General
- Target 2026-10-19_3e95bd4be265d167f4ab7559a42f4e8c_icedid_mespinoza_njrat_ryuk_stealc
- Size 24.0MB
- Sample261020-2mfflswzhy
- SHA256 eaee116153805dad650fb15495c22838e081460dd7993cd3595eab75a896623a
- MD5 3e95bd4be265d167f4ab7559a42f4e8c
- SHA1 4bfce1713279424d9a6a3d2ae5c874d13899e55a
- SHA512 9a1c1eb68077bbf950210ed468ab206c8623220aa479ef49686e5dd26c90ef8f151fa1a4cf6a4d4256b38c1cf11a06d6195b4eeab6901b97c939fdbf03bdd5c7
- SSDEEP 196608:t7kqT+qrLdfGio3Z5kRmBF14blJZXzlp5lrFiovVFyoluId3XbB5Iqfj0buRa/Pj:twqTCqlR4pS7T6cLrFzF+R
- TLSH T155473A178D0C8B4AD015A2F8BD070D5B5BF63F089952EFEB41E20EDB3E2B2516E9911D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-10-19_3e95bd4be265d167f4ab7559a42f4e8c_icedid_mespinoza_njrat_ryuk_stealc.exe
Resource
win10v2004-20260911-en
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-10-19_3e95bd4be265d167f4ab7559a42f4e8c_icedid_mespinoza_njrat_ryuk_stealc.exe
Resource
win11ltsc2024-20260911-en
4 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-10-19_3e95bd4be265d167f4ab7559a42f4e8c_icedid_mespinoza_njrat_ryuk_stealc
- Size 24.0MB
- SHA256 eaee116153805dad650fb15495c22838e081460dd7993cd3595eab75a896623a
- MD5 3e95bd4be265d167f4ab7559a42f4e8c
- SHA1 4bfce1713279424d9a6a3d2ae5c874d13899e55a
- SHA512 9a1c1eb68077bbf950210ed468ab206c8623220aa479ef49686e5dd26c90ef8f151fa1a4cf6a4d4256b38c1cf11a06d6195b4eeab6901b97c939fdbf03bdd5c7
- SSDEEP 196608:t7kqT+qrLdfGio3Z5kRmBF14blJZXzlp5lrFiovVFyoluId3XbB5Iqfj0buRa/Pj:twqTCqlR4pS7T6cLrFzF+R
- TLSH T155473A178D0C8B4AD015A2F8BD070D5B5BF63F089952EFEB41E20EDB3E2B2516E9911D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score8/10-
Sets service image path in registry
This determines the executable launched when a service starts. It can be used to establish persistence.
-
Drops file in System32 directory
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1