General
- Target 2026-05-28_9b8d135db39291e1a624809a69388ea9_icedid_njrat_ryuk
- Size 7.2MB
- Sample260528-v63xpahs2k
- SHA256 81522799b656e9871e2268da0c688174c122b6e5249877ac16f7ec326eb27dba
- MD5 9b8d135db39291e1a624809a69388ea9
- SHA1 945dd896cc9d9e4998d721322a24eff587a207a0
- SHA512 f3c926522468551ba630f40ac2e6af28bec90ea942b5bc06d02f14aa34913137ca20c45e9605a095cd222e661d0108a1c660f3dfa80723bd0006985652dba7cd
- SSDEEP 98304:UVG21W4E02i3X9BaTK4AvevUkojhns2wUzCj8Z9H0:C2OzaC2vGjhOv8z0
- TLSH T1EC769D03F2E941D8E0AED678DB2A5332E9B27C854B35A1DF075076151E76EE09B38B31
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
Static task
static1
Behavioral task
behavioral1
Sample
2026-05-28_9b8d135db39291e1a624809a69388ea9_icedid_njrat_ryuk.exe
Resource
win10v2004-20260513-en
11 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-05-28_9b8d135db39291e1a624809a69388ea9_icedid_njrat_ryuk
- Size 7.2MB
- SHA256 81522799b656e9871e2268da0c688174c122b6e5249877ac16f7ec326eb27dba
- MD5 9b8d135db39291e1a624809a69388ea9
- SHA1 945dd896cc9d9e4998d721322a24eff587a207a0
- SHA512 f3c926522468551ba630f40ac2e6af28bec90ea942b5bc06d02f14aa34913137ca20c45e9605a095cd222e661d0108a1c660f3dfa80723bd0006985652dba7cd
- SSDEEP 98304:UVG21W4E02i3X9BaTK4AvevUkojhns2wUzCj8Z9H0:C2OzaC2vGjhOv8z0
- TLSH T1EC769D03F2E941D8E0AED678DB2A5332E9B27C854B35A1DF075076151E76EE09B38B31
- MD5 SHA1 SHA512 SSDEEP TLSH
Score6/10Adds Run key to start application
Event Triggered Execution: Component Object Model Hijacking
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Component Object Model Hijacking
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Component Object Model Hijacking
1