Extracted

Extracted

• • Target
    2026-07-19_07ff06af8a76e07497c9292fc72302ff_cryptbot_icedid_luca-stealer_njrat_stealc
  • Size 80.2MB
  • SHA256 a024d5b73dae28889cf052e60cc8de86ab7fad45f13b3a6fa1316ff58531ade0
  • MD5 07ff06af8a76e07497c9292fc72302ff
  • SHA1 552a16678b3631db27b13afc61c5edf12cba0b20
  • SHA512 b477e603e246d827d3ec8d28f4051db700e63fe876d4253ddb94aa27f8e82f42a342a0e908dcc1ed369ecbf27fb63e73cf53e535a09c1035fceda156d981bba8
  • SSDEEP 1572864:RsWwg28qYQptG4QpxQxWNJ3JPmnH4r4c2PDZFJLiy68iF8CHpfaecwakQdT08aU:Rbw78qYWvyQxe3JPmnH4wli7NPspWU
  • TLSH
    T177083305CFE211B6D19784F18A0BD03EE972790A23629BAF0379DB3B4999274C97F351
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasionexecutionspywarestealer

  • Detect binaries embedding considerable number of MFA browser extension IDs.

  • Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.

  • Detects PowerShell content designed to retrieve passwords from host

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Indicator Removal: File Deletion

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2