General
- Target 2026-08-15_683082f8ae1a5b772a2a024bcbae1c5f_icedid_mespinoza_njrat_ryuk
- Size 1.7MB
- Sample260816-asc4wswfjf
- SHA256 f68afcdb8080c01777d5fe32073a5a9d7e30b95d630f3ccea5bf897513ae0784
- MD5 683082f8ae1a5b772a2a024bcbae1c5f
- SHA1 e8a958f2a5a06d656050870a11d34e2e99ac90d9
- SHA512 562047a9d041383abc12f6ac3880f6d799c0b394a7418c56edf0e36ab2c7779bb1fe3a48ac0c10ff37a685d9baf47d33394e600524e30ac745c7f4725d69e55b
- SSDEEP 24576:LiBEjWqwXeAVmY5sqjnhMgeiCl7G0nehbGZpbD:/65Xe6X9Dmg27RnWGj
- TLSH T16985DF58A74841E0D1B2C27888539946E6727C018B71DBDF1298E73E6F77AE08D3EF21
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-15_683082f8ae1a5b772a2a024bcbae1c5f_icedid_mespinoza_njrat_ryuk.exe
Resource
win10v2004-20260513-en
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-15_683082f8ae1a5b772a2a024bcbae1c5f_icedid_mespinoza_njrat_ryuk.exe
Resource
win11ltsc2024-20260710-en
5 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-15_683082f8ae1a5b772a2a024bcbae1c5f_icedid_mespinoza_njrat_ryuk
- Size 1.7MB
- SHA256 f68afcdb8080c01777d5fe32073a5a9d7e30b95d630f3ccea5bf897513ae0784
- MD5 683082f8ae1a5b772a2a024bcbae1c5f
- SHA1 e8a958f2a5a06d656050870a11d34e2e99ac90d9
- SHA512 562047a9d041383abc12f6ac3880f6d799c0b394a7418c56edf0e36ab2c7779bb1fe3a48ac0c10ff37a685d9baf47d33394e600524e30ac745c7f4725d69e55b
- SSDEEP 24576:LiBEjWqwXeAVmY5sqjnhMgeiCl7G0nehbGZpbD:/65Xe6X9Dmg27RnWGj
- TLSH T16985DF58A74841E0D1B2C27888539946E6727C018B71DBDF1298E73E6F77AE08D3EF21
- MD5 SHA1 SHA512 SSDEEP TLSH
Score7/10-
Event Triggered Execution: Component Object Model Hijacking
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
-
Drops file in System32 directory