Extracted

• • Target
    2026-05-22_f3958500893bd62fb6ebd9a26fdb7e3b_cryptbot_icedid_luca-stealer_njrat_stealc
  • Size 142.2MB
  • SHA256 4b5cd7c553f9e21b3afee13962942bc3d5c401345eb20e7dc31ae669bac8940f
  • MD5 f3958500893bd62fb6ebd9a26fdb7e3b
  • SHA1 c9ebe3f1d01a108a0f92d12b42caba83157ef61b
  • SHA512 f8c4377e3df0eeb2e4255c2f22e01659ce4238a3855c90353645c8e98e3e977d970ac7e242d595d1bbaa75c83be0bff0e902a611c072a05e806c9321ec9636e8
  • SSDEEP 3145728:Uv3XKFKEEEV2Loxj1Wy4f7HZ8z9WHyOM+jkg+JC0IBdZv:83iMEWoALfLNNlkg+JPI
  • TLSH
    T10968332E7AF10E91C582F578D60ECF938DB2382A4B24D74E93BE95618E97531C51EBC0
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  adwarediscoveryexecutionpersistencespywarestealer

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2