General
- Target 2026-08-14_1badf88389a42319a53c0a5f462c0d74_cryptbot_icedid_luca-stealer_njrat_stealc
- Size 81.5MB
- Sample260814-15ercstvht
- SHA256 293b92c2b7a01cdd467a1bfea51db4e44b5e28597f2571f4ada6d2c607ee2d10
- MD5 1badf88389a42319a53c0a5f462c0d74
- SHA1 efef9fa0ea5a46f00611134706a37bd412d9da20
- SHA512 3b26f93ae5698c875bc39cad275e251a5b81ae70903c5b6bd20efa83c6ed490e308fd49744ba7fd0b2682e2478565701faaf031f2acdc37fb09c72f5c5725200
- SSDEEP 1572864:JdGlVq97KDilCglLsUQQuswSddwtFOgKPhj3ZrR+wre7DtvvEnB6OVI:2lCe+CGsUIsZTwtF/KPhjprYwaPt3Eno
- TLSH T10718330F93A544BDE07715B88DA54C9EE2F4784C9350DFCA8385EA6A9F473B40E6CB42
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-14_1badf88389a42319a53c0a5f462c0d74_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Resource
win10v2004-20260513-en
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-14_1badf88389a42319a53c0a5f462c0d74_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Resource
win11ltsc2024-20260709-en
6 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-14_1badf88389a42319a53c0a5f462c0d74_cryptbot_icedid_luca-stealer_njrat_stealc
- Size 81.5MB
- SHA256 293b92c2b7a01cdd467a1bfea51db4e44b5e28597f2571f4ada6d2c607ee2d10
- MD5 1badf88389a42319a53c0a5f462c0d74
- SHA1 efef9fa0ea5a46f00611134706a37bd412d9da20
- SHA512 3b26f93ae5698c875bc39cad275e251a5b81ae70903c5b6bd20efa83c6ed490e308fd49744ba7fd0b2682e2478565701faaf031f2acdc37fb09c72f5c5725200
- SSDEEP 1572864:JdGlVq97KDilCglLsUQQuswSddwtFOgKPhj3ZrR+wre7DtvvEnB6OVI:2lCe+CGsUIsZTwtF/KPhjprYwaPt3Eno
- TLSH T10718330F93A544BDE07715B88DA54C9EE2F4784C9350DFCA8385EA6A9F473B40E6CB42
- MD5 SHA1 SHA512 SSDEEP TLSH
Score7/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.