General
- Target 2026-08-04_6764ebf2efe576a3109b3def42e20f5b_icedid_mespinoza_njrat_ryuk
- Size 1.9MB
- Sample260804-2s9lmsfl61
- SHA256 d228d6d024e26cb17be1fa707c11801beddce0e1604ece23fa08a0d1b5f92c53
- MD5 6764ebf2efe576a3109b3def42e20f5b
- SHA1 5675313a39a25ba7e7e75c3eab6c638525501807
- SHA512 3826fc20b65e8b30204281da915f6d112e0cd9554a500a01ae8201a9b971dd079b1854a0abe8b4a4c58ee889891709985c222ac57db1276040aa08bdebc1b74a
- SSDEEP 24576:ziBE0GqwXeAVmYmX7bHsMQ4/O6yMLprOInyT/Swl8Mi9:3f5Xe6XmXvYMLprznyDSga9
- TLSH T13C95D058A75845E0E1B6C13888538946F67178018B71DBDF0398E73E6F7BAE19D3EB20
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-04_6764ebf2efe576a3109b3def42e20f5b_icedid_mespinoza_njrat_ryuk.exe
Resource
win10v2004-20260513-en
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-04_6764ebf2efe576a3109b3def42e20f5b_icedid_mespinoza_njrat_ryuk.exe
Resource
win11ltsc2024-20260709-en
4 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-04_6764ebf2efe576a3109b3def42e20f5b_icedid_mespinoza_njrat_ryuk
- Size 1.9MB
- SHA256 d228d6d024e26cb17be1fa707c11801beddce0e1604ece23fa08a0d1b5f92c53
- MD5 6764ebf2efe576a3109b3def42e20f5b
- SHA1 5675313a39a25ba7e7e75c3eab6c638525501807
- SHA512 3826fc20b65e8b30204281da915f6d112e0cd9554a500a01ae8201a9b971dd079b1854a0abe8b4a4c58ee889891709985c222ac57db1276040aa08bdebc1b74a
- SSDEEP 24576:ziBE0GqwXeAVmYmX7bHsMQ4/O6yMLprOInyT/Swl8Mi9:3f5Xe6XmXvYMLprznyDSga9
- TLSH T13C95D058A75845E0E1B6C13888538946F67178018B71DBDF0398E73E6F7BAE19D3EB20
- MD5 SHA1 SHA512 SSDEEP TLSH
Score7/10-
Event Triggered Execution: Component Object Model Hijacking
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
-
Executes dropped EXE
-
Drops file in System32 directory