General
- Target 2026-07-09_e55a44f11b92d210dfc23e1cffa8f744_cobalt-strike_icedid_mespinoza_njrat_ryuk_vidar
- Size 298KB
- Sample260709-l5flbsg18v
- SHA256 f18ff9703c5a44d97deabca87ca43b596955cad250b8c60c9f983e746d3c426d
- MD5 e55a44f11b92d210dfc23e1cffa8f744
- SHA1 4f7a52b73802008be079b0bc335df0c9591f9a18
- SHA512 ef49cebd6fae3f8b7e6e0d4345f4697eac6f682fb1f8065ec265ca961d588e1273e46df0543ac2cb87b8ccb2aec720648a1e6ea29ca5ac55d1bcb3d9e82a77c2
- SSDEEP 6144:artWes9tYyrMb3DLWM0217lhJ7olgtlhn1vl+KK9:EtWes9tlwD32S24lhn1dPK9
- TLSH T16E54AE69B7A00CF9ED77C2BDC9F29525EA32386503A0EADB029441651F373C46E3EB51
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-09_e55a44f11b92d210dfc23e1cffa8f744_cobalt-strike_icedid_mespinoza_njrat_ryuk_vidar.exe
Resource
win10v2004-20260513-en
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-09_e55a44f11b92d210dfc23e1cffa8f744_cobalt-strike_icedid_mespinoza_njrat_ryuk_vidar.exe
Resource
win11ltsc2024-20260706-en
13 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-09_e55a44f11b92d210dfc23e1cffa8f744_cobalt-strike_icedid_mespinoza_njrat_ryuk_vidar
- Size 298KB
- SHA256 f18ff9703c5a44d97deabca87ca43b596955cad250b8c60c9f983e746d3c426d
- MD5 e55a44f11b92d210dfc23e1cffa8f744
- SHA1 4f7a52b73802008be079b0bc335df0c9591f9a18
- SHA512 ef49cebd6fae3f8b7e6e0d4345f4697eac6f682fb1f8065ec265ca961d588e1273e46df0543ac2cb87b8ccb2aec720648a1e6ea29ca5ac55d1bcb3d9e82a77c2
- SSDEEP 6144:artWes9tYyrMb3DLWM0217lhJ7olgtlhn1vl+KK9:EtWes9tlwD32S24lhn1dPK9
- TLSH T16E54AE69B7A00CF9ED77C2BDC9F29525EA32386503A0EADB029441651F373C46E3EB51
- MD5 SHA1 SHA512 SSDEEP TLSH
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.