General
- Target 2026-07-27_deb2210544688e7d36e9d50d1bc32e46_cryptbot_icedid_luca-stealer_njrat_stealc
- Size 85.3MB
- Sample260727-vj2fcacb65
- SHA256 221829b5bc9c9442c702596cacca4e1a6e2c9dc2999682dd6cdba30ec6e37865
- MD5 deb2210544688e7d36e9d50d1bc32e46
- SHA1 cb3cb64290828d813847353efc3325e591d24177
- SHA512 47bad754e33ade861619b9cada3d6d9477e8dc0392bb52814e856fb78e5cd573fd3b3e6d77abd51e8c65acb877716e8424edf302a895d225bee4d83774ad0b89
- SSDEEP 1572864:VYaMdxvg8SOTCpUIRDyUoTgjW3lEoFlOUiN5MXwbM+6JTIZ1wIbzAUDK6oLPAdw0:VYaMdxvgXOW2Se2a3lDXiNmXt+6JTIZ9
- TLSH T1091833295B6624B4D8D29838C13CFF4CEB3A7D861195631A67A4FF666F7B814060F383
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-27_deb2210544688e7d36e9d50d1bc32e46_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Resource
win10v2004-20260513-en
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-27_deb2210544688e7d36e9d50d1bc32e46_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Resource
win11ltsc2024-20260709-en
18 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-27_deb2210544688e7d36e9d50d1bc32e46_cryptbot_icedid_luca-stealer_njrat_stealc
- Size 85.3MB
- SHA256 221829b5bc9c9442c702596cacca4e1a6e2c9dc2999682dd6cdba30ec6e37865
- MD5 deb2210544688e7d36e9d50d1bc32e46
- SHA1 cb3cb64290828d813847353efc3325e591d24177
- SHA512 47bad754e33ade861619b9cada3d6d9477e8dc0392bb52814e856fb78e5cd573fd3b3e6d77abd51e8c65acb877716e8424edf302a895d225bee4d83774ad0b89
- SSDEEP 1572864:VYaMdxvg8SOTCpUIRDyUoTgjW3lEoFlOUiN5MXwbM+6JTIZ1wIbzAUDK6oLPAdw0:VYaMdxvgXOW2Se2a3lDXiNmXt+6JTIZ9
- TLSH T1091833295B6624B4D8D29838C13CFF4CEB3A7D861195631A67A4FF666F7B814060F383
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10-
Detects executables (downlaoders) containing URLs to raw contents of a paste
-
Executes dropped EXE
-
Loads dropped DLL
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.