Overview

overview

10

Static

static

10

2026-09-30...uk.exe

windows10-2004-x64

9

2026-09-30...uk.exe

windows11-ltsc_2024-x64

9

Sharing

Copy URL Twitter E-mail

General

  • Target
    2026-09-30_c6aaf5e322ff5d5b731cc7b50fb8c13c_icedid_njrat_ryuk
  • Size 2.2MB
  • Sample260930-js67eawx4n
  • SHA256 6d5f73a75415a702c26e388536a5db881b5b4444206a11ab720dc95b9e7ce360
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
defense_evasiondiscovery

Malware Config

Targets

    • Target
      2026-09-30_c6aaf5e322ff5d5b731cc7b50fb8c13c_icedid_njrat_ryuk
    • Size 2.2MB
    • SHA256 6d5f73a75415a702c26e388536a5db881b5b4444206a11ab720dc95b9e7ce360
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    9/10
    defense_evasiondiscovery

    • Detects executables packed with Enigma

    • Detects executables packed with Themida

    • Detects executables packed with VMProtect.

    • Looks for VirtualBox Guest Additions in registry

      defense_evasion

    • Looks for VMWare Tools registry key

      defense_evasion

    • Maps connected drives based on registry

      Disk information is often read in order to detect sandboxing environments.

    • Discovers running processes

      Running process information can be used to identify security tools or plan follow-on actions.

      discovery

    • Suspicious use of NtSetInformationThreadHideFromDebugger

      defense_evasion
    behavioral1behavioral2

MITRE ATT&CK Enterprise v16

Tasks