General
- Target 2026-08-18_3af6e4d12d0134f7b652c9b4e1ea7115_cryptbot_icedid_njrat_ryuk
- Size 921KB
- Sample260818-hr1gssfp71
- SHA256 3724417bb5a6f29f2a84c61532ed7671740bc6c97e2e8a7b2cd65ae6bd0b73e5
- MD5 3af6e4d12d0134f7b652c9b4e1ea7115
- SHA1 ce286110400609b37f483a8496b30977880eeb08
- SHA512 7df64bc4122365b444c5551b6053c17acdd6d96d617ac39a93f06d7dc542684900cd418a2fab8f2d690963a2ee2eacc6ce62e515e4aac88a7e7474b6b9cb3ea3
- SSDEEP 24576:msubclce6BpXV+8jh8B3INV2wSViat1Kq55BU2wdnVELI53nY:Cbclx6BpX9jhaIrvat1Kq5ARikxY
- TLSH T1FC15D03A9AF56799D973E1B4DA811093F12A3A0327F1E1BF432A96253F537B10934B13
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-18_3af6e4d12d0134f7b652c9b4e1ea7115_cryptbot_icedid_njrat_ryuk.exe
Resource
win10v2004-20260513-en
15 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-18_3af6e4d12d0134f7b652c9b4e1ea7115_cryptbot_icedid_njrat_ryuk.exe
Resource
win11ltsc2024-20260709-en
14 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-18_3af6e4d12d0134f7b652c9b4e1ea7115_cryptbot_icedid_njrat_ryuk
- Size 921KB
- SHA256 3724417bb5a6f29f2a84c61532ed7671740bc6c97e2e8a7b2cd65ae6bd0b73e5
- MD5 3af6e4d12d0134f7b652c9b4e1ea7115
- SHA1 ce286110400609b37f483a8496b30977880eeb08
- SHA512 7df64bc4122365b444c5551b6053c17acdd6d96d617ac39a93f06d7dc542684900cd418a2fab8f2d690963a2ee2eacc6ce62e515e4aac88a7e7474b6b9cb3ea3
- SSDEEP 24576:msubclce6BpXV+8jh8B3INV2wSViat1Kq55BU2wdnVELI53nY:Cbclx6BpX9jhaIrvat1Kq5ARikxY
- TLSH T1FC15D03A9AF56799D973E1B4DA811093F12A3A0327F1E1BF432A96253F537B10934B13
- MD5 SHA1 SHA512 SSDEEP TLSH
Score7/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE