1a0ea52c0da31179c04aac4e740926f41f8c48c52c1693bbbf49a0e60ffc5fa6 | Triage™

Login
Reports

Overview

overview

7

Static

static

3

2026-11-03...uk.exe

windows10-2004-x64

7

2026-11-03...uk.exe

windows11-ltsc_2024-x64

5

Sharing

Copy URL Twitter E-mail

General

Target
2026-11-03_5cfe3af8ddc79010667c433082ba69c1_icedid_mespinoza_njrat_ryuk
Size 1.7MB
Sample261104-x779xaee68
SHA256 1a0ea52c0da31179c04aac4e740926f41f8c48c52c1693bbbf49a0e60ffc5fa6
MD5 5cfe3af8ddc79010667c433082ba69c1
SHA1 39e670ffbc84258d09c83d4a0f8c8f9a40afb223
SHA512 daeb323ca07966873b28e742428be728d35ca82a944a0cf04ecefad270b8945fa2fcb4d3711a9619b5f8d803afc9ede36d08313b13b9559e7fc3a3ac66281649
SSDEEP 24576:2OA+xJ99nWRccfAFUn/G6yVXuqsBYsywPc8peO3r/UN95cS9l0Tp7:22DnWRccfV/G6BYcPe+m9SS9uTp7
TLSH
T1FF85E045E7F500F8E1B39634CDB24606E6B33C995A70CB4F23A9865A2F736509D39B32
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery ransomware spyware stealer

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

2026-11-03_5cfe3af8ddc79010667c433082ba69c1_icedid_mespinoza_njrat_ryuk.exe

Resource

win10v2004-20260911-en

windows10-2004-x64

16 signatures

150 seconds

defense_evasion discovery ransomware spyware stealer

Behavioral task

behavioral2

Sample

2026-11-03_5cfe3af8ddc79010667c433082ba69c1_icedid_mespinoza_njrat_ryuk.exe

Resource

win11ltsc2024-20260911-en

windows11-ltsc_2024-x64

3 signatures

150 seconds

Malware Config

Targets

- Target
  2026-11-03_5cfe3af8ddc79010667c433082ba69c1_icedid_mespinoza_njrat_ryuk
- Size 1.7MB
- SHA256 1a0ea52c0da31179c04aac4e740926f41f8c48c52c1693bbbf49a0e60ffc5fa6
- MD5 5cfe3af8ddc79010667c433082ba69c1
- SHA1 39e670ffbc84258d09c83d4a0f8c8f9a40afb223
- SHA512 daeb323ca07966873b28e742428be728d35ca82a944a0cf04ecefad270b8945fa2fcb4d3711a9619b5f8d803afc9ede36d08313b13b9559e7fc3a3ac66281649
- SSDEEP 24576:2OA+xJ99nWRccfAFUn/G6yVXuqsBYsywPc8peO3r/UN95cS9l0Tp7:22DnWRccfV/G6BYcPe+m9SS9uTp7
- TLSH
  T1FF85E045E7F500F8E1B39634CDB24606E6B33C995A70CB4F23A9865A2F736509D39B32
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

defense_evasion discovery ransomware spyware stealer
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Direct Volume Access

Credential Access

Credentials from Password Stores

Credentials from Web Browsers

Unsecured Credentials

Credentials In Files

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

System Network Configuration Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

defense_evasiondiscoveryransomwarespywarestealer

behavioral2

© 2018-2026

Terms | Privacy