General
- Target 2026-07-06_0c3ba581b3ff4c764a9f9ad8c688d948_cryptbot_icedid_mespinoza_njrat_ryuk
- Size 2.5MB
- Sample260706-2nv8fsh17l
- SHA256 2fca9becf5ce7f86e7010e43c07bf22ec23fe5da65b33fe2366e8eaed9a1ec77
- MD5 0c3ba581b3ff4c764a9f9ad8c688d948
- SHA1 38abb740110dfcde07da655869fd6bf249890075
- SHA512 f38fbdb13f99ef7f6ad82e8e7d677b98b4dcfd238b0dda4f1e879a403d4d388e152f573dee41696fad2c3e751a04e9793c0b6dbb68002077a07eb637f71f994a
- SSDEEP 49152:51FjXkDRiPqYWwqqWZvcQUhM4xbYMPFPLzwStnufxarkztMDJSXeBdH3OMgH8:pjXDRtDJQao+DJ7Bp+
- TLSH T166C5CF5B27B480A8C167F338C9574747E2F2F8115933CB5B56A5AA4DEF333A14E29322
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-06_0c3ba581b3ff4c764a9f9ad8c688d948_cryptbot_icedid_mespinoza_njrat_ryuk.exe
Resource
win10v2004-20260513-en
19 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-06_0c3ba581b3ff4c764a9f9ad8c688d948_cryptbot_icedid_mespinoza_njrat_ryuk.exe
Resource
win11ltsc2024-20260706-en
0 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-06_0c3ba581b3ff4c764a9f9ad8c688d948_cryptbot_icedid_mespinoza_njrat_ryuk
- Size 2.5MB
- SHA256 2fca9becf5ce7f86e7010e43c07bf22ec23fe5da65b33fe2366e8eaed9a1ec77
- MD5 0c3ba581b3ff4c764a9f9ad8c688d948
- SHA1 38abb740110dfcde07da655869fd6bf249890075
- SHA512 f38fbdb13f99ef7f6ad82e8e7d677b98b4dcfd238b0dda4f1e879a403d4d388e152f573dee41696fad2c3e751a04e9793c0b6dbb68002077a07eb637f71f994a
- SSDEEP 49152:51FjXkDRiPqYWwqqWZvcQUhM4xbYMPFPLzwStnufxarkztMDJSXeBdH3OMgH8:pjXDRtDJQao+DJ7Bp+
- TLSH T166C5CF5B27B480A8C167F338C9574747E2F2F8115933CB5B56A5AA4DEF333A14E29322
- MD5 SHA1 SHA512 SSDEEP TLSH
Score8/10-
Disables taskbar notifications via registry modification
-
Executes dropped EXE
-
Modifies system executable filetype association
-
Windows security modification
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops file in System32 directory