General
- Target 2026-08-20_728631ef2ae2031a4240586cd8ac712d_cryptbot_icedid_mespinoza_njrat_ryuk
- Size 2.5MB
- Sample260820-1mc5tabj7x
- SHA256 521d990d8fb85d48a0f59e130761233a7f06bd2e16243bed2f61d4f4567adee6
- MD5 728631ef2ae2031a4240586cd8ac712d
- SHA1 cf58bf273d3b58ca3f4b45b8c0070bba8d99e157
- SHA512 343fcdea9b62c1022eb02ce3b966c5ffa4272b78991cdb8e8dbea94fc7e44d73002e7b82e9d81fb4e4fb685e9c2f93001c002a2e37cf5405f286dccb2c8d4308
- SSDEEP 49152:11FjXkDRiPqYWwqqWZvcQUhM4xbYMPFPLzwatnufxarkztMDJSXeBdH3OML:ljXDRtDJkao+DJ7Bp+ML
- TLSH T1A7C5D05577B040E8C17BD234CAB7864FE2F27811D9F1CF6B5A69A94E1F333A14A29312
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-20_728631ef2ae2031a4240586cd8ac712d_cryptbot_icedid_mespinoza_njrat_ryuk.exe
Resource
win10v2004-20260513-en
19 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-20_728631ef2ae2031a4240586cd8ac712d_cryptbot_icedid_mespinoza_njrat_ryuk.exe
Resource
win11ltsc2024-20260709-en
0 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-20_728631ef2ae2031a4240586cd8ac712d_cryptbot_icedid_mespinoza_njrat_ryuk
- Size 2.5MB
- SHA256 521d990d8fb85d48a0f59e130761233a7f06bd2e16243bed2f61d4f4567adee6
- MD5 728631ef2ae2031a4240586cd8ac712d
- SHA1 cf58bf273d3b58ca3f4b45b8c0070bba8d99e157
- SHA512 343fcdea9b62c1022eb02ce3b966c5ffa4272b78991cdb8e8dbea94fc7e44d73002e7b82e9d81fb4e4fb685e9c2f93001c002a2e37cf5405f286dccb2c8d4308
- SSDEEP 49152:11FjXkDRiPqYWwqqWZvcQUhM4xbYMPFPLzwatnufxarkztMDJSXeBdH3OML:ljXDRtDJkao+DJ7Bp+ML
- TLSH T1A7C5D05577B040E8C17BD234CAB7864FE2F27811D9F1CF6B5A69A94E1F333A14A29312
- MD5 SHA1 SHA512 SSDEEP TLSH
Score8/10Disables taskbar notifications via registry modification
Executes dropped EXE
Modifies system executable filetype association
Windows security modification
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
Drops file in System32 directory