Analysis
- max time kernel
149s - max time network
150s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
23/04/2026, 03:46
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-04-23_837170baf036e191c972fcf5682f1a54_elex_icedid_njrat.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-04-23_837170baf036e191c972fcf5682f1a54_elex_icedid_njrat.exe
Resource
win11-20260130-en
windows11-21h2-x64
12 signatures
150 seconds
General
- Target 2026-04-23_837170baf036e191c972fcf5682f1a54_elex_icedid_njrat.exe
- Size 667KB
- Sample260423-ebsv8sh18z
- SHA256 44afaad7e64b0aa36b35e21d721421f85a9b139e33b13055a3c56e74db9e90e5
- MD5 837170baf036e191c972fcf5682f1a54
- SHA1 13fc1c78683b837fd1995e58c24bcfc82099faf7
- SHA512 9b27d21ce84bc0f84852dded82e57606bed5e9f7d0165fe276618d3071c41ee8748b2024cfd8994bff627b210cf8ccb7806b69a8d9ae19c88cf5de109120c249
- SSDEEP 12288:rCCSiZbbSoCU5qJSr1eWPUntBB0sP0MugCAjHUzTsh:uCSi1SoCU5qJSr1eWPSCsP0MugC6eT
- TLSH T193E46B56769C33B5D1FBD23DCA4E7A51ED727C010B20A64F13A943AA1F233615B2E326
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Renames multiple (255) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Drops file in Drivers directory 3 IoCs
description ioc Process File opened for modification C:\Windows\system32\drivers\etc\hosts 2026-04-23_837170baf036e191c972fcf5682f1a54_elex_icedid_njrat.exe File opened for modification C:\Windows\system32\drivers\etc\hosts Logo1_.exe File opened for modification C:\Windows\system32\drivers\etc\hosts rundl132.exe - Executes dropped EXE 3 IoCs
pid Process 3528 Logo1_.exe 4312 2026-04-23_837170baf036e191c972fcf5682f1a54_elex_icedid_njrat.exe 4988 rundl132.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\load = "C:\\Windows\\uninstall\\rundl132.exe" 2026-04-23_837170baf036e191c972fcf5682f1a54_elex_icedid_njrat.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\load = "C:\\Windows\\uninstall\\rundl132.exe" Logo1_.exe - Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\M: Logo1_.exe File opened (read-only) \??\X: Logo1_.exe File opened (read-only) \??\R: Logo1_.exe File opened (read-only) \??\P: Logo1_.exe File opened (read-only) \??\O: Logo1_.exe File opened (read-only) \??\L: Logo1_.exe File opened (read-only) \??\W: Logo1_.exe File opened (read-only) \??\V: Logo1_.exe File opened (read-only) \??\N: Logo1_.exe File opened (read-only) \??\K: Logo1_.exe File opened (read-only) \??\J: Logo1_.exe File opened (read-only) \??\G: Logo1_.exe File opened (read-only) \??\E: Logo1_.exe File opened (read-only) \??\U: Logo1_.exe File opened (read-only) \??\T: Logo1_.exe File opened (read-only) \??\I: Logo1_.exe File opened (read-only) \??\H: Logo1_.exe File opened (read-only) \??\Z: Logo1_.exe File opened (read-only) \??\Y: Logo1_.exe File opened (read-only) \??\S: Logo1_.exe File opened (read-only) \??\Q: Logo1_.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstack.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmid.exe Logo1_.exe File created C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe Logo1_.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_proxy.exe.Exe Logo1_.exe File created C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe.Exe Logo1_.exe File created C:\Program Files\Mozilla Firefox\nmhproxy.