Extracted

• • Target
    2026-08-24_9bd4400ba36fd8187eda05156f419429_elex_icedid_njrat
  • Size 4.0MB
  • SHA256 a81b71a37990fd70a83f921a16ca1f9f05d6edfe8ecb3d83c01a458243f4ba36
  • MD5 9bd4400ba36fd8187eda05156f419429
  • SHA1 3212234a74f5bd4bf7ab5dd9251f9da89e81da52
  • SHA512 406608645fd16bd5b4e2900533adb1d5941a79bb9370e8aedf800d88d89b92123c00eaa3d801a608f34912af823d222437364ae4869ca2487d7e6783f86ea259
  • SSDEEP 49152:RNDFFPJu8fBsVE6ij+RNg+UKpBvtqB3m1RC39k:XzP88fBsnZTgOtqB3m1RC39k
  • TLSH
    T14816AE12BBD18F2BC5564B388AE783647379DD904B43575BA38A712D3DB23E02B871D8
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryloaderbotneshtaxmrigloaderminerpersistenceprivilege_escalationspywarestealer

  • Family: LoaderBot

    LoaderBot is a loader written in .NET downloading and executing miners.

    loaderminerloaderbot

  • Family: Neshta

    Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

    persistencespywareneshta

  • Family: xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig
  • Custom signature

    Detects executables built or packed with MPress PE compressor

  • LoaderBot executable

  • XMRig Miner payload

    miner

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Cryptocurrency Miner

    Makes network request to known mining pool URL.

    miner

  • Executes dropped EXE

  • Modifies system executable filetype association

    persistence

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence
  behavioral1behavioral2