General
- Target 2026-08-11_7cd261b25ca6ea00de7e83f111c0282f_cryptbot_icedid_luca-stealer_njrat_stealc
- Size 14.8MB
- Sample260812-a8z9cssxax
- SHA256 5e4a96fc099c16b0d31ee8e2759257d4ff47ed2a5419f95532489281d8efaa40
- MD5 7cd261b25ca6ea00de7e83f111c0282f
- SHA1 b2fd756290f32c68eea903c920c69726e6d82627
- SHA512 5da876de3b22b812375a4ef8a50df8715f589fd4ee1b7901c6ebbdba36a535f5616e0fff82deee22bdb8c86e2d7ceae7d8490c420dc7c25ccefcb039065add6e
- SSDEEP 393216:BG7JKgexy8RCm4I64EQ1A7RuvZ4xEISUN+kVZb/:BGwVx9RCPI64EQf4xEISKVZT
- TLSH T14FF63355E3A140BDF4A3E6B8CE825701E7767C182B60DBCF46E4ADA51F2B3908D27316
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-11_7cd261b25ca6ea00de7e83f111c0282f_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Resource
win10v2004-20260513-en
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-11_7cd261b25ca6ea00de7e83f111c0282f_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Resource
win11ltsc2024-20260709-en
9 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-11_7cd261b25ca6ea00de7e83f111c0282f_cryptbot_icedid_luca-stealer_njrat_stealc
- Size 14.8MB
- SHA256 5e4a96fc099c16b0d31ee8e2759257d4ff47ed2a5419f95532489281d8efaa40
- MD5 7cd261b25ca6ea00de7e83f111c0282f
- SHA1 b2fd756290f32c68eea903c920c69726e6d82627
- SHA512 5da876de3b22b812375a4ef8a50df8715f589fd4ee1b7901c6ebbdba36a535f5616e0fff82deee22bdb8c86e2d7ceae7d8490c420dc7c25ccefcb039065add6e
- SSDEEP 393216:BG7JKgexy8RCm4I64EQ1A7RuvZ4xEISUN+kVZb/:BGwVx9RCPI64EQf4xEISKVZT
- TLSH T14FF63355E3A140BDF4A3E6B8CE825701E7767C182B60DBCF46E4ADA51F2B3908D27316
- MD5 SHA1 SHA512 SSDEEP TLSH
Score7/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.