Extracted

Extracted

Extracted

Extracted

• • Target
    2026-02-13_9406cc0e972f0b9c34928551dc35c34f_cryptbot_icedid_luca-stealer_njrat_stealc
  • Size 21.9MB
  • SHA256 55b60e27eae1f9fdd63470a9553dc0a3e0750c0ff8d079a016663c1e8db78b55
  • MD5 9406cc0e972f0b9c34928551dc35c34f
  • SHA1 16616de5f073bc5ebbc666435d8c673cd3e02713
  • SHA512 96abbe7f9b179e1bf5bfc2f16bdb6bd024129ff79572c02d015b5629e83cd0b4f262ba88b521fe75aaa52082607f55c2eedbf43b70d9712d72f8d40c57933e61
  • SSDEEP 393216:YLLdB5X47w/Ngpdx5D0asQ90G0NN2XP/8XLGfoF1CXR/5eMe4:YLLf55/2x5D0ZDaP/TQv4
  • TLSH
    T175373356F7F414B8E5B3AA3599511F07E737F84047B0DB8F432CC962AF231A0992AB61
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoverydownloaderexecutionnwormvjw0rmxworminstallerpersistenceprivilege_escalationrattrojanupxworm

  • Detect Xworm Payload

  • NWorm

    A TrickBot module used to propagate to vulnerable domain controllers.

    wormdownloadernworm

  • Nworm family

    nworm

  • Vjw0rm

    Vjw0rm is a remote access trojan written in JavaScript.

    trojanwormvjw0rm

  • Vjw0rm family

    vjw0rm

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Drops file in Drivers directory

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Event Triggered Execution: Component Object Model Hijacking

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Loads dropped DLL

  • Modifies system executable filetype association

    persistence

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2