General
- Target 2026-07-30_04cfb0b046c5bf7c6ef40be28f2020cb_icedid_njrat_ryuk
- Size 1.4MB
- Sample260730-wwmcmadd86
- SHA256 480a774781cc5d058d3a4ecb17a7781f9b73dea7dd2a92bf1b31bd054dd8bc9f
- MD5 04cfb0b046c5bf7c6ef40be28f2020cb
- SHA1 344f82e683ea03a51e1da0026f49e3549dd596af
- SHA512 d4132ca01f687037c55d380819b0c635710247f6b59054d8ed508aced93969bdf88baa6ace318d9f618adc7d2fdc94b26a6766de1f787380a0c1c4efbcffd3d3
- SSDEEP 12288:j06BaAhjk3j2V8tM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:oMjG486mctvE/BT76+1NCE
- TLSH T1B2650241B2A904F8E9B38274CA55C112E9737C561725DA9F0360926BDF336E1BD3EF22
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-30_04cfb0b046c5bf7c6ef40be28f2020cb_icedid_njrat_ryuk.exe
Resource
win10v2004-20260513-en
18 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-30_04cfb0b046c5bf7c6ef40be28f2020cb_icedid_njrat_ryuk.exe
Resource
win11ltsc2024-20260709-en
19 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-30_04cfb0b046c5bf7c6ef40be28f2020cb_icedid_njrat_ryuk
- Size 1.4MB
- SHA256 480a774781cc5d058d3a4ecb17a7781f9b73dea7dd2a92bf1b31bd054dd8bc9f
- MD5 04cfb0b046c5bf7c6ef40be28f2020cb
- SHA1 344f82e683ea03a51e1da0026f49e3549dd596af
- SHA512 d4132ca01f687037c55d380819b0c635710247f6b59054d8ed508aced93969bdf88baa6ace318d9f618adc7d2fdc94b26a6766de1f787380a0c1c4efbcffd3d3
- SSDEEP 12288:j06BaAhjk3j2V8tM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:oMjG486mctvE/BT76+1NCE
- TLSH T1B2650241B2A904F8E9B38274CA55C112E9737C561725DA9F0360926BDF336E1BD3EF22
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Executes dropped EXE
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops file in System32 directory
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1