Extracted

• • Target
    2026-07-26_edf331ba0ba9ff73b38b4fd4477c7cf5_cryptbot_icedid_luca-stealer_njrat_stealc
  • Size 1.1MB
  • SHA256 6d087b3c60755b19a1bdb36eea898bd5b1f4e1750a353b36df4729619dcab57f
  • MD5 edf331ba0ba9ff73b38b4fd4477c7cf5
  • SHA1 fedeccc55788a157422a07e5e67a87bb187aa6c2
  • SHA512 9af5d98cac3d4c92ffe8ad595d1ad7a89529d849e11a52cd892d374a0e0fa96490df8297ed8728eb1a9653555eaae6553a00956feb4f5799eadddbe39a9fd3e4
  • SSDEEP 24576:ab2+CvRSEHiRkTw+sVtw5cJacKeA+r/I5TnYovCdm3r0/BofSplmMlAa:W2hvRhHukU+sVtw5cMXeA+r/IBnYovIL
  • TLSH
    T118358D1D5BB484EED2A63B388CE1BB29827A76967E34D74F965004D52F33F887C11B42
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecution

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution
  behavioral1behavioral2