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\RCXAC33.tmp Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmid.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\servertool.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\RCXB5A3.tmp Logo1_.exe File created C:\Program Files\7-Zip\7zFM.exe.Exe Logo1_.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\RCXACA6.tmp Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Internet Explorer\iexplore.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\RCXBA1A.tmp Logo1_.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\Installer\setup.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedgewebview2.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe Logo1_.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe.Exe Logo1_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.6.3102.0_x64__8wekyb3d8bbwe\Solitaire.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_pwa_launcher.exe.Exe Logo1_.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.143.57\MicrosoftEdgeUpdateOnDemand.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe.Exe Logo1_.exe File created C:\Program Files\Java\jdk-1.8\bin\javapackager.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\pack200.exe.Exe Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE.Exe Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe.Exe Logo1_.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe Logo1_.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE Logo1_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsStore_12104.1001.1.0_x64__8wekyb3d8bbwe\WinStore.App.exe Logo1_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.6.10571.0_x64__8wekyb3d8bbwe\wt.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.143.57\MicrosoftEdgeUpdate.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstack.exe Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVLP.exe Logo1_.exe File created C:\Program Files\VideoLAN\VLC\vlc.exe.Exe Logo1_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingNews_1.0.6.0_x64__8wekyb3d8bbwe\NewsStub.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe.Exe Logo1_.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\Installer\setup.exe.Exe Logo1_.exe File opened for modification C:\Program Files\dotnet\dotnet.exe.Exe Logo1_.exe File created C:\Program Files\Java\jdk-1.8\bin\jps.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\unpack200.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgewebview2.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\pwahelper.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.143.57\RCXBAEE.tmp Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmic.exe.Exe Logo1_.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe Logo1_.exe - Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\uninstall\rundl132.exe 2026-04-23_837170baf036e191c972fcf5682f1a54_elex_icedid_njrat.exe File created C:\Windows\Logo1_.exe 2026-04-23_837170baf036e191c972fcf5682f1a54_elex_icedid_njrat.exe File opened for modification C:\Windows\uninstall\rundl132.exe Logo1_.exe File created C:\Windows\RichDll.dll Logo1_.exe - System Location Discovery: System Language Discovery 1 TTPs 10 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-04-23_837170baf036e191c972fcf5682f1a54_elex_icedid_njrat.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Logo1_.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundl132.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe - Runs net.exe
- Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2888 2026-04-23_837170baf036e191c972fcf5682f1a54_elex_icedid_njrat.exe 2888 2026-04-23_837170baf036e191c972fcf5682f1a54_elex_icedid_njrat.exe 2888 2026-04-23_837170baf036e191c972fcf5682f1a54_elex_icedid_njrat.exe 2888 2026-04-23_837170baf036e191c972fcf5682f1a54_elex_icedid_njrat.exe 2888 2026-04-23_837170baf036e191c972fcf5682f1a54_elex_icedid_njrat.exe 2888 2026-04-23_837170baf036e191c972fcf5682f1a54_elex_icedid_njrat.exe 2888 2026-04-23_837170baf036e191c972fcf5682f1a54_elex_icedid_njrat.exe 2888 2026-04-23_837170baf036e191c972fcf5682f1a54_elex_icedid_njrat.exe 2888 2026-04-23_837170baf036e191c972fcf5682f1a54_elex_icedid_njrat.exe 2888 2026-04-23_837170baf036e191c972fcf5682f1a54_elex_icedid_njrat.exe 2888 2026-04-23_837170baf036e191c972fcf5682f1a54_elex_icedid_njrat.exe 2888 2026-04-23_837170baf036e191c972fcf5682f1a54_elex_icedid_njrat.exe 2888 2026-04-23_837170baf036e191c972fcf5682f1a54_elex_icedid_njrat.exe 2888 2026-04-23_837170baf036e191c972fcf5682f1a54_elex_icedid_njrat.exe 2888 2026-04-23_837170baf036e191c972fcf5682f1a54_elex_icedid_njrat.exe 2888 2026-04-23_837170baf036e191c972fcf5682f1a54_elex_icedid_njrat.exe 2888 2026-04-23_837170baf036e191c972fcf5682f1a54_elex_icedid_njrat.exe 2888 2026-04-23_837170baf036e191c972fcf5682f1a54_elex_icedid_njrat.exe 2888 2026-04-23_837170baf036e191c972fcf5682f1a54_elex_icedid_njrat.exe 2888 2026-04-23_837170baf036e191c972fcf5682f1a54_elex_icedid_njrat.exe 2888 2026-04-23_837170baf036e191c972fcf5682f1a54_elex_icedid_njrat.exe 2888 2026-04-23_837170baf036e191c972fcf5682f1a54_elex_icedid_njrat.exe 2888 2026-04-23_837170baf036e191c972fcf5682f1a54_elex_icedid_njrat.exe 2888 2026-04-23_837170baf036e191c972fcf5682f1a54_elex_icedid_njrat.exe 2888 2026-04-23_837170baf036e191c972fcf5682f1a54_elex_icedid_njrat.exe 2888 2026-04-23_837170baf036e191c972fcf5682f1a54_elex_icedid_njrat.exe 3528 Logo1_.exe 3528 Logo1_.exe 3528 Logo1_.exe 3528 Logo1_.exe 3528 Logo1_.exe 3528 Logo1_.exe 3528 Logo1_.exe 3528 Logo1_.exe 3528 Logo1_.exe 3528 Logo1_.exe 3528 Logo1_.exe 3528 Logo1_.exe 3528 Logo1_.exe 3528 Logo1_.exe 3528 Logo1_.exe 3528 Logo1_.exe 3528 Logo1_.exe 3528 Logo1_.exe 3528 Logo1_.exe 3528 Logo1_.exe 3528 Logo1_.exe 3528 Logo1_.exe 3528 Logo1_.exe 3528 Logo1_.exe 3528 Logo1_.exe 3528 Logo1_.exe 3528 Logo1_.exe 3528 Logo1_.exe 3528 Logo1_.exe 3528 Logo1_.exe 3528 Logo1_.exe 3528 Logo1_.exe 3528 Logo1_.exe 3528 Logo1_.exe 3528 Logo1_.exe 3528 Logo1_.exe 3528 Logo1_.exe 3528 Logo1_.exe - Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 2888 wrote to memory of 2376 2888 2026-04-23_837170baf036e191c972fcf5682f1a54_elex_icedid_njrat.exe 80 PID 2376 wrote to memory of 8 2376 net.exe 82 PID 2888 wrote to memory of 4396 2888 2026-04-23_837170baf036e191c972fcf5682f1a54_elex_icedid_njrat.exe 83 PID 2888 wrote to memory of 3528 2888 2026-04-23_837170baf036e191c972fcf5682f1a54_elex_icedid_njrat.exe 84 PID 3528 wrote to memory of 2648 3528 Logo1_.exe 86 PID 4396 wrote to memory of 4312 4396 cmd.exe 87 PID 2648 wrote to memory of 3956 2648 net.exe 89 PID 3528 wrote to memory of 1368 3528 Logo1_.exe 92 PID 1368 wrote to memory of 1576 1368 net.exe 94
