eedb39df4e5c24881f31c507dcc9146f4c53d20f7dd67397c3bc02845950c886

General

Target
2026-08-14_951070690277029079eae530f088f5cd_cryptbot_icedid_luca-stealer_njrat_stealc
Size 115.5MB
Sample260815-csbbeadm9t
SHA256 eedb39df4e5c24881f31c507dcc9146f4c53d20f7dd67397c3bc02845950c886
MD5 951070690277029079eae530f088f5cd
SHA1 00d75149efb47ecb9187c6652f9b532091cf2ebc
SHA512 753b7c56975aec7e9272fbdf3635e26fc5133c18638e4d3e658eb5661c4aaeb09bbb2749abf942f655f0af4bad11f852e1c77850eb334703f70234d9a582141e
SSDEEP 3145728:T+wJ6Rg88Az3BRzGMdGpfHeo2PMhVUNX0wEIg1:TAg88G/wp5VU0L1
TLSH
T109483314BA640160F2966838E74DD67BD7B87CD90E706B8F1BF27C833E75194B9282C6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-08-14_951070690277029079eae530f088f5cd_cryptbot_icedid_luca-stealer_njrat_stealc
- Size 115.5MB
- SHA256 eedb39df4e5c24881f31c507dcc9146f4c53d20f7dd67397c3bc02845950c886
- MD5 951070690277029079eae530f088f5cd
- SHA1 00d75149efb47ecb9187c6652f9b532091cf2ebc
- SHA512 753b7c56975aec7e9272fbdf3635e26fc5133c18638e4d3e658eb5661c4aaeb09bbb2749abf942f655f0af4bad11f852e1c77850eb334703f70234d9a582141e
- SSDEEP 3145728:T+wJ6Rg88Az3BRzGMdGpfHeo2PMhVUNX0wEIg1:TAg88G/wp5VU0L1
- TLSH
  T109483314BA640160F2966838E74DD67BD7B87CD90E706B8F1BF27C833E75194B9282C6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

credential_access defense_evasion discovery evasion execution impact installer persistence pyinstaller ransomware spyware trojan
- Contains code to disable Windows Defender
  A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
- Modifies WinLogon for persistence
  persistence
- Modifies Windows Defender DisableAntiSpyware settings
  evasion trojan
- Modifies Windows Defender Real-time Protection settings
  defense_evasion trojan
- Modifies security service
  defense_evasion
- UAC bypass
  defense_evasion trojan
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- Modifies boot configuration data using bcdedit
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Deletes system backups
  Uses wbadmin.exe to inhibit system recovery.
  ransomware
- Downloads MZ/PE file
- Drops file in Drivers directory
- Modify Registry: Disable Windows Driver Blocklist
  Disable Windows Driver Blocklist via Registry.
  defense_evasion
- Boot or Logon Autostart Execution: LSASS Driver
  Adversaries may modify or add LSASS drivers to obtain persistence on compromised systems.
  persistence credential_access
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Discovers running processes
  Running process information can be used to identify security tools or plan follow-on actions.
  discovery
- Drops file in System32 directory
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral1 behavioral2