General
- Target 2026-08-01_f97c3cc8bd1dedea3f900a52311b4ddb_cryptbot_icedid_luca-stealer_njrat_stealc
- Size 3.0MB
- Sample260801-ss397ayhmh
- SHA256 4b8b1dffd983466c32489c4d0d0cacea75adcdae4fdddddec8a73c55ecfbc33b
- MD5 f97c3cc8bd1dedea3f900a52311b4ddb
- SHA1 cb91445f44d98c06d6109ae1e90fc47a596f4879
- SHA512 a97a7fc42502fd885b7b2b09aadb718a7a7b95d6f8a93f4406e7a8ddf623e57d3df7a92f251469b0b7ec43bab836e275a86d03c7017dc26dc6bf4d200770d5b7
- SSDEEP 49152:rKA5/fBjo8VI3NvmF4xqfs9QXrePf7H/F6T9BTT3k0VY9FeNVdPL4jt:rKAVsYsY2zHd6fjDfNVN6
- TLSH T141E52204D7E404F9E1B7D578CE824D52EB767C0943B1EB9F43A4B9960E272E0893EB52
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-01_f97c3cc8bd1dedea3f900a52311b4ddb_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Resource
win10v2004-20260513-en
13 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-01_f97c3cc8bd1dedea3f900a52311b4ddb_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Resource
win11ltsc2024-20260709-en
8 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-01_f97c3cc8bd1dedea3f900a52311b4ddb_cryptbot_icedid_luca-stealer_njrat_stealc
- Size 3.0MB
- SHA256 4b8b1dffd983466c32489c4d0d0cacea75adcdae4fdddddec8a73c55ecfbc33b
- MD5 f97c3cc8bd1dedea3f900a52311b4ddb
- SHA1 cb91445f44d98c06d6109ae1e90fc47a596f4879
- SHA512 a97a7fc42502fd885b7b2b09aadb718a7a7b95d6f8a93f4406e7a8ddf623e57d3df7a92f251469b0b7ec43bab836e275a86d03c7017dc26dc6bf4d200770d5b7
- SSDEEP 49152:rKA5/fBjo8VI3NvmF4xqfs9QXrePf7H/F6T9BTT3k0VY9FeNVdPL4jt:rKAVsYsY2zHd6fjDfNVN6
- TLSH T141E52204D7E404F9E1B7D578CE824D52EB767C0943B1EB9F43A4B9960E272E0893EB52
- MD5 SHA1 SHA512 SSDEEP TLSH
-
UPX dump on OEP (original entry point)
-
XMRig Miner payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Suspicious use of SetThreadContext