111daa5ffe836ab9951a3ccef2acca7622de29b32108dd24c99b071b279e8a43 | Triage™

Login
Reports

Overview

overview

Static

static

2026-06-30...lc.exe

windows10-2004-x64

2026-06-30...lc.exe

windows11-ltsc_2024-x64

Sharing

Copy URL Twitter E-mail

General

Target
2026-06-30_270226b990864d01822a42f3c390404d_cryptbot_icedid_luca-stealer_njrat_stealc
Size 1.5MB
Sample260701-gpprvaft4q
SHA256 111daa5ffe836ab9951a3ccef2acca7622de29b32108dd24c99b071b279e8a43
MD5 270226b990864d01822a42f3c390404d
SHA1 e3f7d4239d3d13527a579830e3d5c6b57eb487b1
SHA512 d91284e839c9a7620259c94d83da9f58e987632818ddd2ac508f2486948a0240e7e0406f3bb0f54d76628dc1b52551bda32feb07c3684ed84bffcaa745add972
SSDEEP 24576:nRSfrAEH9XIYpj0BEHBxXPGfjuIb1iN1Eob4d/rfcRIU:ngTbH94YxVq21wrfKF
TLSH
T1B1655A55A6A441B8E0A29678CB5EC933E7727CC60F70968F02D47DA73F332507A297D2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery evasion execution trojan

Static task

static1

4 signatures

Behavioral task

behavioral1

Sample

2026-06-30_270226b990864d01822a42f3c390404d_cryptbot_icedid_luca-stealer_njrat_stealc.exe

Resource

win10v2004-20260513-en

windows10-2004-x64

14 signatures

150 seconds

defense_evasion discovery evasion execution trojan

Behavioral task

behavioral2

Sample

2026-06-30_270226b990864d01822a42f3c390404d_cryptbot_icedid_luca-stealer_njrat_stealc.exe

Resource

win11ltsc2024-20260630-en

windows11-ltsc_2024-x64

13 signatures

150 seconds

defense_evasion discovery evasion execution trojan

Malware Config

Targets

- Target
  2026-06-30_270226b990864d01822a42f3c390404d_cryptbot_icedid_luca-stealer_njrat_stealc
- Size 1.5MB
- SHA256 111daa5ffe836ab9951a3ccef2acca7622de29b32108dd24c99b071b279e8a43
- MD5 270226b990864d01822a42f3c390404d
- SHA1 e3f7d4239d3d13527a579830e3d5c6b57eb487b1
- SHA512 d91284e839c9a7620259c94d83da9f58e987632818ddd2ac508f2486948a0240e7e0406f3bb0f54d76628dc1b52551bda32feb07c3684ed84bffcaa745add972
- SSDEEP 24576:nRSfrAEH9XIYpj0BEHBxXPGfjuIb1iN1Eob4d/rfcRIU:ngTbH94YxVq21wrfKF
- TLSH
  T1B1655A55A6A441B8E0A29678CB5EC933E7727CC60F70968F02D47DA73F332507A297D2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery evasion execution trojan
- Contains code to disable Windows Defender
  A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
- Modifies Windows Defender DisableAntiSpyware settings
  evasion trojan
- Modifies Windows Defender notification settings
  defense_evasion trojan
- UAC bypass
  defense_evasion trojan
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

PowerShell

Persistence

Create or Modify System Process

Windows Service

Privilege Escalation

Abuse Elevation Control Mechanism

Bypass User Account Control

Create or Modify System Process

Windows Service

Defense Evasion

Abuse Elevation Control Mechanism

Bypass User Account Control

Impair Defenses

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

defense_evasiondiscoveryevasionexecutiontrojan

behavioral2

defense_evasiondiscoveryevasionexecutiontrojan

© 2018-2026

Terms | Privacy