General
- Target 2026-08-09_c393d0427fac8a2bdd1d4b399add5f6c_icedid_mespinoza_njrat_ryuk
- Size 1.0MB
- Sample260809-pmrsesxfpc
- SHA256 b4cc9bd3dc90136effdcd9aaaac33103ee917fff6904cdb74e2618108cfc1ded
- MD5 c393d0427fac8a2bdd1d4b399add5f6c
- SHA1 9bebcb53069761d94f82c2211401f8b1a34e4d09
- SHA512 cea21e9aacb992e45f475d44c6468517e0af2387589a0c3cc59fd0282fe70de093fe32e6582975baf73694809eb23d1f5c176f8ff6c8094982a0fc4f4114e533
- SSDEEP 24576:1iBE0GqwXeAVmYUsqjnhMgeiCl7G0nehbGZpbD:Zf5Xe6XwDmg27RnWGj
- TLSH T16E35DF58A75841E0D1B2C27888539946E6727C018B71DBDF1298E73E6F77AE08D3EF21
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-09_c393d0427fac8a2bdd1d4b399add5f6c_icedid_mespinoza_njrat_ryuk.exe
Resource
win10v2004-20260513-en
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-09_c393d0427fac8a2bdd1d4b399add5f6c_icedid_mespinoza_njrat_ryuk.exe
Resource
win11ltsc2024-20260710-en
4 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-09_c393d0427fac8a2bdd1d4b399add5f6c_icedid_mespinoza_njrat_ryuk
- Size 1.0MB
- SHA256 b4cc9bd3dc90136effdcd9aaaac33103ee917fff6904cdb74e2618108cfc1ded
- MD5 c393d0427fac8a2bdd1d4b399add5f6c
- SHA1 9bebcb53069761d94f82c2211401f8b1a34e4d09
- SHA512 cea21e9aacb992e45f475d44c6468517e0af2387589a0c3cc59fd0282fe70de093fe32e6582975baf73694809eb23d1f5c176f8ff6c8094982a0fc4f4114e533
- SSDEEP 24576:1iBE0GqwXeAVmYUsqjnhMgeiCl7G0nehbGZpbD:Zf5Xe6XwDmg27RnWGj
- TLSH T16E35DF58A75841E0D1B2C27888539946E6727C018B71DBDF1298E73E6F77AE08D3EF21
- MD5 SHA1 SHA512 SSDEEP TLSH
Score7/10-
Event Triggered Execution: Component Object Model Hijacking
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
-
Executes dropped EXE
-
Drops file in System32 directory