General
- Target 2026-08-15_2e3378367d3d142523f0c5c7bc9f47a5_cobalt-strike_icedid_mespinoza_njrat_ryuk
- Size 528KB
- Sample260815-ppln7axsez
- SHA256 8eb4e19c29db1cf9189416b7f0e1915c63fea09650b5d88cfbcd0459ab581130
- MD5 2e3378367d3d142523f0c5c7bc9f47a5
- SHA1 b7ddba171a6dd4b61bfe770088b044c32e615ab8
- SHA512 fe799b6745e319c6b25f5a9f6e0a3d652dbea77d59359ff86fcfa329138697d4f8d293ef3c53cef3863c5d85c2317e5b2008ef3e8c18b28be6dfb8541af28f05
- SSDEEP 12288:ciBlwBAQIXqaE0yCgqwXeAVmoEAlaU7e7LuH:ciBE0WqwXeAVmYAU7e7yH
- TLSH T142B46B58A75441E0D1B6C23888539943F67178018BB1DBDF12A8E73E2F777E19E3AB21
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-15_2e3378367d3d142523f0c5c7bc9f47a5_cobalt-strike_icedid_mespinoza_njrat_ryuk.exe
Resource
win10v2004-20260513-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-15_2e3378367d3d142523f0c5c7bc9f47a5_cobalt-strike_icedid_mespinoza_njrat_ryuk.exe
Resource
win11ltsc2024-20260709-en
2 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-15_2e3378367d3d142523f0c5c7bc9f47a5_cobalt-strike_icedid_mespinoza_njrat_ryuk
- Size 528KB
- SHA256 8eb4e19c29db1cf9189416b7f0e1915c63fea09650b5d88cfbcd0459ab581130
- MD5 2e3378367d3d142523f0c5c7bc9f47a5
- SHA1 b7ddba171a6dd4b61bfe770088b044c32e615ab8
- SHA512 fe799b6745e319c6b25f5a9f6e0a3d652dbea77d59359ff86fcfa329138697d4f8d293ef3c53cef3863c5d85c2317e5b2008ef3e8c18b28be6dfb8541af28f05
- SSDEEP 12288:ciBlwBAQIXqaE0yCgqwXeAVmoEAlaU7e7LuH:ciBE0WqwXeAVmYAU7e7yH
- TLSH T142B46B58A75441E0D1B6C23888539943F67178018BB1DBDF12A8E73E2F777E19E3AB21
- MD5 SHA1 SHA512 SSDEEP TLSH
Score7/10-
Event Triggered Execution: Component Object Model Hijacking
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.