General
- Target 2026-10-28_9ae473615b1cbf9c88b9963ee8bd3f7f_icedid_mespinoza_njrat_ryuk
- Size 1.8MB
- Sample261029-2rpj3sty2n
- SHA256 7b4b5c1204b69141ea3d87d680ca4cdece242f20257103b3e6c8884b205a5db3
- MD5 9ae473615b1cbf9c88b9963ee8bd3f7f
- SHA1 95df73a76ebbdef89615cb38d49ec9421dd46b3f
- SHA512 b031280adc5c0c9448bf5816dab1807daf8c4c0ad08ab4913b84cdbaebe31e1e80490436b5d97acf8d90614557922b54fc827ef566c376041aaba7e51a219851
- SSDEEP 12288:myVOd/SmcJAmfPNsJutSVq9teZKcmKIbSYr3omkdEu2OEEH9JZdy:my+TcSmf1skAVq9teZaKJBE2p
- TLSH T10E95CF0173E84199F5F7A7789AF691269A337C925B34C68F0354426A1FB3F908D39B32
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-10-28_9ae473615b1cbf9c88b9963ee8bd3f7f_icedid_mespinoza_njrat_ryuk.exe
Resource
win10v2004-20260911-en
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-10-28_9ae473615b1cbf9c88b9963ee8bd3f7f_icedid_mespinoza_njrat_ryuk.exe
Resource
win11ltsc2024-20260911-en
7 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-10-28_9ae473615b1cbf9c88b9963ee8bd3f7f_icedid_mespinoza_njrat_ryuk
- Size 1.8MB
- SHA256 7b4b5c1204b69141ea3d87d680ca4cdece242f20257103b3e6c8884b205a5db3
- MD5 9ae473615b1cbf9c88b9963ee8bd3f7f
- SHA1 95df73a76ebbdef89615cb38d49ec9421dd46b3f
- SHA512 b031280adc5c0c9448bf5816dab1807daf8c4c0ad08ab4913b84cdbaebe31e1e80490436b5d97acf8d90614557922b54fc827ef566c376041aaba7e51a219851
- SSDEEP 12288:myVOd/SmcJAmfPNsJutSVq9teZKcmKIbSYr3omkdEu2OEEH9JZdy:my+TcSmf1skAVq9teZaKJBE2p
- TLSH T10E95CF0173E84199F5F7A7789AF691269A337C925B34C68F0354426A1FB3F908D39B32
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Drops file in System32 directory