General
- Target 2026-10-04_edcbe7a873ec47e9f8e18672414d5118_icedid_mespinoza_njrat_ryuk
- Size 1.0MB
- Sample261004-2nw5raszcs
- SHA256 c85b32a5f195e732dbbbd550dd73a204c56e8abcf725c5b87741e829b05b8efb
- MD5 edcbe7a873ec47e9f8e18672414d5118
- SHA1 bf644cc619820de77d5599f8971e7c0cba5d5602
- SHA512 9b8bb765ded84aeb60405e20d26a643e5ede3da8ef8e759f2fa865e95f0eb414c2aadd4160265acd1d99566bf2707915ab2fb501047db40f4e6f5464dc1ba24d
- SSDEEP 24576:fiBEEWqwXeAVmY4Lqna7RGw1iqhuOM6ansBjxkOTWvks/:7T5Xe6X4WoRGw7uOMkBjxFT6f
- TLSH T1E435D058A75441E0E1B2C23888539942E6717C018BB1DBDF13A8A73E6F77BE19D3AF11
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-10-04_edcbe7a873ec47e9f8e18672414d5118_icedid_mespinoza_njrat_ryuk.exe
Resource
win10v2004-20260911-en
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-10-04_edcbe7a873ec47e9f8e18672414d5118_icedid_mespinoza_njrat_ryuk.exe
Resource
win11ltsc2024-20260911-en
3 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-10-04_edcbe7a873ec47e9f8e18672414d5118_icedid_mespinoza_njrat_ryuk
- Size 1.0MB
- SHA256 c85b32a5f195e732dbbbd550dd73a204c56e8abcf725c5b87741e829b05b8efb
- MD5 edcbe7a873ec47e9f8e18672414d5118
- SHA1 bf644cc619820de77d5599f8971e7c0cba5d5602
- SHA512 9b8bb765ded84aeb60405e20d26a643e5ede3da8ef8e759f2fa865e95f0eb414c2aadd4160265acd1d99566bf2707915ab2fb501047db40f4e6f5464dc1ba24d
- SSDEEP 24576:fiBEEWqwXeAVmY4Lqna7RGw1iqhuOM6ansBjxkOTWvks/:7T5Xe6X4WoRGw7uOMkBjxFT6f
- TLSH T1E435D058A75441E0E1B2C23888539942E6717C018BB1DBDF13A8A73E6F77BE19D3AF11
- MD5 SHA1 SHA512 SSDEEP TLSH
Score7/10-
Event Triggered Execution: Component Object Model Hijacking
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
-
Drops file in System32 directory