Extracted

• • Target
    2026-02-04_01803ec695b92f3e0c8b7ac7f204ec5f_cryptbot_icedid_luca-stealer_njrat_stealc
  • Size 30.6MB
  • SHA256 949fdff7add8424402563119503a81a3ea58be83321ba17a12a82b02fc6402ce
  • MD5 01803ec695b92f3e0c8b7ac7f204ec5f
  • SHA1 8f899be79a6f22b21084952c11f347701955f1ba
  • SHA512 023de52f20061237c8c717dc017c9e09feecd7774cadef209b812f0f7587e65f3f3e03c63140b1de3805a8d2ea8406b44634a6759190e1f593a5ca794977a0f1
  • SSDEEP 786432:tUKk9/E3M1MgCsm3IhVVkebg3+Oy70qZcTakRfasfX3SC:tUJNMVD3IhVVH03+OynFWas/D
  • TLSH
    T11B673325D76061F9C9ABD534CC918827DF3A7C0A4397FB8B57FA817A1E532414E3AB02
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  administtratordefense_evasiondiscoveryexecutionblackguardgrowtopianjratxmrigminerpersistenceransomwarespywarestealertrojan

  • BlackGuard

    Infostealer first seen in Late 2021.

    stealerblackguard

  • Blackguard family

    blackguard

  • Growtopia

    Growtopa is an opensource modular stealer written in C#.

    stealergrowtopia

  • Growtopia family

    growtopia

  • Njrat family

    njrat

  • Xmrig family

    xmrig

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig

  • Clears Windows event logs

    defense_evasionransomware

  • XMRig Miner payload

    miner

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2