General
- Target 2026-10-22_5423f86c65465d5d535dc1edcda8bb1d_icedid_mespinoza_njrat_ryuk
- Size 1.7MB
- Sample261024-qbyx2afa42
- SHA256 b8da87470abd63145b4c179b58d0af051791f2fff3a7e90a734ab310cddcbf8c
- MD5 5423f86c65465d5d535dc1edcda8bb1d
- SHA1 1af3a823780bb83927c1553f40db2bbb7435d706
- SHA512 656cf895d38eabf94cefb5cd04959afc55206006af4a086966d0e3886e5b443827942bde697fd46b11a174010d3a9805dea382dc6b5bed563df50346c2f2e754
- SSDEEP 24576:hiBEkWqwXeAVmYEfJ4yL/tNCJPXUQrPS:tz5Xe6XEfJ4klKXnK
- TLSH T11D85DF58A75440E0D1B6C27888539942E7717C018B71EBDF4398E73A2F7BAE19D3EB21
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-10-22_5423f86c65465d5d535dc1edcda8bb1d_icedid_mespinoza_njrat_ryuk.exe
Resource
win10v2004-20260911-en
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-10-22_5423f86c65465d5d535dc1edcda8bb1d_icedid_mespinoza_njrat_ryuk.exe
Resource
win11ltsc2024-20260911-en
7 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-10-22_5423f86c65465d5d535dc1edcda8bb1d_icedid_mespinoza_njrat_ryuk
- Size 1.7MB
- SHA256 b8da87470abd63145b4c179b58d0af051791f2fff3a7e90a734ab310cddcbf8c
- MD5 5423f86c65465d5d535dc1edcda8bb1d
- SHA1 1af3a823780bb83927c1553f40db2bbb7435d706
- SHA512 656cf895d38eabf94cefb5cd04959afc55206006af4a086966d0e3886e5b443827942bde697fd46b11a174010d3a9805dea382dc6b5bed563df50346c2f2e754
- SSDEEP 24576:hiBEkWqwXeAVmYEfJ4yL/tNCJPXUQrPS:tz5Xe6XEfJ4klKXnK
- TLSH T11D85DF58A75440E0D1B6C27888539942E7717C018B71EBDF4398E73A2F7BAE19D3EB21
- MD5 SHA1 SHA512 SSDEEP TLSH
Score7/10Event Triggered Execution: Component Object Model Hijacking
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
Executes dropped EXE
Drops file in System32 directory