b287d0467eb30d4e9822155b586c7f7702e139c38872571904c06b08b6618d18

Analysis

max time kernel
149s
max time network
152s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
18/05/2026, 04:30

Target
2026-05-18_8a5a086e044b2116649fd2915d4cc217_icedid_luca-stealer_njrat_stealc.exe
Size 9.7MB
Sample260518-e5axhsfz3z
SHA256 b287d0467eb30d4e9822155b586c7f7702e139c38872571904c06b08b6618d18
MD5 8a5a086e044b2116649fd2915d4cc217
SHA1 8037b96bdd945c4a0cd956a795978d44e8df5c8b
SHA512 b640243bfc2909c38d7100179f794888173648b3264f571a3ffcf1f227054e75c797bcc54d33fdc3baf0dab339c49c78fb73cfde6d4c204fa614b7702afd7644
SSDEEP 98304:6lY/nJdnH8PiruajuXJE911+u6HDENHO+hdx7AzwNQPRxdC17TogzPTCy7JzPRax:6wJmPSjuXE1KDENTzcp/d2xzLCINMGa
TLSH
T137A6015E62883378D01B843CB537AD05F2B26619C3B4D5DF32C7E9806B7A5E4963EB06
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

vmprotect

Detects executables packed with VMProtect. 1 IoCs

resource	yara_rule
behavioral2/memory/1820-0-0x00007FF64FE00000-0x00007FF6507C2000-memory.dmp	INDICATOR_EXE_Packed_VMProtect

Detects executables referencing many IR and analysis tools 1 IoCs

resource	yara_rule
behavioral2/memory/1820-0-0x00007FF64FE00000-0x00007FF6507C2000-memory.dmp	INDICATOR_SUSPICIOUS_References_SecTools

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
behavioral2/memory/1820-0-0x00007FF64FE00000-0x00007FF6507C2000-memory.dmp	vmprotect

C:\Users\Admin\AppData\Local\Temp\2026-05-18_8a5a086e044b2116649fd2915d4cc217_icedid_luca-stealer_njrat_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-18_8a5a086e044b2116649fd2915d4cc217_icedid_luca-stealer_njrat_stealc.exe"
1⤵
PID:1820