General
- Target 2026-08-12_0fc5d4bae5eab3843a3b65e7ea841a43_cryptbot_icedid_mespinoza_njrat_ryuk
- Size 2.5MB
- Sample260812-kzamfstaje
- SHA256 f2c73b7e27b3c68caac71624133ccfa12dc4d0b0013125aa02ee3d271d6a9dba
- MD5 0fc5d4bae5eab3843a3b65e7ea841a43
- SHA1 c8d62d10fc44f128f8c830e90b968ce565645978
- SHA512 ad14acd4e1a69eded96a3580b120b13972adb45c4e59c507eea9437fc0bc0365b5d1804395243739b715c9f617a58195ba83365f24fdddd6763c67780430728e
- SSDEEP 49152:KyFO6qPehNmKFmWhDcQi3RJbvJwT34+pAtHGIQkFzNjteyUHBdH3FwSznGsLMs:TOXntLEFIzNte9Bp1w9I/
- TLSH T174C5BE592FF440E8D1B7D7F8C97F8646E6BD78512931CA6F0567A94E1F333608A28322
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-12_0fc5d4bae5eab3843a3b65e7ea841a43_cryptbot_icedid_mespinoza_njrat_ryuk.exe
Resource
win10v2004-20260513-en
18 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-12_0fc5d4bae5eab3843a3b65e7ea841a43_cryptbot_icedid_mespinoza_njrat_ryuk.exe
Resource
win11ltsc2024-20260709-en
0 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-12_0fc5d4bae5eab3843a3b65e7ea841a43_cryptbot_icedid_mespinoza_njrat_ryuk
- Size 2.5MB
- SHA256 f2c73b7e27b3c68caac71624133ccfa12dc4d0b0013125aa02ee3d271d6a9dba
- MD5 0fc5d4bae5eab3843a3b65e7ea841a43
- SHA1 c8d62d10fc44f128f8c830e90b968ce565645978
- SHA512 ad14acd4e1a69eded96a3580b120b13972adb45c4e59c507eea9437fc0bc0365b5d1804395243739b715c9f617a58195ba83365f24fdddd6763c67780430728e
- SSDEEP 49152:KyFO6qPehNmKFmWhDcQi3RJbvJwT34+pAtHGIQkFzNjteyUHBdH3FwSznGsLMs:TOXntLEFIzNte9Bp1w9I/
- TLSH T174C5BE592FF440E8D1B7D7F8C97F8646E6BD78512931CA6F0567A94E1F333608A28322
- MD5 SHA1 SHA512 SSDEEP TLSH
Score8/10-
Disables taskbar notifications via registry modification
-
Executes dropped EXE
-
Modifies system executable filetype association
-
Windows security modification
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops file in System32 directory