General
- Target 2026-07-22_c0cd6b9c1802a99496a4be299ff06a21_icedid_mespinoza_njrat_ryuk
- Size 1.9MB
- Sample260722-3bf4fadd62
- SHA256 f342e6015dc1353ada6fda0fbf077cb0f1aecdcb87653d332b212261ffef8abb
- MD5 c0cd6b9c1802a99496a4be299ff06a21
- SHA1 3b9110687b47498bca7134d4cd91a8ae6c15e9ff
- SHA512 b8c6f0777d6db1e0ed627c146ee05cc0df0690e536f9a4889238a328aac20da231905e16acbe2c3e677e25916dfeab73c65795e400f8c12309b44bf68c21f63f
- SSDEEP 24576:tiBE0wqwXeAVmYpsqjnhMgeiCl7G0nehbGZpbD:hN5Xe6XtDmg27RnWGj
- TLSH T13195DF58A75841E0D1B2C23888539946E6727C018B71DBDF1298E77E6F77AE08D3EF21
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-22_c0cd6b9c1802a99496a4be299ff06a21_icedid_mespinoza_njrat_ryuk.exe
Resource
win10v2004-20260513-en
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-22_c0cd6b9c1802a99496a4be299ff06a21_icedid_mespinoza_njrat_ryuk.exe
Resource
win11ltsc2024-20260709-en
5 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-22_c0cd6b9c1802a99496a4be299ff06a21_icedid_mespinoza_njrat_ryuk
- Size 1.9MB
- SHA256 f342e6015dc1353ada6fda0fbf077cb0f1aecdcb87653d332b212261ffef8abb
- MD5 c0cd6b9c1802a99496a4be299ff06a21
- SHA1 3b9110687b47498bca7134d4cd91a8ae6c15e9ff
- SHA512 b8c6f0777d6db1e0ed627c146ee05cc0df0690e536f9a4889238a328aac20da231905e16acbe2c3e677e25916dfeab73c65795e400f8c12309b44bf68c21f63f
- SSDEEP 24576:tiBE0wqwXeAVmYpsqjnhMgeiCl7G0nehbGZpbD:hN5Xe6XtDmg27RnWGj
- TLSH T13195DF58A75841E0D1B2C23888539946E6727C018B71DBDF1298E77E6F77AE08D3EF21
- MD5 SHA1 SHA512 SSDEEP TLSH
Score7/10-
Event Triggered Execution: Component Object Model Hijacking
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
-
Executes dropped EXE
-
Drops file in System32 directory