General
- Target 2026-08-02_8169c2c0bf7d952a9c0398ede2eb85f1_cryptbot_icedid_luca-stealer_njrat_stealc
- Size 3.0MB
- Sample260802-gps49swbqd
- SHA256 286097d8c69dbe35eaf9f0a61f00265689f6580e91287143c28157b137b2fd3e
- MD5 8169c2c0bf7d952a9c0398ede2eb85f1
- SHA1 43bc17fc27b0dbca1c45a66857919ccb11af29ad
- SHA512 ac58d23ed43e6f1102663fcc9560e88475884ac17b416c90992fb7166ecf50d4d897838e4783fc2262b0b71961756d5f5d954fd2fd9d755c4b9a90b77259e255
- SSDEEP 49152:rKA5/fBjo8VI3NvmF4xqfs9QXrePf7H/F6T9BTT3k0VY9FeNVdPL4jC:rKAVsYsY2zHd6fjDfNVNT
- TLSH T16BE52204D7E404F9E1B7D578CE824D52EB767C0943B1EB9F43A4B9960E272E0893EB52
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-02_8169c2c0bf7d952a9c0398ede2eb85f1_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Resource
win10v2004-20260513-en
13 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-02_8169c2c0bf7d952a9c0398ede2eb85f1_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Resource
win11ltsc2024-20260709-en
8 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-02_8169c2c0bf7d952a9c0398ede2eb85f1_cryptbot_icedid_luca-stealer_njrat_stealc
- Size 3.0MB
- SHA256 286097d8c69dbe35eaf9f0a61f00265689f6580e91287143c28157b137b2fd3e
- MD5 8169c2c0bf7d952a9c0398ede2eb85f1
- SHA1 43bc17fc27b0dbca1c45a66857919ccb11af29ad
- SHA512 ac58d23ed43e6f1102663fcc9560e88475884ac17b416c90992fb7166ecf50d4d897838e4783fc2262b0b71961756d5f5d954fd2fd9d755c4b9a90b77259e255
- SSDEEP 49152:rKA5/fBjo8VI3NvmF4xqfs9QXrePf7H/F6T9BTT3k0VY9FeNVdPL4jC:rKAVsYsY2zHd6fjDfNVNT
- TLSH T16BE52204D7E404F9E1B7D578CE824D52EB767C0943B1EB9F43A4B9960E272E0893EB52
- MD5 SHA1 SHA512 SSDEEP TLSH
-
UPX dump on OEP (original entry point)
-
XMRig Miner payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Suspicious use of SetThreadContext