General
- Target 2026-04-24_db38912f554edcffd5a5359d21ccc93c_icedid_njrat_ryuk
- Size 1.3MB
- Sample260424-24xffsfs2p
- SHA256 3cc5f3e493375a4d31a707b67b0dc06b50d57807cb06d6813da7f413b8773b93
- MD5 db38912f554edcffd5a5359d21ccc93c
- SHA1 e73a7aa80718a254ba7ada3e54d5654301c15c62
- SHA512 291c184ea4b1bd4ebd0c1f02587578cc38f647aafd4eb174bf56e1b83993f3d7d40451d891d8d88b3e0f004cad26e8d8051817b227f07eebd1f0c6e357fe1c0d
- SSDEEP 12288:5D6b3hm1SP5iufVQp7krxHXkbAxOC+LTGQwxht9I3IXW39/+JmeRAALuat:5D6bxm1PEJL+RwxhHxXWN/eL7
- TLSH T133550247B36870F8F1678239C9921619EB76B8750B70978F0674433A2F276D19E3EB21
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-04-24_db38912f554edcffd5a5359d21ccc93c_icedid_njrat_ryuk.exe
Resource
win10v2004-20260130-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-04-24_db38912f554edcffd5a5359d21ccc93c_icedid_njrat_ryuk.exe
Resource
win11-20260130-en
16 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-04-24_db38912f554edcffd5a5359d21ccc93c_icedid_njrat_ryuk
- Size 1.3MB
- SHA256 3cc5f3e493375a4d31a707b67b0dc06b50d57807cb06d6813da7f413b8773b93
- MD5 db38912f554edcffd5a5359d21ccc93c
- SHA1 e73a7aa80718a254ba7ada3e54d5654301c15c62
- SHA512 291c184ea4b1bd4ebd0c1f02587578cc38f647aafd4eb174bf56e1b83993f3d7d40451d891d8d88b3e0f004cad26e8d8051817b227f07eebd1f0c6e357fe1c0d
- SSDEEP 12288:5D6b3hm1SP5iufVQp7krxHXkbAxOC+LTGQwxht9I3IXW39/+JmeRAALuat:5D6bxm1PEJL+RwxhHxXWN/eL7
- TLSH T133550247B36870F8F1678239C9921619EB76B8750B70978F0674433A2F276D19E3EB21
- MD5 SHA1 SHA512 SSDEEP TLSH
Score7/10-
Executes dropped EXE
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops file in System32 directory
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1