General
- Target 2026-08-20_5b6554d52fef4559f377a2cef13aa2f3_cobalt-strike_icedid_mespinoza_njrat_ryuk
- Size 518KB
- Sample260820-l378kavald
- SHA256 aae7e23ee32cfde946a412004f1853519f9e337210e9afd46f01e5b7d5c94a65
- MD5 5b6554d52fef4559f377a2cef13aa2f3
- SHA1 2df0b3d9ba19aaf6f9a752b0cc921ced52d5c09a
- SHA512 489faf53faf14322824b9cbedb0602a616b4adaa52736aa08c20051abfe85c2cd20e726233b598eaba921e5cd182569c885003cbacdccb78358f5e72c159703f
- SSDEEP 12288:qiBlwBAQIXqaE0yCgqwXeAVmoEAl+kV8VCD:qiBE0WqwXeAVmYgkV8Vq
- TLSH T1FDB46B48A75441E0D1B6C27888539943F67178018B71DBDF12A8E73E2F77BE19E3AB21
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-20_5b6554d52fef4559f377a2cef13aa2f3_cobalt-strike_icedid_mespinoza_njrat_ryuk.exe
Resource
win10v2004-20260513-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-20_5b6554d52fef4559f377a2cef13aa2f3_cobalt-strike_icedid_mespinoza_njrat_ryuk.exe
Resource
win11ltsc2024-20260709-en
2 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-20_5b6554d52fef4559f377a2cef13aa2f3_cobalt-strike_icedid_mespinoza_njrat_ryuk
- Size 518KB
- SHA256 aae7e23ee32cfde946a412004f1853519f9e337210e9afd46f01e5b7d5c94a65
- MD5 5b6554d52fef4559f377a2cef13aa2f3
- SHA1 2df0b3d9ba19aaf6f9a752b0cc921ced52d5c09a
- SHA512 489faf53faf14322824b9cbedb0602a616b4adaa52736aa08c20051abfe85c2cd20e726233b598eaba921e5cd182569c885003cbacdccb78358f5e72c159703f
- SSDEEP 12288:qiBlwBAQIXqaE0yCgqwXeAVmoEAl+kV8VCD:qiBE0WqwXeAVmYgkV8Vq
- TLSH T1FDB46B48A75441E0D1B6C27888539943F67178018B71DBDF12A8E73E2F77BE19E3AB21
- MD5 SHA1 SHA512 SSDEEP TLSH
Score7/10-
Event Triggered Execution: Component Object Model Hijacking
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.