Extracted

Extracted

Extracted

Extracted

• • Target
    2026-08-18_fbe69d3b121c9e846f45082703f9d7b9_cryptbot_icedid_luca-stealer_njrat_stealc
  • Size 11.9MB
  • SHA256 69b0f433fe0d3d41244b73cd0ba68e20ec64a1eb63852e7d3348654bfeabb089
  • MD5 fbe69d3b121c9e846f45082703f9d7b9
  • SHA1 9680e2a679c0a2cd65e7abd1fdf2ddbe9f3c06e6
  • SHA512 27b0a43f9173882e5e7757b6bfeb2ee65704892281f9da07e2e086809dbf9054d903624f05865f48ba17263398e7de978dc1a2781d3e58fa9a907fec657b1175
  • SSDEEP 196608:0QonuB1oJSFwMxfLuWtdVteSN2YOpPvG+VDlZTleGEDPuwwi0Gfufur8mY4lJL:bhBmSF/xaohwfv1VDlZTluPuwtXufuw2
  • TLSH
    T195C6332CD3F611F4E8A3D634CC874913F77A788D87B1D5CF03B4A5965A276A08D2A722
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryacrstealerremus_stealerspywarestealerd2e7d60a27cddde5e8f140018830569chijackloadervidarloader

  • Detects ACRStealer V4.x

  • Detects HijackLoader (aka IDAT Loader)

  • Family: ACR stealer,GrMsk

    ACR stealer (aka GrMsk stealer) is an infostealer written in C++.

    stealeracrstealer

  • Family: HijackLoader, IDAT loader, Ghostulse,

    HijackLoader is a multi-stage loader, first seen in 2023.

    loaderhijackloader

  • Family: Remus

    Remus is a stealer written in C++.

    stealerremus_stealer

  • Family: Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2