General
- Target 2026-08-22_42279fc4dc4a3fb5254e1de750bf0926_cobalt-strike_icedid_mespinoza_njrat_ryuk
- Size 506KB
- Sample260823-lberyavfmf
- SHA256 5f723ff6a508633edd88f43ea7743596c8aa400db29ae6b24549d94e97484148
- MD5 42279fc4dc4a3fb5254e1de750bf0926
- SHA1 c327985627e7f2356b42c1e358661f88163873e0
- SHA512 5ee982fe20aaf55a85e424193bbe408143e38426507ab05c6725fd6fb4cc66336af9f6f49de95f2ff10a3cf2e7f10c4d62b0f834a3c782ca39969c24570aae78
- SSDEEP 6144:NiBlwsmAQIPvTmaEVmP02yCUE+cw0wIceA4D55qv4t/uBmohChYgXP6RIedV+:NiBlwBAQIXqaE0yCgqwXeAVmoEAldU
- TLSH T1ECB46B58A75441E0D1B2C23888539947E67178018BB1DBDF12A8E73E2F77BE19D3EB21
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Static task
static1
Behavioral task
behavioral1
Sample
2026-08-22_42279fc4dc4a3fb5254e1de750bf0926_cobalt-strike_icedid_mespinoza_njrat_ryuk.exe
Resource
win10v2004-20260513-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-22_42279fc4dc4a3fb5254e1de750bf0926_cobalt-strike_icedid_mespinoza_njrat_ryuk.exe
Resource
win11ltsc2024-20260709-en
2 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-22_42279fc4dc4a3fb5254e1de750bf0926_cobalt-strike_icedid_mespinoza_njrat_ryuk
- Size 506KB
- SHA256 5f723ff6a508633edd88f43ea7743596c8aa400db29ae6b24549d94e97484148
- MD5 42279fc4dc4a3fb5254e1de750bf0926
- SHA1 c327985627e7f2356b42c1e358661f88163873e0
- SHA512 5ee982fe20aaf55a85e424193bbe408143e38426507ab05c6725fd6fb4cc66336af9f6f49de95f2ff10a3cf2e7f10c4d62b0f834a3c782ca39969c24570aae78
- SSDEEP 6144:NiBlwsmAQIPvTmaEVmP02yCUE+cw0wIceA4D55qv4t/uBmohChYgXP6RIedV+:NiBlwBAQIXqaE0yCgqwXeAVmoEAldU
- TLSH T1ECB46B58A75441E0D1B2C23888539947E67178018BB1DBDF12A8E73E2F77BE19D3EB21
- MD5 SHA1 SHA512 SSDEEP TLSH
Score5/10-
Event Triggered Execution: Component Object Model Hijacking
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.