56b3987911c7e2484b95ca084f2b4be5e4c5d082a7c76c44558edae3073905de

General

Target
2026-08-15_2575446bfd0dbeb139d2812442e57e3d_cryptbot_icedid_luca-stealer_njrat_stealc
Size 115.5MB
Sample260815-b5248adj7x
SHA256 56b3987911c7e2484b95ca084f2b4be5e4c5d082a7c76c44558edae3073905de
MD5 2575446bfd0dbeb139d2812442e57e3d
SHA1 fbcb0223a8c504483c196faa1fbae110e8b03f7a
SHA512 9e03e48d624536c9aa93f8d56c8116858433c1bf8239548fc2763a6fa76f55316172e7fa3713932f39dc6f8467b7cc7975f034cf2a12e012a1cb4e4ffea3ff03
SSDEEP 1572864:6WZmKl+RruKI+DXpSfXL6QYLUTKoJtfKJheNRpdaLujSQ7WhDqwNaz489Io:6sbJ+DMXeUTH7ceXulQ7sYleo
TLSH
T178483307E2984536E1909179CB4EC837CB796CCA6DF5838B13D9BE4B3E36B8079221D5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-08-15_2575446bfd0dbeb139d2812442e57e3d_cryptbot_icedid_luca-stealer_njrat_stealc
- Size 115.5MB
- SHA256 56b3987911c7e2484b95ca084f2b4be5e4c5d082a7c76c44558edae3073905de
- MD5 2575446bfd0dbeb139d2812442e57e3d
- SHA1 fbcb0223a8c504483c196faa1fbae110e8b03f7a
- SHA512 9e03e48d624536c9aa93f8d56c8116858433c1bf8239548fc2763a6fa76f55316172e7fa3713932f39dc6f8467b7cc7975f034cf2a12e012a1cb4e4ffea3ff03
- SSDEEP 1572864:6WZmKl+RruKI+DXpSfXL6QYLUTKoJtfKJheNRpdaLujSQ7WhDqwNaz489Io:6sbJ+DMXeUTH7ceXulQ7sYleo
- TLSH
  T178483307E2984536E1909179CB4EC837CB796CCA6DF5838B13D9BE4B3E36B8079221D5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

credential_access defense_evasion discovery evasion execution impact installer persistence pyinstaller ransomware spyware trojan
- Contains code to disable Windows Defender
  A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
- Modifies WinLogon for persistence
  persistence
- Modifies Windows Defender DisableAntiSpyware settings
  evasion trojan
- Modifies Windows Defender Real-time Protection settings
  defense_evasion trojan
- Modifies security service
  defense_evasion
- UAC bypass
  defense_evasion trojan
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- Modifies boot configuration data using bcdedit
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Deletes system backups
  Uses wbadmin.exe to inhibit system recovery.
  ransomware
- Downloads MZ/PE file
- Drops file in Drivers directory
- Modify Registry: Disable Windows Driver Blocklist
  Disable Windows Driver Blocklist via Registry.
  defense_evasion
- Boot or Logon Autostart Execution: LSASS Driver
  Adversaries may modify or add LSASS drivers to obtain persistence on compromised systems.
  persistence credential_access
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Discovers running processes
  Running process information can be used to identify security tools or plan follow-on actions.
  discovery
- Drops file in System32 directory
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral1 behavioral2