General
- Target 2026-08-01_93a15dd6bff6f24ccebd412fbe97d2b8_cryptbot_icedid_luca-stealer_njrat_stealc
- Size 3.0MB
- Sample260801-tstanaszdw
- SHA256 cb642dff9413d393c2c196774d5752755cb327cc365a33fbd3c21e182bd4d7cd
- MD5 93a15dd6bff6f24ccebd412fbe97d2b8
- SHA1 53f8c68c30a8dd61943d91de9165c66c0d588f86
- SHA512 4b5b28fe58b8c59fc20cf627a879b53fa2e79455bcdb995a908cfe27d072e0b553bc2ca6913f50a3c3d03d3c996c6586c1f1745ee4868eb43e67a51300495a0c
- SSDEEP 49152:rKA5/fBjo8VI3NvmF4xqfs9QXrePf7H/F6T9BTT3k0VY9FeNVdPL4j3:rKAVsYsY2zHd6fjDfNVNC
- TLSH T141E52204D7E404F9E1B7D578CE824D52EB767C0943B1EB9F43A4B9960E272E0893EB52
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-01_93a15dd6bff6f24ccebd412fbe97d2b8_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Resource
win10v2004-20260513-en
13 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-01_93a15dd6bff6f24ccebd412fbe97d2b8_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Resource
win11ltsc2024-20260709-en
8 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-01_93a15dd6bff6f24ccebd412fbe97d2b8_cryptbot_icedid_luca-stealer_njrat_stealc
- Size 3.0MB
- SHA256 cb642dff9413d393c2c196774d5752755cb327cc365a33fbd3c21e182bd4d7cd
- MD5 93a15dd6bff6f24ccebd412fbe97d2b8
- SHA1 53f8c68c30a8dd61943d91de9165c66c0d588f86
- SHA512 4b5b28fe58b8c59fc20cf627a879b53fa2e79455bcdb995a908cfe27d072e0b553bc2ca6913f50a3c3d03d3c996c6586c1f1745ee4868eb43e67a51300495a0c
- SSDEEP 49152:rKA5/fBjo8VI3NvmF4xqfs9QXrePf7H/F6T9BTT3k0VY9FeNVdPL4j3:rKAVsYsY2zHd6fjDfNVNC
- TLSH T141E52204D7E404F9E1B7D578CE824D52EB767C0943B1EB9F43A4B9960E272E0893EB52
- MD5 SHA1 SHA512 SSDEEP TLSH
-
UPX dump on OEP (original entry point)
-
XMRig Miner payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Suspicious use of SetThreadContext