2026-11-03_5cfe3af8ddc79010667c433082ba69c1_icedid_mespinoza_njrat_ryuk

Sharing

Copy URL Twitter E-mail

General

Target
2026-11-03_5cfe3af8ddc79010667c433082ba69c1_icedid_mespinoza_njrat_ryuk
Size 1.7MB
Sample261104-x779xaee68
SHA256 1a0ea52c0da31179c04aac4e740926f41f8c48c52c1693bbbf49a0e60ffc5fa6
MD5 5cfe3af8ddc79010667c433082ba69c1
SHA1 39e670ffbc84258d09c83d4a0f8c8f9a40afb223
SHA512 daeb323ca07966873b28e742428be728d35ca82a944a0cf04ecefad270b8945fa2fcb4d3711a9619b5f8d803afc9ede36d08313b13b9559e7fc3a3ac66281649
SSDEEP 24576:2OA+xJ99nWRccfAFUn/G6yVXuqsBYsywPc8peO3r/UN95cS9l0Tp7:22DnWRccfV/G6BYcPe+m9SS9uTp7
TLSH
T1FF85E045E7F500F8E1B39634CDB24606E6B33C995A70CB4F23A9865A2F736509D39B32
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-11-03_5cfe3af8ddc79010667c433082ba69c1_icedid_mespinoza_njrat_ryuk

File Explorer

2026-11-03_5cfe3af8ddc79010667c433082ba69c1_icedid_mespinoza_njrat_ryuk

.exe 1.7MB

2026-11-03_5cfe3af8ddc79010667c433082ba69c1_icedid_mespinoza_njrat_ryuk

IMPHASH e4dc8637916b0b301d647908406e62bf
SHA256 1a0ea52c0da31179c04aac4e740926f41f8c48c52c1693bbbf49a0e60ffc5fa6
MD5 5cfe3af8ddc79010667c433082ba69c1
SHA1 39e670ffbc84258d09c83d4a0f8c8f9a40afb223
SHA512 daeb323ca07966873b28e742428be728d35ca82a944a0cf04ecefad270b8945fa2fcb4d3711a9619b5f8d803afc9ede36d08313b13b9559e7fc3a3ac66281649
SSDEEP 24576:2OA+xJ99nWRccfAFUn/G6yVXuqsBYsywPc8peO3r/UN95cS9l0Tp7:22DnWRccfV/G6BYcPe+m9SS9uTp7
TLSH
T1FF85E045E7F500F8E1B39634CDB24606E6B33C995A70CB4F23A9865A2F736509D39B32
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

188168

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\Projects\WinRAR\rar\build\unrar64\Release\UnRAR.pdb

kernel32

DeviceIoControl SetFileTime CloseHandle CreateDirectoryW RemoveDirectoryW CreateFileW DeleteFileW CreateHardLinkW GetShortPathNameW GetLongPathNameW MoveFileW ReadFile FlushFileBuffers SetEndOfFile SetFilePointer GetDriveTypeW GetDiskFreeSpaceExW SetFileAttributesW GetFileAttributesW GetVolumeInformationW ExpandEnvironmentStringsW FindClose FindFirstFileW FindNextFileW GetVersionExW GetModuleFileNameW GetCurrentDirectoryW GetFullPathNameW FoldStringW SetErrorMode GetModuleHandleW FreeLibrary LoadLibraryW LoadLibraryExW GetProcAddress GetCurrentProcessId GetCurrentThread GetCurrentProcess SetThreadExecutionState GetSystemDirectoryW SetPriorityClass GetProcessAffinityMask CreateThread InitializeCriticalSection EnterCriticalSection LeaveCriticalSection DeleteCriticalSection SetEvent ResetEvent ReleaseSemaphore WaitForSingleObject CreateEventW CreateSemaphoreW GetSystemTime SystemTimeToTzSpecificLocalTime TzSpecificLocalTimeToSystemTime SystemTimeToFileTime FileTimeToLocalFileTime LocalFileTimeToFileTime FileTimeToSystemTime GetCPInfo IsDBCSLeadByte MultiByteToWideChar WideCharToMultiByte CompareStringW SetFilePointerEx GetProcessHeap HeapSize SetEnvironmentVariableA FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP IsValidCodePage FindNextFileA SetConsoleCtrlHandler FormatMessageW Sleep SetLastError GetLastError WriteConsoleW ReadConsoleW SetConsoleMode GetConsoleMode WriteFile GetStdHandle GetFileType SetThreadPriority GetCommandLineW FindFirstFileExA SetStdHandle GetConsoleCP RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent WaitForSingleObjectEx IsDebuggerPresent GetStartupInfoW QueryPerformanceCounter GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead RtlPcToFileHeader EncodePointer RaiseException RtlUnwindEx InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree ExitProcess GetModuleHandleExW QueryPerformanceFrequency GetModuleFileNameA GetCommandLineA GetACP HeapFree HeapAlloc HeapReAlloc GetStringTypeW LCMapStringW

user32

CharLowerW CharUpperW MessageBeep ExitWindowsEx CharToOemBuffW CharToOemA OemToCharBuffA OemToCharA LoadStringW

advapi32

FreeSid AllocateAndInitializeSid RegQueryValueExW RegOpenKeyExW RegCloseKey LookupPrivilegeValueW SetFileSecurityW AdjustTokenPrivileges OpenProcessToken CheckTokenMembership

shell32

SHGetSpecialFolderLocation SHGetPathFromIDListW SHGetMalloc

powrprof

SetSuspendState

Name

.text

Size

259KB

Virtual Size

259KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

65KB

Virtual Size

65KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

86KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

11KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.gfids

Size

512B

Virtual Size

216B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

30KB

Virtual Size

30KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

1.4MB

Virtual Size

1.4MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-11-03_5cfe3af8ddc79010667c433082ba69c1_icedid_mespinoza_njrat_ryuk

kernel32

user32

advapi32

shell32

powrprof

generic