d22a8b44b384692cc6bc977d6a7510d1b5e9a07c1b2138de4d47123f5efdfec1

Analysis

max time kernel
149s
max time network
154s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
15/04/2026, 11:28

Target
2026-04-15_942e4d9d9adaa660b7d72accfb5edd24_icedid_mespinoza_njrat_ryuk.exe
Size 8.2MB
Sample260415-nlabbafw2v
SHA256 d22a8b44b384692cc6bc977d6a7510d1b5e9a07c1b2138de4d47123f5efdfec1
MD5 942e4d9d9adaa660b7d72accfb5edd24
SHA1 329ea8aa67ba4e14b7363ffed4da988792d0232b
SHA512 695c1e8e67de76df7b4bc63c99332bd6f27308e26372b4289a2443a26a367159011a100bdc942136119770e822303a2983e07cfe0c0f9b2fe293a649cf564411
SSDEEP 196608:QgJ3kWqukUcVtz6SbAxyqB98UF8yn/SYFh:lJUWqukUceSbAx8nynKYFh
TLSH
T18796D08BA6BC02D5E573D239CA03454BEBB2BC151A71C78F116C579E6F332A14E5B322
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4368	2026-04-15_942e4d9d9adaa660b7d72accfb5edd24_icedid_mespinoza_njrat_ryuk.exe
4368	2026-04-15_942e4d9d9adaa660b7d72accfb5edd24_icedid_mespinoza_njrat_ryuk.exe

C:\Users\Admin\AppData\Local\Temp\2026-04-15_942e4d9d9adaa660b7d72accfb5edd24_icedid_mespinoza_njrat_ryuk.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-15_942e4d9d9adaa660b7d72accfb5edd24_icedid_mespinoza_njrat_ryuk.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:4368