General
- Target 2026-08-08_3e0431853d188b6a5b32ebb62c33ed97_agent-tesla_amadey_icedid_luca-stealer_njrat
- Size 67.9MB
- Sample260808-pla4aawhnf
- SHA256 90ed17b5ea0ac3156e27416a0846eab63ce81958c4370128247a6279af4c9d4c
- MD5 3e0431853d188b6a5b32ebb62c33ed97
- SHA1 7747084f50038c1cafedc8e9e5d049271c5fcace
- SHA512 617f7280fa8bcf180042d3578416defa9952675dfc4621f9492ad8d1e2ee35747f3062937aed47881148cdf750c47bdafe41bd0c148b0ab8f15c6f1015b111f6
- SSDEEP 1572864:HbP92bQvfUMgTFUty/DwE9/hmKbKVv+AcbtBlsBmQ4LmAiOLkDYCMHJ1:HbPiRXTFy2kEJNov+AKzBFBnHj
- TLSH T1E8F73306B7E452DEFEA7E0728313CD0BC3B2BA015236966F056696756F237B1172E312
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2026-08-08_3e0431853d188b6a5b32ebb62c33ed97_agent-tesla_amadey_icedid_luca-stealer_njrat.exe
Resource
win10v2004-20260513-en
16 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-08_3e0431853d188b6a5b32ebb62c33ed97_agent-tesla_amadey_icedid_luca-stealer_njrat.exe
Resource
win11ltsc2024-20260709-en
15 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-08_3e0431853d188b6a5b32ebb62c33ed97_agent-tesla_amadey_icedid_luca-stealer_njrat
- Size 67.9MB
- SHA256 90ed17b5ea0ac3156e27416a0846eab63ce81958c4370128247a6279af4c9d4c
- MD5 3e0431853d188b6a5b32ebb62c33ed97
- SHA1 7747084f50038c1cafedc8e9e5d049271c5fcace
- SHA512 617f7280fa8bcf180042d3578416defa9952675dfc4621f9492ad8d1e2ee35747f3062937aed47881148cdf750c47bdafe41bd0c148b0ab8f15c6f1015b111f6
- SSDEEP 1572864:HbP92bQvfUMgTFUty/DwE9/hmKbKVv+AcbtBlsBmQ4LmAiOLkDYCMHJ1:HbPiRXTFy2kEJNov+AKzBFBnHj
- TLSH T1E8F73306B7E452DEFEA7E0728313CD0BC3B2BA015236966F056696756F237B1172E312
- MD5 SHA1 SHA512 SSDEEP TLSH
Score8/10-
Drops file in Drivers directory
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
-
Drops file in System32 directory