2026-11-03_64a6e93183e6b04e009372bbe1e75120_icedid_mespinoza_njrat_ryuk

Sharing

Copy URL Twitter E-mail

General

Target
2026-11-03_64a6e93183e6b04e009372bbe1e75120_icedid_mespinoza_njrat_ryuk
Size 1.6MB
Sample261104-xavybacw2z
SHA256 8478bf06835f906be8c8f269bac2fb8aabf14f802d836d4493d59c9c3aa5a81e
MD5 64a6e93183e6b04e009372bbe1e75120
SHA1 03eae667192e6edd661045379933809e3c535ab1
SHA512 ea87a77590b91991f3de2342f06dde36a1b3b485b1dd7bb79106c46891759b85a265dcb0be704bcd6de0ba18d905cf11442da07e77ee85fd9fe4ad4be0322f4b
SSDEEP 24576:YEPxoECLW1RcD9dOB3aLXkwcIBIbH0LxvXqbwGRz55jAre8MjKiwi:bCLW1RcDvOB3aLVcIjLxvXGApMjKS
TLSH
T13375E145EBE504F4E1B39634C9B24506E7B37C865BB0C65F33A9855B2F73A908D38B22
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-11-03_64a6e93183e6b04e009372bbe1e75120_icedid_mespinoza_njrat_ryuk

File Explorer

2026-11-03_64a6e93183e6b04e009372bbe1e75120_icedid_mespinoza_njrat_ryuk

.exe 1.6MB

2026-11-03_64a6e93183e6b04e009372bbe1e75120_icedid_mespinoza_njrat_ryuk

IMPHASH 6acfd07fb8e784f60f58db66852ed830
SHA256 8478bf06835f906be8c8f269bac2fb8aabf14f802d836d4493d59c9c3aa5a81e
MD5 64a6e93183e6b04e009372bbe1e75120
SHA1 03eae667192e6edd661045379933809e3c535ab1
SHA512 ea87a77590b91991f3de2342f06dde36a1b3b485b1dd7bb79106c46891759b85a265dcb0be704bcd6de0ba18d905cf11442da07e77ee85fd9fe4ad4be0322f4b
SSDEEP 24576:YEPxoECLW1RcD9dOB3aLXkwcIBIbH0LxvXqbwGRz55jAre8MjKiwi:bCLW1RcDvOB3aLVcIjLxvXGApMjKS
TLSH
T13375E145EBE504F4E1B39634C9B24506E7B37C865BB0C65F33A9855B2F73A908D38B22
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

195216

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\Projects\WinRAR\rar\build\unrar64\Release\UnRAR.pdb

kernel32

DeviceIoControl SetFileTime CloseHandle CreateDirectoryW RemoveDirectoryW CreateFileW DeleteFileW CreateHardLinkW GetShortPathNameW GetLongPathNameW MoveFileW ReadFile FlushFileBuffers SetEndOfFile SetFilePointer GetDriveTypeW GetDiskFreeSpaceExW SetFileAttributesW GetFileAttributesW GetVolumeInformationW ExpandEnvironmentStringsW FindClose FindFirstFileW FindNextFileW GetVersionExW GetModuleFileNameW GetCurrentDirectoryW GetFullPathNameW FoldStringW SetErrorMode GetModuleHandleW FreeLibrary LoadLibraryW LoadLibraryExW GetProcAddress GetCurrentProcessId GetCurrentThread GetCurrentProcess SetThreadExecutionState CreateEventW GetSystemDirectoryW SetPriorityClass GetProcessAffinityMask CreateThread InitializeCriticalSection EnterCriticalSection LeaveCriticalSection DeleteCriticalSection SetEvent ResetEvent ReleaseSemaphore WaitForSingleObject CreateSemaphoreW GetSystemTime SystemTimeToTzSpecificLocalTime TzSpecificLocalTimeToSystemTime SystemTimeToFileTime FileTimeToLocalFileTime LocalFileTimeToFileTime FileTimeToSystemTime GetCPInfo IsDBCSLeadByte MultiByteToWideChar WideCharToMultiByte CompareStringW SetFilePointerEx GetProcessHeap HeapSize SetEnvironmentVariableA FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP IsValidCodePage FindNextFileA SetConsoleCtrlHandler FormatMessageW Sleep SetLastError GetLastError WriteConsoleW ReadConsoleW SetConsoleMode GetConsoleMode WriteFile GetStdHandle GetFileType SetThreadPriority GetCommandLineW FindFirstFileExA SetStdHandle GetConsoleCP RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent WaitForSingleObjectEx IsDebuggerPresent GetStartupInfoW QueryPerformanceCounter GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead RtlUnwindEx RtlPcToFileHeader RaiseException EncodePointer InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree ExitProcess GetModuleHandleExW QueryPerformanceFrequency GetModuleFileNameA GetCommandLineA GetACP HeapFree HeapAlloc HeapReAlloc GetStringTypeW LCMapStringW

user32

CharLowerW CharUpperW MessageBeep ExitWindowsEx CharToOemBuffW CharToOemA OemToCharBuffA OemToCharA LoadStringW

advapi32

FreeSid AllocateAndInitializeSid RegQueryValueExW RegOpenKeyExW RegCloseKey LookupPrivilegeValueW SetFileSecurityW AdjustTokenPrivileges OpenProcessToken CheckTokenMembership

shell32

SHGetSpecialFolderLocation SHGetPathFromIDListW SHGetMalloc

powrprof

SetSuspendState

Name

.text

Size

266KB

Virtual Size

266KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

72KB

Virtual Size

72KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

11KB

Virtual Size

100KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

11KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

31KB

Virtual Size

30KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

1.2MB

Virtual Size

1.9MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-11-03_64a6e93183e6b04e009372bbe1e75120_icedid_mespinoza_njrat_ryuk

kernel32

user32

advapi32

shell32

powrprof

generic