2026-10-27_ebe29a0fcf13f21fcb389d5acf8ae801_icedid_mespinoza_njrat_ryuk

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-27_ebe29a0fcf13f21fcb389d5acf8ae801_icedid_mespinoza_njrat_ryuk
Size 2.0MB
Sample261027-227hmsgw5t
SHA256 8aee4b6b7260594a4811c0f88169984a63d4a3a80e42c5cf7ad6dbb14e4637ae
MD5 ebe29a0fcf13f21fcb389d5acf8ae801
SHA1 c66310d1e743266e2a0dfde45286219253ea6889
SHA512 e214e4a0aecee19cfd3bab1c788e79b3be333c22ab94f4bac2542b938060dd01b23343e1c92447f1f20d67f2b0e6fa3ce0c7069babcd614fd1139a87b95a1ce9
SSDEEP 24576:zonB0LE2zKV0ICMO//35gUKSJozCh9bEO:zo07zKaICN/3Hh9A
TLSH
T152A5AE16A69C7CE6C0729238A77387C2E33EFC054761C69F12D092295E3F9927D3A791
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-27_ebe29a0fcf13f21fcb389d5acf8ae801_icedid_mespinoza_njrat_ryuk

File Explorer

2026-10-27_ebe29a0fcf13f21fcb389d5acf8ae801_icedid_mespinoza_njrat_ryuk

.exe 2.0MB

2026-10-27_ebe29a0fcf13f21fcb389d5acf8ae801_icedid_mespinoza_njrat_ryuk

IMPHASH 17798f99bfe8b24b380b00240e3c47e6
SHA256 8aee4b6b7260594a4811c0f88169984a63d4a3a80e42c5cf7ad6dbb14e4637ae
MD5 ebe29a0fcf13f21fcb389d5acf8ae801
SHA1 c66310d1e743266e2a0dfde45286219253ea6889
SHA512 e214e4a0aecee19cfd3bab1c788e79b3be333c22ab94f4bac2542b938060dd01b23343e1c92447f1f20d67f2b0e6fa3ce0c7069babcd614fd1139a87b95a1ce9
SSDEEP 24576:zonB0LE2zKV0ICMO//35gUKSJozCh9bEO:zo07zKaICN/3Hh9A
TLSH
T152A5AE16A69C7CE6C0729238A77387C2E33EFC054761C69F12D092295E3F9927D3A791
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

170868

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

E:\DUOWAN_BUILD\build\Build_Src\dwinternal\YYAudioGo_1.2rel_mb\bin\Release\YYAudioGo_x64.pdb

winmm

timeGetTime

kernel32

CreateToolhelp32Snapshot MultiByteToWideChar GetLastError Process32NextW OutputDebugStringW CloseHandle LoadLibraryW GetProcAddress GetCurrentProcessId GetModuleHandleW FreeLibrary GetFileTime CreateRemoteThreadEx WriteProcessMemory EnterCriticalSection LeaveCriticalSection InitializeCriticalSection WaitForSingleObject Sleep VirtualAllocEx DeleteCriticalSection VirtualFreeEx DecodePointer HeapAlloc HeapReAlloc HeapFree HeapSize GetProcessHeap RaiseException InitializeCriticalSectionAndSpinCount GetFileSizeEx WideCharToMultiByte GetFileAttributesW DeleteFileW SetLastError SetEvent ResetEvent ReleaseMutex GetFileSize OpenProcess ReadFile SetEndOfFile SetFilePointer GetLocalTime MapViewOfFile UnmapViewOfFile CreateEventW CreateFileMappingW GetCommandLineW CopyFileW MoveFileW HeapCreate FindFirstFileExW FindClose GetConsoleCP ReadConsoleW GetConsoleMode EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetFileType GetACP GetStdHandle ExitProcess FreeLibraryAndExitThread ExitThread CreateThread GetFileAttributesExW LoadLibraryExW RtlUnwindEx RtlPcToFileHeader InitializeSListHead QueryPerformanceCounter GetStartupInfoW IsDebuggerPresent IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext WaitForSingleObjectEx GetSystemTimeAsFileTime TlsFree TlsSetValue TlsGetValue GetCurrentThreadId CreateFileW CreateMutexW GetEnvironmentVariableW GetModuleFileNameW TerminateProcess GetModuleHandleExW GetCurrentProcess GetModuleFileNameA SetFilePointerEx WriteFile WriteConsoleW TlsAlloc GetLocaleInfoW LCMapStringW GetCPInfo FlushFileBuffers SetStdHandle EncodePointer GetStringTypeW FindNextFileW IsValidCodePage GetOEMCP FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA

user32

MsgWaitForMultipleObjects SendMessageW PeekMessageW PostThreadMessageW GetMessageW DefWindowProcW PostMessageW DestroyWindow SetWindowLongPtrW CreateWindowExW RegisterClassExW LoadAcceleratorsW LoadStringW DispatchMessageW SetTimer TranslateAcceleratorW TranslateMessage LoadCursorW KillTimer PostQuitMessage UpdateWindow BeginPaint EndPaint GetWindowThreadProcessId AllowSetForegroundWindow GetWindow FindWindowExW IsWindowVisible SetActiveWindow SetWindowTextW GetWindowLongPtrW ShowWindow IsWindow AttachThreadInput GetForegroundWindow SetFocus BringWindowToTop SystemParametersInfoW SetForegroundWindow LoadIconW

advapi32

AdjustTokenPrivileges OpenProcessToken CreateProcessAsUserW GetTokenInformation LookupPrivilegeValueW

shell32

SHCreateDirectoryExW ord165 CommandLineToArgvW

shlwapi

PathAppendW PathFileExistsW PathFindFileNameA PathFindFileNameW

userenv

CreateEnvironmentBlock DestroyEnvironmentBlock

Name

.text

Size

302KB

Virtual Size

301KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

123KB

Virtual Size

122KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

14KB

Virtual Size

14KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.gfids

Size

512B

Virtual Size

404B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

93KB

Virtual Size

93KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

1.5MB

Virtual Size

2.5MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-27_ebe29a0fcf13f21fcb389d5acf8ae801_icedid_mespinoza_njrat_ryuk

winmm

kernel32

user32

advapi32

shell32

shlwapi

userenv

generic