General
- Target 2026-09-08_d4d83d5fa1779fc3a5217a1c90a7021f_icedid_mespinoza_njrat_ryuk
- Size 1.8MB
- Sample260910-cy78bstgqb
- SHA256 89b9d6c117b75b17596e41d23e8c874b5c9b317503aee3f145d9c7212dce03e2
- MD5 d4d83d5fa1779fc3a5217a1c90a7021f
- SHA1 1a5f8688492968cde7e29f5961b458c12a4eaf6e
- SHA512 959aecbe3989bd6465e6c45415152010b62878ca9c11eb818c338fd7d319a3ac80ba72d4c89abfdcc3b4d1da189a9b98b3cbdfd63aea5dab2a1181a9c15b1a38
- SSDEEP 24576:EiBE0zqwXeAVmYA22C9+bmOmbTk3reZCIT59z7m:Ee5Xe6XA2LlOpbeZB7m
- TLSH T1FF85D048A75445E0D1B6C23888539946E6717C018BB1EBDF4298E73E2F77BE09D3EB21
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-09-08_d4d83d5fa1779fc3a5217a1c90a7021f_icedid_mespinoza_njrat_ryuk.exe
Resource
win10v2004-20260513-en
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-09-08_d4d83d5fa1779fc3a5217a1c90a7021f_icedid_mespinoza_njrat_ryuk.exe
Resource
win11ltsc2024-20260709-en
6 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-09-08_d4d83d5fa1779fc3a5217a1c90a7021f_icedid_mespinoza_njrat_ryuk
- Size 1.8MB
- SHA256 89b9d6c117b75b17596e41d23e8c874b5c9b317503aee3f145d9c7212dce03e2
- MD5 d4d83d5fa1779fc3a5217a1c90a7021f
- SHA1 1a5f8688492968cde7e29f5961b458c12a4eaf6e
- SHA512 959aecbe3989bd6465e6c45415152010b62878ca9c11eb818c338fd7d319a3ac80ba72d4c89abfdcc3b4d1da189a9b98b3cbdfd63aea5dab2a1181a9c15b1a38
- SSDEEP 24576:EiBE0zqwXeAVmYA22C9+bmOmbTk3reZCIT59z7m:Ee5Xe6XA2LlOpbeZB7m
- TLSH T1FF85D048A75445E0D1B6C23888539946E6717C018BB1EBDF4298E73E2F77BE09D3EB21
- MD5 SHA1 SHA512 SSDEEP TLSH
Score7/10-
Event Triggered Execution: Component Object Model Hijacking
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
-
Drops file in System32 directory