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-23_837170baf036e191c972fcf5682f1a54_elex_icedid_njrat.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-23_837170baf036e191c972fcf5682f1a54_elex_icedid_njrat.exe"1⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2888 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2376 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"3⤵
- System Location Discovery: System Language Discovery
PID:8
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1D86.bat2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4396 -
C:\Users\Admin\AppData\Local\Temp\2026-04-23_837170baf036e191c972fcf5682f1a54_elex_icedid_njrat.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-23_837170baf036e191c972fcf5682f1a54_elex_icedid_njrat.exe"3⤵
- Executes dropped EXE
PID:4312
-
-
-
C:\Windows\Logo1_.exeC:\Windows\Logo1_.exe2⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Adds Run key to start application
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3528 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2648 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"4⤵
- System Location Discovery: System Language Discovery
PID:3956
-
-
-
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1368 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"4⤵
- System Location Discovery: System Language Discovery
PID:1576
-
-
-
-
C:\Windows\uninstall\rundl132.exeC:\Windows\uninstall\rundl132.exe1⤵
- Drops file in Drivers directory
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4988
Network
MITRE ATT&CK Enterprise v16
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RCXB612.tmp
- Size 156KB
- SHA256 d971a7156dc812ec5154991b0e0ff4fc933d691d27a103699641d23d696e0617
- MD5 34f7f7de15c5bba4fd31724a264b2d5d
- SHA1 b6c1db6c656562b9a132e5d3a2d4e19439297328
- SHA512 bf99e2c6b57839937d0646da2136d8fdb4db36056a680ea763e9f69d7333a645da5cf47a385451be90e89dd32553fc46611704c8a4fb0313b67be2f4b8ed5073
- SSDEEP 1536:E7qnkAQtSaoGo5n4iLG0/WM6TJNHSaYqeygjxT8m3G5QGPMLRNz:dCSjGoLpWM6VbBgjxTxi3M9Z
- TLSH T145F3B32EB18FB3F6C3E1597C8D1CF295ED29FE20CE19285B75993B0E9A7A1C34508191
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\RCXB809.tmp
- Size 94KB
- SHA256 44331735ae5e45a38c6daf3e4b1da5fb246b894a7324071363acf7e9305aab96
- MD5 d9670e60e07056235019c646b314cd29
- SHA1 5bfe70d73da2ec5f5328226c26aa847ad6f7c2a8
- SHA512 58fa68ba406cf98249e9e055b51769b89853613b4a70b2cc9d66d2436c021e3699ebd7d23c3349d3169e53ed7a733322e8d60d0d378a79c9c22de469d71677c0
- SSDEEP 1536:Z7qnkAQtSaoGo5n4iLG0/WM6TJNHSaYqeygjxw8m3G5QGPMLCND:ACSjGoLpWM6VbBgjxwxi3M2p
- TLSH T123933A5AB28CB3B6C0E199BC8E0FF6E5BD697E201E1D089FB1992F0DDE761C1590C185
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe.Exe
- Size 5.8MB
- SHA256 a8bf4e4a428f85bdaf114eafe127c9d1fd316c5ed0b91a2859b2e43fd4c98400
- MD5 d44ccc28a573ea8e5fee5a70700868ec
- SHA1 1627cd24e287d8eb47244fa6e0fe792115716cfa
- SHA512 5d06b46780afaac1e35491bd079775cad72ec83600e2a42609171bc653b7d1fae706b93175f8f37ffc440e76cf0c3cb3ff6fdbdc4c3962718b0ea5152e372644
- SSDEEP 98304:Sog5HQ+hDHQTW6Af4fF7KkOuYO6IgF+IAMk/JexMXP8iuHG9XXYXQz7ws:Sog1P9fIlOuz6IgF+I3m2MXP6HG8Qzb
