69c63c133c8c2fda53a876c3ae331bc66349dc4eeada631444d44eeb8ba62236

General

Target
2026-08-07_e335c1a88c956d11e3427850e87e7a93_cryptbot_icedid_luca-stealer_njrat_stealc
Size 38.5MB
Sample260807-pyachsfh73
SHA256 69c63c133c8c2fda53a876c3ae331bc66349dc4eeada631444d44eeb8ba62236
MD5 e335c1a88c956d11e3427850e87e7a93
SHA1 108845ac4ed46af3ca2b4af88470fb6aa885e52d
SHA512 e214bbece98a3ee025da0477aab5c1fa643e18482165ffbc2da357a0329ddfb5dcb2e21f3ccb7856b0d06b49d613e0076faff0f3b688ac19d6105ecc19512d5d
SSDEEP 786432:kgade757bbSSNmxLn7G/qP0x6OjhI0H4mcnMniSc1Qh+v+OLleDje2HsVg:kgaARbSj40Oj+G4Qni/ehU+OlSoVg
TLSH
T15D97330AFFE42A6ED0739AF80B7A9717D37238590631630B47798926EF574C49D38B81
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

Malware Config

Targets

- Target
  2026-08-07_e335c1a88c956d11e3427850e87e7a93_cryptbot_icedid_luca-stealer_njrat_stealc
- Size 38.5MB
- SHA256 69c63c133c8c2fda53a876c3ae331bc66349dc4eeada631444d44eeb8ba62236
- MD5 e335c1a88c956d11e3427850e87e7a93
- SHA1 108845ac4ed46af3ca2b4af88470fb6aa885e52d
- SHA512 e214bbece98a3ee025da0477aab5c1fa643e18482165ffbc2da357a0329ddfb5dcb2e21f3ccb7856b0d06b49d613e0076faff0f3b688ac19d6105ecc19512d5d
- SSDEEP 786432:kgade757bbSSNmxLn7G/qP0x6OjhI0H4mcnMniSc1Qh+v+OLleDje2HsVg:kgaARbSj40Oj+G4Qni/ehU+OlSoVg
- TLSH
  T15D97330AFFE42A6ED0739AF80B7A9717D37238590631630B47798926EF574C49D38B81
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

costura discovery packer themida
- Detects executables Discord URL observed in first stage droppers
- Detects executables containing URLs to raw contents of a Github gist
- Detects executables manipulated with Fody
- Detects executables packed with Themida
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Themida packer
  Detects Themida, an advanced Windows software protection system.
  themida
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Detects executables Discord URL observed in first stage droppers

Detects executables containing URLs to raw contents of a Github gist

Detects executables manipulated with Fody

Detects executables packed with Themida

Checks computer location settings

Executes dropped EXE

Themida packer

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2