General
- Target 2026-09-26_8bd73ed3085e64fa093a7cdc37ba8ff3_icedid_njrat_ryuk
- Size 1.5MB
- Sample260926-xmervszena
- SHA256 f5a131df2af2488fa19503a18ce2cd9db46ee7e9bff003ceb90a3543b2e4ef8a
- MD5 8bd73ed3085e64fa093a7cdc37ba8ff3
- SHA1 2ffa0753116fc51cb393899307b3e8f025f19c24
- SHA512 d201ffdabce576d3c7b094f60011d9e9576c448f4bcbdf40c3f3c66c82c8d64d5e7668925e8066342a138b4492d8ebf0027ac2ab82d03ebe931864afc12f51fb
- SSDEEP 24576:P8IRzVakfCrljc3voKFLgYHJWwl24C15rDY:PjRzVakfCrlyQKKYpWwl1+NY
- TLSH T100750146F7A500F6D977C13C89A28513D272B85D0760EBDF43688A5A1F63AF15E3EB20
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-09-26_8bd73ed3085e64fa093a7cdc37ba8ff3_icedid_njrat_ryuk.exe
Resource
win10v2004-20260911-en
16 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-09-26_8bd73ed3085e64fa093a7cdc37ba8ff3_icedid_njrat_ryuk.exe
Resource
win11ltsc2024-20260911-en
0 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-09-26_8bd73ed3085e64fa093a7cdc37ba8ff3_icedid_njrat_ryuk
- Size 1.5MB
- SHA256 f5a131df2af2488fa19503a18ce2cd9db46ee7e9bff003ceb90a3543b2e4ef8a
- MD5 8bd73ed3085e64fa093a7cdc37ba8ff3
- SHA1 2ffa0753116fc51cb393899307b3e8f025f19c24
- SHA512 d201ffdabce576d3c7b094f60011d9e9576c448f4bcbdf40c3f3c66c82c8d64d5e7668925e8066342a138b4492d8ebf0027ac2ab82d03ebe931864afc12f51fb
- SSDEEP 24576:P8IRzVakfCrljc3voKFLgYHJWwl24C15rDY:PjRzVakfCrlyQKKYpWwl1+NY
- TLSH T100750146F7A500F6D977C13C89A28513D272B85D0760EBDF43688A5A1F63AF15E3EB20
- MD5 SHA1 SHA512 SSDEEP TLSH
Score7/10-
Executes dropped EXE
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops file in System32 directory
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1