General
- Target 2026-07-04_b67d76ac9386da31199cda102eacf912_icedid_mespinoza_njrat_ryuk
- Size 1.0MB
- Sample260704-2px4faaw3k
- SHA256 6995050aaca95fe6f2723d425667fb0551565b98dad2d57c7bd37a8ba6cf8e5c
- MD5 b67d76ac9386da31199cda102eacf912
- SHA1 5d1bdf5bab3efc478ecb8e6f543c3aaaa8d4298c
- SHA512 46b97a8add52a3cbfdccb0a0bedb17410552e13a2eab26f2ae7cc5f19384d3f4781e62909773ddf818a482534cdc6eb1583c63ef6a31caf5478b166a66ba44c5
- SSDEEP 24576:AiBE0GqwXeAVmYj5SSiVw6uAX8DS52tpz9ZRzbPmSZyo:4f5Xe6Xj5SW6H8DS52tdDpbRZy
- TLSH T11F35D048A75441E1D1B6C27888539946E77178018B70EBDF03A8E33A6F77AE19D3EF21
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-04_b67d76ac9386da31199cda102eacf912_icedid_mespinoza_njrat_ryuk.exe
Resource
win10v2004-20260513-en
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-04_b67d76ac9386da31199cda102eacf912_icedid_mespinoza_njrat_ryuk.exe
Resource
win11ltsc2024-20260629-en
4 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-04_b67d76ac9386da31199cda102eacf912_icedid_mespinoza_njrat_ryuk
- Size 1.0MB
- SHA256 6995050aaca95fe6f2723d425667fb0551565b98dad2d57c7bd37a8ba6cf8e5c
- MD5 b67d76ac9386da31199cda102eacf912
- SHA1 5d1bdf5bab3efc478ecb8e6f543c3aaaa8d4298c
- SHA512 46b97a8add52a3cbfdccb0a0bedb17410552e13a2eab26f2ae7cc5f19384d3f4781e62909773ddf818a482534cdc6eb1583c63ef6a31caf5478b166a66ba44c5
- SSDEEP 24576:AiBE0GqwXeAVmYj5SSiVw6uAX8DS52tpz9ZRzbPmSZyo:4f5Xe6Xj5SW6H8DS52tdDpbRZy
- TLSH T11F35D048A75441E1D1B6C27888539946E77178018B70EBDF03A8E33A6F77AE19D3EF21
- MD5 SHA1 SHA512 SSDEEP TLSH
Score7/10-
Event Triggered Execution: Component Object Model Hijacking
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
-
Drops file in System32 directory