General
- Target 2026-07-12_b3eb95afc69fe132f09fe3371a8ed494_icedid_mespinoza_njrat_ryuk
- Size 1.9MB
- Sample260712-3wclrabz61
- SHA256 6ab2591cecbd8bbaa4b9f4a7ad28d3e30a3009898abf8bb8115d76dc3d476555
- MD5 b3eb95afc69fe132f09fe3371a8ed494
- SHA1 e6c35ee06228129cf2bc2ecc03d687dd7778e1db
- SHA512 05b80241ac1fa7274e9f71af7558c80fc34fd8a3b60106c86150138cdad099f80744f91b64b3431260639043ef1904879c190f35d531deae5b49c81946eafa76
- SSDEEP 24576:riBE0AqwXeAVmY0sqjnhMgeiCl7G0nehbGZpbD:fd5Xe6XQDmg27RnWGj
- TLSH T18595DF58A74841E0D1B6C23888539946E6717C018B71DBDF1298E77E6F77AE08E3EF21
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-12_b3eb95afc69fe132f09fe3371a8ed494_icedid_mespinoza_njrat_ryuk.exe
Resource
win10v2004-20260513-en
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-12_b3eb95afc69fe132f09fe3371a8ed494_icedid_mespinoza_njrat_ryuk.exe
Resource
win11ltsc2024-20260709-en
4 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-12_b3eb95afc69fe132f09fe3371a8ed494_icedid_mespinoza_njrat_ryuk
- Size 1.9MB
- SHA256 6ab2591cecbd8bbaa4b9f4a7ad28d3e30a3009898abf8bb8115d76dc3d476555
- MD5 b3eb95afc69fe132f09fe3371a8ed494
- SHA1 e6c35ee06228129cf2bc2ecc03d687dd7778e1db
- SHA512 05b80241ac1fa7274e9f71af7558c80fc34fd8a3b60106c86150138cdad099f80744f91b64b3431260639043ef1904879c190f35d531deae5b49c81946eafa76
- SSDEEP 24576:riBE0AqwXeAVmY0sqjnhMgeiCl7G0nehbGZpbD:fd5Xe6XQDmg27RnWGj
- TLSH T18595DF58A74841E0D1B6C23888539946E6717C018B71DBDF1298E77E6F77AE08E3EF21
- MD5 SHA1 SHA512 SSDEEP TLSH
Score7/10-
Event Triggered Execution: Component Object Model Hijacking
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
-
Executes dropped EXE
-
Drops file in System32 directory