2b675bc7c5e1440933c8c8438bb18ae18d9bd85dae844da7fabc6393a628273e

General

Target
2026-07-12_12cf8319f2bd25c8ac5e596d6bc58fca_cryptbot_icedid_luca-stealer_njrat_stealc
Size 113.2MB
Sample260712-zvpcdaaz6x
SHA256 2b675bc7c5e1440933c8c8438bb18ae18d9bd85dae844da7fabc6393a628273e
MD5 12cf8319f2bd25c8ac5e596d6bc58fca
SHA1 7a913f7dcab6c8889fab1e44f6e4772e079b3d98
SHA512 571f76a189cb418d0ef818603bb13c602bbe103b52770a5791c414f0c2928a5429fc8684da3afe6dd46ce14852065a33c468550643537f9131b282f488a5a08e
SSDEEP 3145728:+Qord7Vjx0HclGDJhMw2/l04UKDxCUdplwopN8U:+PrztIo8popN/
TLSH
T121483338DAB5FD4ED29A12B408D2D06AE8763944572263CF12BD99F04F62A58DD73333
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-07-12_12cf8319f2bd25c8ac5e596d6bc58fca_cryptbot_icedid_luca-stealer_njrat_stealc
- Size 113.2MB
- SHA256 2b675bc7c5e1440933c8c8438bb18ae18d9bd85dae844da7fabc6393a628273e
- MD5 12cf8319f2bd25c8ac5e596d6bc58fca
- SHA1 7a913f7dcab6c8889fab1e44f6e4772e079b3d98
- SHA512 571f76a189cb418d0ef818603bb13c602bbe103b52770a5791c414f0c2928a5429fc8684da3afe6dd46ce14852065a33c468550643537f9131b282f488a5a08e
- SSDEEP 3145728:+Qord7Vjx0HclGDJhMw2/l04UKDxCUdplwopN8U:+PrztIo8popN/
- TLSH
  T121483338DAB5FD4ED29A12B408D2D06AE8763944572263CF12BD99F04F62A58DD73333
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery evasion execution persistence ransomware
- Modifies WinLogon for persistence
  persistence
- Modifies boot configuration data using bcdedit
  ransomware evasion
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Executes dropped EXE
- Impair Defenses: Safe Mode Boot
  defense_evasion
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Enumerates processes with tasklist
  discovery
behavioral1 behavioral2