Extracted

Extracted

Extracted

Extracted

• • Target
    2026-02-24_6df2b0ebce0805a19e30c386be113fc6_cryptbot_icedid_luca-stealer_njrat_stealc
  • Size 3.9MB
  • SHA256 4ff0b5bb099a2d14d358978ce86717b28ebb4fdf5f7c04b9d401872fa3905a98
  • MD5 6df2b0ebce0805a19e30c386be113fc6
  • SHA1 0d8e42da6b0f003b1fd075d75f9f814ae4623b6a
  • SHA512 dd8cdc40aa56b3f38ce57684ae8528eb00e557b300f0b1dcce018087c8ee884a15034d12c8cef71bd0585b131a96820e231cae22df6e0b40a202b79d246c713b
  • SSDEEP 98304:U23OahmB50AozZzN+kf4B3M/kxrS+t35guH2FF:fLhmL0bZd4prH3a5z
  • TLSH
    T18B162218D3E401FEE0B7E574DA528916E7737C581B71D9CF13AC2A835F236948A39B22
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  f%fdiscoveryexecutionlimeratnjratvjw0rmpersistencerattrojanworm

  • LimeRAT

    Simple yet powerful RAT for Windows machines written in .NET.

    ratlimerat

  • Limerat family

    limerat

  • Njrat family

    njrat

  • Vjw0rm

    Vjw0rm is a remote access trojan written in JavaScript.

    trojanwormvjw0rm

  • Vjw0rm family

    vjw0rm

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Suspicious use of SetThreadContext

  behavioral1behavioral2