General
- Target 2026-08-02_88a957c2dd9d793805596f79da6a03ed_cryptbot_icedid_luca-stealer_njrat_stealc
- Size 3.0MB
- Sample260802-gla5aadp5t
- SHA256 e455ebe514a88a13f96a2a86698f50436b459e1d5854f1b5673446a89e5a8d46
- MD5 88a957c2dd9d793805596f79da6a03ed
- SHA1 6b2c07602101591aec008022243e527f28a9686b
- SHA512 97dbf8c762cd4d044cb92dff8baad4a2ed1007740c800cd390478fc9b5723de62af5b094f9775940e1512b955c6a5c6ec6435b7a8f71148d82e20326978c2cb2
- SSDEEP 49152:rKA5/fBjo8VI3NvmF4xqfs9QXrePf7H/F6T9BTT3k0VY9FeNVdPL4j7:rKAVsYsY2zHd6fjDfNVNm
- TLSH T166E52204D7E404F9E1B7D578CE824D52EB767C0943B1EB9F43A4B9960E272E0893EB52
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-02_88a957c2dd9d793805596f79da6a03ed_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Resource
win10v2004-20260513-en
13 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-02_88a957c2dd9d793805596f79da6a03ed_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Resource
win11ltsc2024-20260709-en
8 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-02_88a957c2dd9d793805596f79da6a03ed_cryptbot_icedid_luca-stealer_njrat_stealc
- Size 3.0MB
- SHA256 e455ebe514a88a13f96a2a86698f50436b459e1d5854f1b5673446a89e5a8d46
- MD5 88a957c2dd9d793805596f79da6a03ed
- SHA1 6b2c07602101591aec008022243e527f28a9686b
- SHA512 97dbf8c762cd4d044cb92dff8baad4a2ed1007740c800cd390478fc9b5723de62af5b094f9775940e1512b955c6a5c6ec6435b7a8f71148d82e20326978c2cb2
- SSDEEP 49152:rKA5/fBjo8VI3NvmF4xqfs9QXrePf7H/F6T9BTT3k0VY9FeNVdPL4j7:rKAVsYsY2zHd6fjDfNVNm
- TLSH T166E52204D7E404F9E1B7D578CE824D52EB767C0943B1EB9F43A4B9960E272E0893EB52
- MD5 SHA1 SHA512 SSDEEP TLSH
-
UPX dump on OEP (original entry point)
-
XMRig Miner payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Suspicious use of SetThreadContext