- TLSH T180567B23A4E46130E5F332756D2CA7395D327FA29F3145CB86906C946FB82D3293936B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\RCXBAAA.tmp
- Size 103KB
- SHA256 29e9c3fa8f2118116e01cdd4fba07e6cac2ca947bbfcce83bf6f051bb85912c6
- MD5 5207c6360f90ecf0ea443343f41be3e0
- SHA1 f7832b45029e9cb396ab57deeaee9a2c422e7992
- SHA512 02a495b2a41c6d53c0038b35de66614675223dd70aa4250e2f590b04c042163a049a38fc3619d24cba8854515ed83f8b46019bafbcd37f706f4b0280bdaf3eff
- SSDEEP 1536:R7qnkAQtSaoGo5n4iLG0/WM6TJNHSaYqeygjxp8m3G5QGPMLM1XkSPsULMHiENQ:YCSjGoLpWM6VbBgjxpxi3MAdtPlLqdu
- TLSH T108A36B1AB28DB377C0E199BC8E0DF2E4BD397D201F19186BB29D1F0D9A775C2590C196
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCXB98A.tmp
- Size 118KB
- SHA256 e60045b42847bea435b27f3055adb0830d50c636b65fc58766c3a2078be50b6f
- MD5 48c292331fe94e18c75259909f6b1514
- SHA1 e1f3db12a1cb82d78cb5dcb2410fadf9a3026d0f
- SHA512 9d8ebd90e299e72e4f5097843cf7bad6d3aeed1475397c7af0baa5ed0613d8bb361f8d3ca07e8de159b6dd9c14826bea8f79d1f950840dd985e5a620d8000342
- SSDEEP 1536:M7qnkAQtSaoGo5n4iLG0/WM6TJNHSaYqeygjxz8m3G5QGPMLx4GZjzQwK5WW7VC6:FCSjGoLpWM6VbBgjxzxi3Mje5BV0yH
- TLSH T16DC3AE59B6CCB377C0E199B88E0DF2E4BD697E201F19086FB5992F0DCA7B5C1590C192
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Mozilla Maintenance Service\RCXBBA8.tmp
- Size 100KB
- SHA256 10289fc20b0049c5179158c55f69c69131f7e539bea63a5e913050f9e0e7e01b
- MD5 c13b0c32864d68c0abe48fd9517d110c
- SHA1 2903a22a65a631416513455704ed6e85693fa5f8
- SHA512 7c514df62a7a19d3ad9077f814ccedf797d11c870c874745045ae4677ae30867329a30a33de5f4050a3f598c93b8f27cf358552b204434beaa4ae5d3b1c70586
- SSDEEP 1536:x7qnkAQtSaoGo5n4iLG0/WM6TJNHSaYqeygjxO8m3G5QGPMLeqkSZZZ3JNj:4CSjGoLpWM6VbBgjxOxi3M0UJJ
- TLSH T173A35B16B68CB3B6D0F189789E0DF3E5BD357D301F59086BB2AD3B0E9A77182590C186
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe.Exe
- Size 642KB
- SHA256 9a738bd8e3cc7ed4d118bd151290d917b89c59b022fc8d529b3f4a09d08415d5
- MD5 c3c6ef5dd843f184fd3820f3c3f81c25
- SHA1 f10049a4d1cd0a6f6531b4626e0a5e91fcb939b1
- SHA512 4a5d1d388b43eae9f2042217f9f24a5813d99d6c5b7f87ed0938953b98d35376ba1182ef51e707a221785c8db5e2a1200bf2e0c320f27eee9c5d88610959503a
- SSDEEP 12288:rC0XZNYVLeyUji0h90ZD0wxpGZIVuKrHs:u00Le5ji0hmxNrM
- TLSH T106E4F715F66CB331D0F2C0B9C5DEB68AED713C411B3089CB5286876C6E676E6863A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\RCXAAF3.tmp
- Size 91KB
- SHA256 792b404b0ff261ab0eb682be3155d4d61610b6cf2c3c465c7be31798c5346063
- MD5 95598b10b231c28fafe32bae17674762
- SHA1 6f0cd80d8c5c09f41606c726342e11ca1238b8ec
- SHA512 33e4b49fe0854bf19217154bdc7d514744e373a7a054ea2279bc3a123edc265f8a4e807444a402d2b68633a6d00363472813313a046408ea9bc73ae6c11fbc45
- SSDEEP 1536:B7qnkAQtSaoGo5n4iLG0/WM6TJNHSaYqeygjxo8m3G5QGPMLlNb:oCSjGoLpWM6VbBgjxoxi3M5B
- TLSH T1E6935B5AB28CB377D0E199B88E0DF2E5BD797E301F19086FB1AD2F0D9A761C1590C192
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\RCXABE3.tmp
- Size 92KB
- SHA256 70b3e17ea90d1b5e22b3c858edef799814e853227279d7224b49bdca3e9921f3
- MD5 f9bf566389f9c46231889ba8e85ea86a
- SHA1 065e080d33e82ad3505993d4112c2572341d7657
- SHA512 e6676e314f22956bcc0b4134971623f0faf862693fbd3a96500dafc379a5f0ba369a1a37af91c8224f04d06e0231e59fc9c0ff839c37e116152f23d15a456c76
- SSDEEP 1536:p7qnkAQtSaoGo5n4iLG0/WM6TJNHSaYqeygjxQ8m3G5QGPMLkNL:wCSjGoLpWM6VbBgjxQxi3Mgx
