General
- Target 2026-11-03_7a112ab58f0dd42b8e1c1dd5c0b3b4f2_icedid_mespinoza_njrat_ryuk
- Size 1.1MB
- Sample261104-tthkjsdz2p
- SHA256 d21c6b5b8e8a9fe8bb27eebe2ca344ecff149edae8ffa4a8a5875e068db56090
- MD5 7a112ab58f0dd42b8e1c1dd5c0b3b4f2
- SHA1 716cb9b22d8874bebdb7132cea05af3e2065fb1b
- SHA512 346bad1fea1e8f419d4b8c6ee42adb027ba192d924b466d05b332bdaa660bead95e6a6435fa61aba8a07cdbf5c8f2f20c74ab89124899649c58daef02fd4166b
- SSDEEP 24576:WlPCcvj+YYrfSOWVNcj14S5JPgdbBCZG97+dicaamo0sCBxbtbNQ0jJ+9Ms5T:i7vjMSOWVNcjeS5JPuBCIY9aFTtbNQ0s
- TLSH T1F345E155A7E440B8E1B3D674CA624617FBB338512A71CB5F03A9865B1F337A08F39722
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-11-03_7a112ab58f0dd42b8e1c1dd5c0b3b4f2_icedid_mespinoza_njrat_ryuk.exe
Resource
win10v2004-20260911-en
17 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-11-03_7a112ab58f0dd42b8e1c1dd5c0b3b4f2_icedid_mespinoza_njrat_ryuk
- Size 1.1MB
- SHA256 d21c6b5b8e8a9fe8bb27eebe2ca344ecff149edae8ffa4a8a5875e068db56090
- MD5 7a112ab58f0dd42b8e1c1dd5c0b3b4f2
- SHA1 716cb9b22d8874bebdb7132cea05af3e2065fb1b
- SHA512 346bad1fea1e8f419d4b8c6ee42adb027ba192d924b466d05b332bdaa660bead95e6a6435fa61aba8a07cdbf5c8f2f20c74ab89124899649c58daef02fd4166b
- SSDEEP 24576:WlPCcvj+YYrfSOWVNcj14S5JPgdbBCZG97+dicaamo0sCBxbtbNQ0jJ+9Ms5T:i7vjMSOWVNcjeS5JPuBCIY9aFTtbNQ0s
- TLSH T1F345E155A7E440B8E1B3D674CA624617FBB338512A71CB5F03A9865B1F337A08F39722
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Executes dropped EXE
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops file in System32 directory
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1