General
- Target 2026-08-27_ed8b066aadddc468f5a99b40c0429f0d_icedid_mespinoza_njrat_ryuk
- Size 1.6MB
- Sample260828-c5xp6ssvax
- SHA256 ca2d8f9ad6ef548882824eb5d209a9fcb16aa8c3898fa6e3f71b500edff82a21
- MD5 ed8b066aadddc468f5a99b40c0429f0d
- SHA1 72562db2897c1e7ee898ecc28652e2b4d8f4cb07
- SHA512 c0ace9d81feada87ade5f527bd91fefa0719ac17ea68164f820b516483120a504a5f29715977e7e31fdc601d3e3d93e97c4388cd54098e1f0afccc524a3a9441
- SSDEEP 24576:sIg/X2v8lf/Do6nWl1R3u48sqjnhMgeiCl7G0nehbGZpbDR:IXq8lf/Do6WlvHoDmg27RnWGjJ
- TLSH T12E75D05AE75448F5D1268138C552860BE3B27C584B71D7CB12A9E3BE2F335D09E3EB22
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-27_ed8b066aadddc468f5a99b40c0429f0d_icedid_mespinoza_njrat_ryuk.exe
Resource
win10v2004-20260513-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-27_ed8b066aadddc468f5a99b40c0429f0d_icedid_mespinoza_njrat_ryuk.exe
Resource
win11ltsc2024-20260709-en
2 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-27_ed8b066aadddc468f5a99b40c0429f0d_icedid_mespinoza_njrat_ryuk
- Size 1.6MB
- SHA256 ca2d8f9ad6ef548882824eb5d209a9fcb16aa8c3898fa6e3f71b500edff82a21
- MD5 ed8b066aadddc468f5a99b40c0429f0d
- SHA1 72562db2897c1e7ee898ecc28652e2b4d8f4cb07
- SHA512 c0ace9d81feada87ade5f527bd91fefa0719ac17ea68164f820b516483120a504a5f29715977e7e31fdc601d3e3d93e97c4388cd54098e1f0afccc524a3a9441
- SSDEEP 24576:sIg/X2v8lf/Do6nWl1R3u48sqjnhMgeiCl7G0nehbGZpbDR:IXq8lf/Do6WlvHoDmg27RnWGjJ
- TLSH T12E75D05AE75448F5D1268138C552860BE3B27C584B71D7CB12A9E3BE2F335D09E3EB22
- MD5 SHA1 SHA512 SSDEEP TLSH
Score7/10-
Event Triggered Execution: Component Object Model Hijacking
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.