- TLSH T125935C56B28CB376C0E199B88E0DF2E5BD797E301F19086BB1AE3F1D9A771C1590C186
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Mozilla Firefox\RCXAE59.tmp
- Size 91KB
- SHA256 b4f05a0163ecfa5cf5996df2b16cf16c2e3500d3fc09946efedb4f913f7e16ad
- MD5 f4b7cc271931c000f1c3c7b84ffec844
- SHA1 c1e5b1085d0c82fddff17a6d289d55a3e3f1978e
- SHA512 cb1ab3f6893c8f9b56287ed029243e24daec226d89112a96bd5acb88cb1cadf8a94297565ec44d08b2a9f65079b969a210bd3d9d1223cd405c22f5a5690eddc6
- SSDEEP 1536:p7qnkAQtSaoGo5n4iLG0/WM6TJNHSaYqeygjxI8m3G5QGPML/NL:wCSjGoLpWM6VbBgjxIxi3Mzx
- TLSH T1EE934C59B28CB376C0E1A9B88E0DF2E5BD697E300F19085BB1ED2F1DDA7B1C2590C195
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\setup.exe.Exe
- Size 545KB
- SHA256 4df4190ac6c7240c5c867ef411568093e64ddda80369e7aa7d8e4110de082b3c
- MD5 3c489be7245ab5071b72f3512957d871
- SHA1 d9135cac242197ae244cd3136a8c86701c990436
- SHA512 c837018bf5e08683ca275ca6b68e4258bb83580a937abe1c3a0a3d11c1589cdb79089aebfe7bc086ed7028eb2ef571c92f838c1076b46fd457e3bf6d74e6b08f
- SSDEEP 6144:uXq1gGi3C78n5Qw0tneDA/sqhleIc0HftDrkYY1hj63hgDonsogCh6NEpAFM:JCs85bM3npxYfj63hgD1ZiL
- TLSH T14EC4D50277EDB335F2F31B31AE7DB2515E7ABC619D35860E23841A0D49B0980EA75B63
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\$$a1D86.bat
- Size 704B
- SHA256 cac2cbd2505f74dd841cd4fd410f5904300ce8c2aab80c693b77c02496adc206
- MD5 12e1dffe5326c7a702a99094716dee9d
- SHA1 1707bcab193545a3a1e4ab66609d75269851d41c
- SHA512 f5376131a064092fe561f674b4b49a35084171574d9bb3edc538bb3118c961cb940532ff5d1c171e6dd366111f86c74ecc03586e9811275c6dfccbf3699e00f0
- TLSH T11301626A83BBCDA9D455712F0BD3E8DDCE623A65AE78233AA324D61520D004D6ED3601
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\2026-04-23_837170baf036e191c972fcf5682f1a54_elex_icedid_njrat.exe.exe
- Size 574KB
- SHA256 0cf9864ae3a8679ed503f954a453452c93fa44f99ca6f39bbc5860abde7fd35e
- MD5 6503efe0a01c2d50c97be27f3cb10a43
- SHA1 a0cb3708603a18f02352d01ec672020e5bad5073
- SHA512 ebdbc553ba4348676fd3f2ca12e48af53a229b449a36e653dbfca90efb34d21033e41d1157dcca28c2b1e5f91368c0839298992247cf7d2e8feca5feab8ecea4
- SSDEEP 12288:jSiZbbSoCU5qJSr1eWPUntBB0sP0MugCAjHUzTsh:jSi1SoCU5qJSr1eWPSCsP0MugC6eT
- TLSH T12FC48C5A779006F5D17BD239CA524B56EAB278024720A64F03EA43BB1F233215F7F726
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Logo1_.exe
- Size 93KB
- SHA256 07249cbb0fbe8f6a30922399e3b9d787a777da1f08ec951f83ffc18218320e47
- MD5 96df8f9a448de3005e027c3ed0cd1739
- SHA1 00e29bb185f92fad3ed7c467cbcbb8d42f7d7161
- SHA512 4a30cee27431e5a89bdb94759890d3cfa253548e356ff3c7850762a6d789127be52c9f982ee4b9ecb301b1b412a83f9b29c2d0cbbcb91c4034429a99477ed7f4
- SSDEEP 1536:x7qnkAQtSaoGo5n4iLG0/WM6TJNHSaYqeygjxw8m3G5QGPMLfNh:4CSjGoLpWM6VbBgjxwxi3MTv
- TLSH T112934B55B29CB376C0ED99BC8E0DF2E5BD657E300F19086B719D2F0D9A7A1C1590C18E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\drivers\etc\hosts
- Size 842B
- SHA256 d9704dab05e988be3e5e7b7c020bb9814906d11bb9c31ad80d4ed1316f6bc94e
- MD5 6f4adf207ef402d9ef40c6aa52ffd245
- SHA1 4b05b495619c643f02e278dede8f5b1392555a57
- SHA512 a6306bd200a26ea78192ae5b00cc49cfab3fba025fe7233709a4e62db0f9ed60030dce22b34afe57aad86a098c9a8c44e080cedc43227cb87ef4690baec35b47
- TLSH T14201FD2D0BDEF8AC077285D21A4DF44DB26A55F0627B0E89385C820D37A776D8726A4A
- MD5 SHA1 SHA512 TLSH