General
- Target 2026-09-03_f3ca5075dfa9de4a90cc56a511debd50_cryptbot_icedid_mespinoza_njrat_ryuk
- Size 2.5MB
- Sample260903-xfb3dstflc
- SHA256 37fb465dcf2ab70e18b6361edc7b8f13323e1d4444b0f3f3d3adb6b4770a9e33
- MD5 f3ca5075dfa9de4a90cc56a511debd50
- SHA1 971503154fb8cdb32feab55dd1c65d5625757de3
- SHA512 c17b3f71d01d687be0f4767e6cc8678c186df3dfef4dad11f7e32e67b99c480a7f617fa88cf35fbcd40bae610172cb5ec2f9ea48d845413e9c48eaf292fe12a7
- SSDEEP 49152:A1FjXkDRiPqYWwqqWZvcQUhM4xbYMPFPLzw9tnufxarkztMDJSXeBdH3OLp00l:2jXDRtDJ/ao+DJ7Bp+Pl
- TLSH T14DC5BE46E7AC80BCCD67C138C95286C6F3BE78215D30CB5B56A5A95EDF333605A39322
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-09-03_f3ca5075dfa9de4a90cc56a511debd50_cryptbot_icedid_mespinoza_njrat_ryuk.exe
Resource
win10v2004-20260513-en
19 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-09-03_f3ca5075dfa9de4a90cc56a511debd50_cryptbot_icedid_mespinoza_njrat_ryuk.exe
Resource
win11ltsc2024-20260709-en
0 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-09-03_f3ca5075dfa9de4a90cc56a511debd50_cryptbot_icedid_mespinoza_njrat_ryuk
- Size 2.5MB
- SHA256 37fb465dcf2ab70e18b6361edc7b8f13323e1d4444b0f3f3d3adb6b4770a9e33
- MD5 f3ca5075dfa9de4a90cc56a511debd50
- SHA1 971503154fb8cdb32feab55dd1c65d5625757de3
- SHA512 c17b3f71d01d687be0f4767e6cc8678c186df3dfef4dad11f7e32e67b99c480a7f617fa88cf35fbcd40bae610172cb5ec2f9ea48d845413e9c48eaf292fe12a7
- SSDEEP 49152:A1FjXkDRiPqYWwqqWZvcQUhM4xbYMPFPLzw9tnufxarkztMDJSXeBdH3OLp00l:2jXDRtDJ/ao+DJ7Bp+Pl
- TLSH T14DC5BE46E7AC80BCCD67C138C95286C6F3BE78215D30CB5B56A5A95EDF333605A39322
- MD5 SHA1 SHA512 SSDEEP TLSH
Score8/10-
Disables taskbar notifications via registry modification
-
Executes dropped EXE
-
Modifies system executable filetype association
-
Windows security modification
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops file in System32 directory