General
- Target 2026-08-13_cc9f247d8807a0b384f7e151fd86cabe_cryptbot_icedid_luca-stealer_njrat_stealc
- Size 35.9MB
- Sample260813-dyhs4sge74
- SHA256 10da50d80581121ab8d9d5eee723eb2636b01bbe3a662eb8ac2128172d79b26b
- MD5 cc9f247d8807a0b384f7e151fd86cabe
- SHA1 8c7de426f54ce772ef252d113ecf8ce1035d9840
- SHA512 70c7cf66ab002ec5f8f1e60900abf35cc35b45d1a874a1b4b78a3c8d7c72a65c3259b57f88f66d6e4ab4667e18f6f7f3e1024a308968f09d96fb450ee0c8a5f0
- SSDEEP 786432:ERJGXjObriY6FcLql+pZtcXRTIRlpghSDEz1Tj03HD7flTPS:EqzObrihFcLqwpncopZqe3lS
- TLSH T14F873348B6CD0EA9E0BBD7B8CDD64511DBB57C210B71A98B17F5CAE60E262E04F34712
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-13_cc9f247d8807a0b384f7e151fd86cabe_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Resource
win10v2004-20260513-en
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-13_cc9f247d8807a0b384f7e151fd86cabe_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Resource
win11ltsc2024-20260709-en
6 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-13_cc9f247d8807a0b384f7e151fd86cabe_cryptbot_icedid_luca-stealer_njrat_stealc
- Size 35.9MB
- SHA256 10da50d80581121ab8d9d5eee723eb2636b01bbe3a662eb8ac2128172d79b26b
- MD5 cc9f247d8807a0b384f7e151fd86cabe
- SHA1 8c7de426f54ce772ef252d113ecf8ce1035d9840
- SHA512 70c7cf66ab002ec5f8f1e60900abf35cc35b45d1a874a1b4b78a3c8d7c72a65c3259b57f88f66d6e4ab4667e18f6f7f3e1024a308968f09d96fb450ee0c8a5f0
- SSDEEP 786432:ERJGXjObriY6FcLql+pZtcXRTIRlpghSDEz1Tj03HD7flTPS:EqzObrihFcLqwpncopZqe3lS
- TLSH T14F873348B6CD0EA9E0BBD7B8CDD64511DBB57C210B71A98B17F5CAE60E262E04F34712
- MD5 SHA1 SHA512 SSDEEP TLSH
Score7/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.