2026-11-02_f06db3c92102689ab360124bb2dc360e_icedid_mespinoza_njrat_ryuk

Sharing

Copy URL Twitter E-mail

General

Target
2026-11-02_f06db3c92102689ab360124bb2dc360e_icedid_mespinoza_njrat_ryuk
Size 6.1MB
Sample261102-xa85yaex4k
SHA256 93acd1efc7fc13461729719ce7496f442774a4ef488b81cb7c747dfa77a660a6
MD5 f06db3c92102689ab360124bb2dc360e
SHA1 6cf6dc1cc2308a957afd5b8fa472f9bee23142a7
SHA512 f24ee3fee7b8adb948f103e53485cea58f1cf4347469042c8d84cd301fb51e7d59357fe7a37bfced8c06e593f76186d213423b30d4615b2906d898f37ddfcb3f
SSDEEP 49152:CfBlkfF+70IXc/l/ChQw8wyW74+fdjuZYst+ppU2ilFhIY/Zt9vkjMcPtSJq8thh:zCX7CDENh
TLSH
T10F56B617A76921E5C1BBC13C95936B22FC6030E5473967E74681866A2B70FF8BD3E720
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-11-02_f06db3c92102689ab360124bb2dc360e_icedid_mespinoza_njrat_ryuk

File Explorer

2026-11-02_f06db3c92102689ab360124bb2dc360e_icedid_mespinoza_njrat_ryuk

.exe 6.1MB

2026-11-02_f06db3c92102689ab360124bb2dc360e_icedid_mespinoza_njrat_ryuk

IMPHASH b61ca755aaf885ae2c13f83b98055ba3
SHA256 93acd1efc7fc13461729719ce7496f442774a4ef488b81cb7c747dfa77a660a6
MD5 f06db3c92102689ab360124bb2dc360e
SHA1 6cf6dc1cc2308a957afd5b8fa472f9bee23142a7
SHA512 f24ee3fee7b8adb948f103e53485cea58f1cf4347469042c8d84cd301fb51e7d59357fe7a37bfced8c06e593f76186d213423b30d4615b2906d898f37ddfcb3f
SSDEEP 49152:CfBlkfF+70IXc/l/ChQw8wyW74+fdjuZYst+ppU2ilFhIY/Zt9vkjMcPtSJq8thh:zCX7CDENh
TLSH
T10F56B617A76921E5C1BBC13C95936B22FC6030E5473967E74681866A2B70FF8BD3E720
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

3946768

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\source\repo\engine\trunk\db\norm\compiler-test\build\windows_clang_x86_64_Debug\test\Debug\compiler_test_1\compiler_test_1.pdb

shell32

SHGetKnownFolderPath

ole32

CoTaskMemFree

kernel32

AcquireSRWLockExclusive AreFileApisANSI CloseHandle CompareStringEx CompareStringW CopyFile2 CreateDirectoryExW CreateDirectoryW CreateEventA CreateFile2 CreateFileA CreateFileW CreateHardLinkW CreatePipe CreateProcessA CreateSymbolicLinkW DecodePointer DeleteCriticalSection DeviceIoControl EncodePointer EnterCriticalSection EnumSystemLocalesW ExitProcess FindClose FindFirstFileExW FindFirstFileW FindNextFileW FlsAlloc FlsFree FlsGetValue FlsSetValue FlushFileBuffers FlushProcessWriteBuffers FormatMessageA FreeEnvironmentStringsW FreeLibrary GetACP GetCPInfo GetCommandLineA GetCommandLineW GetConsoleMode GetConsoleOutputCP GetCurrentDirectoryW GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetDateFormatW GetDiskFreeSpaceExA GetDiskFreeSpaceExW GetEnvironmentStringsW GetExitCodeProcess GetFileAttributesExA GetFileAttributesExW GetFileAttributesW GetFileInformationByHandle GetFileInformationByHandleEx GetFileSizeEx GetFileType GetFinalPathNameByHandleW GetFullPathNameW GetLargePageMinimum GetLastError GetLocaleInfoEx GetLocaleInfoW GetLogicalDriveStringsA GetModuleFileNameA GetModuleFileNameW GetModuleHandleExW GetModuleHandleW GetOEMCP GetProcAddress GetProcessHeap GetProcessWorkingSetSize GetStartupInfoW GetStdHandle GetStringTypeW GetSystemInfo GetSystemTimeAsFileTime GetTempPathW GetTickCount64 GetTimeFormatW GetTimeZoneInformation GetUserDefaultLCID GetVolumeInformationA GetVolumeInformationByHandleW HeapAlloc HeapFree HeapQueryInformation HeapReAlloc HeapSize HeapValidate InitializeCriticalSectionEx InitializeSListHead InterlockedFlushSList InterlockedPushEntrySList IsDebuggerPresent IsProcessorFeaturePresent IsThreadAFiber IsValidCodePage IsValidLocale LCMapStringEx LCMapStringW LeaveCriticalSection LoadLibraryExW LocalFree MoveFileExW MultiByteToWideChar OutputDebugStringA OutputDebugStringW PeekNamedPipe QueryPerformanceCounter RaiseException ReadConsoleW ReadFile ReleaseSRWLockExclusive RtlCaptureContext RtlCaptureStackBackTrace RtlLookupFunctionEntry RtlPcToFileHeader RtlUnwind RtlUnwindEx RtlVirtualUnwind SetConsoleCtrlHandler SetCurrentDirectoryW SetEndOfFile SetEnvironmentVariableA SetEnvironmentVariableW SetFileAttributesW SetFileInformationByHandle SetFilePointerEx SetFileTime SetHandleInformation SetLastError SetProcessWorkingSetSizeEx SetStdHandle SetUnhandledExceptionFilter SleepConditionVariableSRW TerminateProcess UnhandledExceptionFilter VirtualAlloc VirtualAllocEx VirtualFree VirtualFreeEx VirtualLock VirtualProtect WaitForSingleObject WakeAllConditionVariable WideCharToMultiByte WriteConsoleW WriteFile

bcrypt

BCryptGenRandom

advapi32

AdjustTokenPrivileges LookupPrivilegeValueA OpenProcessToken

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressAll

Name

.text

Size

4.6MB

Virtual Size

4.6MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.1MB

Virtual Size

1.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

49KB

Virtual Size

56KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

405KB

Virtual Size

404KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_RDATA

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_guard_c

Size

512B

Virtual Size

36B

Characteristics

Name

_guard_d

Size

512B

Virtual Size

36B

Characteristics

Name

memcmp_

Size

512B

Virtual Size

88B

Characteristics

Name

memcpy_

Size

512B

Virtual Size

332B

Characteristics

Name

memset_

Size

512B

Virtual Size

120B

Characteristics

Name

.rsrc

Size

512B

Virtual Size

464B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

7KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-11-02_f06db3c92102689ab360124bb2dc360e_icedid_mespinoza_njrat_ryuk

shell32

ole32

kernel32

bcrypt

advapi32

api-ms-win-core-synch-l1-2-0

generic