General
- Target 2026-07-23_268563e92d010b49ab43f2bf31932ffd_icedid_mespinoza_njrat_ryuk
- Size 1.9MB
- Sample260723-nap8ds1vbz
- SHA256 1b37a975860ca65a2fcbf8fa416a0130491567faa78024d17abd3662a8de9855
- MD5 268563e92d010b49ab43f2bf31932ffd
- SHA1 43a83747136f1e0e13ba4f70939c247e2124276c
- SHA512 1837d3b8c2b5b1e7cd0b72cea1aee5545f537de16149ed91c603129f025f2c90d5a9448671fbe043893afb7ad97870deb81364e63836b45ce055e5045bce4177
- SSDEEP 24576:/iBE0wqwXeAVmYpsqjnhMgeiCl7G0nehbGZpbD:bN5Xe6XtDmg27RnWGj
- TLSH T17F95DF58A75841E0D1B2C23888539946E6727C018B71DBDF1298E77E6F77AE08D3EF21
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-23_268563e92d010b49ab43f2bf31932ffd_icedid_mespinoza_njrat_ryuk.exe
Resource
win10v2004-20260513-en
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-23_268563e92d010b49ab43f2bf31932ffd_icedid_mespinoza_njrat_ryuk.exe
Resource
win11ltsc2024-20260709-en
5 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-23_268563e92d010b49ab43f2bf31932ffd_icedid_mespinoza_njrat_ryuk
- Size 1.9MB
- SHA256 1b37a975860ca65a2fcbf8fa416a0130491567faa78024d17abd3662a8de9855
- MD5 268563e92d010b49ab43f2bf31932ffd
- SHA1 43a83747136f1e0e13ba4f70939c247e2124276c
- SHA512 1837d3b8c2b5b1e7cd0b72cea1aee5545f537de16149ed91c603129f025f2c90d5a9448671fbe043893afb7ad97870deb81364e63836b45ce055e5045bce4177
- SSDEEP 24576:/iBE0wqwXeAVmYpsqjnhMgeiCl7G0nehbGZpbD:bN5Xe6XtDmg27RnWGj
- TLSH T17F95DF58A75841E0D1B2C23888539946E6727C018B71DBDF1298E77E6F77AE08D3EF21
- MD5 SHA1 SHA512 SSDEEP TLSH
Score7/10-
Event Triggered Execution: Component Object Model Hijacking
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
-
Drops file in System32 directory