General
- Target 2026-08-08_86866d693f094fb9ee1cc2685caade52_icedid_mespinoza_njrat_ryuk_stealc
- Size 6.0MB
- Sample260808-drgbpsygmd
- SHA256 f1c85b0837c5aa255a432b139e3d78b90bb70d785850ee4247ff300e1c2c5485
- MD5 86866d693f094fb9ee1cc2685caade52
- SHA1 98a0f05f049fb4d5b1662040fa5d703ef88d1f37
- SHA512 5f84b25942a4eabaa3a547ee428160a26957bb58a019a287a56780c3bd7fc2b3731008401115c8ca5958794cf8563fe3f87fbd894fa09a7d19c73c805ba8b6f8
- SSDEEP 196608:EwtkDy5Oz5RiHOA+X3xms6RU6AIMTVQFPdkVg/q2:EPD5zai30s6RXAIfPdJ
- TLSH T158568D389186A2DAED6A407601F555E434213372833D2FFF8590E277AD0BBD25F6A32D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Static task
static1
Behavioral task
behavioral1
Sample
2026-08-08_86866d693f094fb9ee1cc2685caade52_icedid_mespinoza_njrat_ryuk_stealc.exe
Resource
win10v2004-20260513-en
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-08_86866d693f094fb9ee1cc2685caade52_icedid_mespinoza_njrat_ryuk_stealc.exe
Resource
win11ltsc2024-20260709-en
5 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-08_86866d693f094fb9ee1cc2685caade52_icedid_mespinoza_njrat_ryuk_stealc
- Size 6.0MB
- SHA256 f1c85b0837c5aa255a432b139e3d78b90bb70d785850ee4247ff300e1c2c5485
- MD5 86866d693f094fb9ee1cc2685caade52
- SHA1 98a0f05f049fb4d5b1662040fa5d703ef88d1f37
- SHA512 5f84b25942a4eabaa3a547ee428160a26957bb58a019a287a56780c3bd7fc2b3731008401115c8ca5958794cf8563fe3f87fbd894fa09a7d19c73c805ba8b6f8
- SSDEEP 196608:EwtkDy5Oz5RiHOA+X3xms6RU6AIMTVQFPdkVg/q2:EPD5zai30s6RXAIfPdJ
- TLSH T158568D389186A2DAED6A407601F555E434213372833D2FFF8590E277AD0BBD25F6A32D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10-
Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.
-
Detects executables containing SQL queries to confidential data stores. Observed in infostealers
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.