General
- Target 2026-08-01_15f9a1798d913615567db24626222f4d_cryptbot_icedid_luca-stealer_njrat_stealc
- Size 3.0MB
- Sample260801-v3j1eaec44
- SHA256 f51a70afb48f0687d35c2c1f22263f2cd84ed78a38134776cf8595bd559aab5f
- MD5 15f9a1798d913615567db24626222f4d
- SHA1 8cc13ff227172a46485f86747166085d97d52888
- SHA512 3c08b68fa61740614e0176a51e955058e817a7d9144e42cbd3a9e2c150fbed786b6ba199cf5422073b9b9dc8948472fb616445c39b4301f7dcaeda26af07ca17
- SSDEEP 49152:rKA5/fBjo8VI3NvmF4xqfs9QXrePf7H/F6T9BTT3k0VY9FeNVdPL4jM:rKAVsYsY2zHd6fjDfNVN/
- TLSH T1A6E52204D7E404F9E1B7D578CE824D52EB767C0943B1EB9F43A4B9960E272E0893EB52
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-01_15f9a1798d913615567db24626222f4d_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Resource
win10v2004-20260513-en
13 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-01_15f9a1798d913615567db24626222f4d_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Resource
win11ltsc2024-20260709-en
8 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-01_15f9a1798d913615567db24626222f4d_cryptbot_icedid_luca-stealer_njrat_stealc
- Size 3.0MB
- SHA256 f51a70afb48f0687d35c2c1f22263f2cd84ed78a38134776cf8595bd559aab5f
- MD5 15f9a1798d913615567db24626222f4d
- SHA1 8cc13ff227172a46485f86747166085d97d52888
- SHA512 3c08b68fa61740614e0176a51e955058e817a7d9144e42cbd3a9e2c150fbed786b6ba199cf5422073b9b9dc8948472fb616445c39b4301f7dcaeda26af07ca17
- SSDEEP 49152:rKA5/fBjo8VI3NvmF4xqfs9QXrePf7H/F6T9BTT3k0VY9FeNVdPL4jM:rKAVsYsY2zHd6fjDfNVN/
- TLSH T1A6E52204D7E404F9E1B7D578CE824D52EB767C0943B1EB9F43A4B9960E272E0893EB52
- MD5 SHA1 SHA512 SSDEEP TLSH
-
UPX dump on OEP (original entry point)
-
XMRig Miner payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Suspicious use of SetThreadContext