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-22_85c0be023f06aae9c529d92a2ab4237b_icedid_mespinoza_njrat_ryuk

kernel32

user32

advapi32

shell32

wtsapi32

userenv

hid

setupapi

shlwapi

powrprof

ole32

oleaut32

generic