General
- Target 2026-08-14_f60cff2ad92d5c6ae83be73aa9903359_cryptbot_icedid_luca-stealer_njrat_stealc
- Size 4.4MB
- Sample260814-n9ldgssend
- SHA256 6669f08853ecacf595a9f7b8658f7b98edcfb07d9d0fada6f14d14093b52d498
- MD5 f60cff2ad92d5c6ae83be73aa9903359
- SHA1 f290d91d05010a411372244625daf64be1a3d1ab
- SHA512 1f81e0e06ae7510c0caa260ca7daf431011d3fae5d74960c4342f706bb3021952c1c9bb8f2d53619f1a6e19c05642dac9ca00ecae681e8d3ef2282e4eb03bc38
- SSDEEP 98304:s2KlErJX+glpQPyiIIAeeDXGcWDXm61D37K1X2nqN:qaogTX5eYXGcW2eD7u2nqN
- TLSH T183262209D7E445FCE1B3A6B48E92C901EB7B38495770E28F03A859A51F277905E3DB23
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-14_f60cff2ad92d5c6ae83be73aa9903359_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Resource
win10v2004-20260513-en
9 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-14_f60cff2ad92d5c6ae83be73aa9903359_cryptbot_icedid_luca-stealer_njrat_stealc
- Size 4.4MB
- SHA256 6669f08853ecacf595a9f7b8658f7b98edcfb07d9d0fada6f14d14093b52d498
- MD5 f60cff2ad92d5c6ae83be73aa9903359
- SHA1 f290d91d05010a411372244625daf64be1a3d1ab
- SHA512 1f81e0e06ae7510c0caa260ca7daf431011d3fae5d74960c4342f706bb3021952c1c9bb8f2d53619f1a6e19c05642dac9ca00ecae681e8d3ef2282e4eb03bc38
- SSDEEP 98304:s2KlErJX+glpQPyiIIAeeDXGcWDXm61D37K1X2nqN:qaogTX5eYXGcW2eD7u2nqN
- TLSH T183262209D7E445FCE1B3A6B48E92C901EB7B38495770E28F03A859A51F277905E3DB23
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detects executables manipulated with Fody
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.