Extracted

• • Target
    2026-06-26_cf04f7c15ad45407e123653c79c0818d_cryptbot_icedid_luca-stealer_njrat_stealc
  • Size 108.8MB
  • SHA256 3ff9ad301ec0d2ff2be86c87ec18075b28a2329651a8b1922615b3d28994665f
  • MD5 cf04f7c15ad45407e123653c79c0818d
  • SHA1 b94c3dd70a04b4d28c4e3cb3035044a394f0a4c8
  • SHA512 ad21c56cb109dbf9ac44f59ba093cb816fc2bdd9f1e012eeb3722633100411819004e143dd57c04b072273f6a71090e55c4f2a8aea671c6c2b8317764e7fab89
  • SSDEEP 3145728:H5joggkkKd24V9LJ4hW6Im4puCKsRM0jQPJmMJMbt9GVSewuDP3:poggFo24Vn4w/m4pJKs7QPJmMJGt9FrO
  • TLSH
    T108483302D37E44DCD99CF8B0CA875B22E73EF44A9B11455B435AA3531E273F6863EA06
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  backdoordefense_evasionhavoctrojanadwarepersistencespyware

  • Detects Havoc payload

  • Family: Havoc, HavocC2

    Havoc is an open-source backdoor and post-exploitation framework written in C++.

    backdoorhavoc

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Checks whether UAC is enabled

    defense_evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Checks system information in the registry

    System information is often read in order to detect sandboxing environments.

  behavioral1behavioral2