maxlocker | b1c389440c63e141f9689e3c17090d42bc828cb117562427f0c74c6d813cb532 | Triage™

Login
Reports

Overview

overview

Static

static

2026-09-19...at.exe

windows10-2004-x64

9

2026-09-19...at.exe

windows11-ltsc_2024-x64

9

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-19_feaf761ecd19109e346c059dd0fc3526_icedid_luca-stealer_njrat
Size 1.8MB
Sample260919-csentsgm7v
SHA256 b1c389440c63e141f9689e3c17090d42bc828cb117562427f0c74c6d813cb532
MD5 feaf761ecd19109e346c059dd0fc3526
SHA1 213b1d4c1ad929907cd0cd7b3030feac6472d09d
SHA512 27fb4f5fc614f058460a6e038250e3741bea256da825871c8475d3945ac096bb748bfb84873d6d3a59ebf865804622714da1f72965b921384819cc19aba71952
SSDEEP 49152:HpuDiEB1vRYd/mfOQ/EZ+esaWtoMAH5SDnJKobC:HEhBVCEfOQ/EZAaWBAHsDnJKobC
TLSH
T1A685124277A756EAE6378D388AA2C317EF32FC560B75D7DB63900AE61D136D01D24B02
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

maxlocker defense_evasion persistence stealer

Static task

static1

4 signatures

stealer maxlocker

Behavioral task

behavioral1

Sample

2026-09-19_feaf761ecd19109e346c059dd0fc3526_icedid_luca-stealer_njrat.exe

Resource

win10v2004-20260911-en

windows10-2004-x64

8 signatures

150 seconds

defense_evasion persistence

Behavioral task

behavioral2

Sample

2026-09-19_feaf761ecd19109e346c059dd0fc3526_icedid_luca-stealer_njrat.exe

Resource

win11ltsc2024-20260911-en

windows11-ltsc_2024-x64

8 signatures

150 seconds

defense_evasion persistence

Malware Config

Targets

- Target
  2026-09-19_feaf761ecd19109e346c059dd0fc3526_icedid_luca-stealer_njrat
- Size 1.8MB
- SHA256 b1c389440c63e141f9689e3c17090d42bc828cb117562427f0c74c6d813cb532
- MD5 feaf761ecd19109e346c059dd0fc3526
- SHA1 213b1d4c1ad929907cd0cd7b3030feac6472d09d
- SHA512 27fb4f5fc614f058460a6e038250e3741bea256da825871c8475d3945ac096bb748bfb84873d6d3a59ebf865804622714da1f72965b921384819cc19aba71952
- SSDEEP 49152:HpuDiEB1vRYd/mfOQ/EZ+esaWtoMAH5SDnJKobC:HEhBVCEfOQ/EZAaWBAHsDnJKobC
- TLSH
  T1A685124277A756EAE6378D388AA2C317EF32FC560B75D7DB63900AE61D136D01D24B02
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

defense_evasion persistence
- Looks for VirtualBox Guest Additions in registry
  defense_evasion
- Disables RegEdit via registry modification
  defense_evasion
- Disables Task Manager via registry modification
  defense_evasion
- Looks for VMWare Tools registry key
  defense_evasion
- Adds Run key to start application
  persistence
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Virtualization/Sandbox Evasion

Credential Access

Discovery

Query Registry

Virtualization/Sandbox Evasion

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

stealermaxlocker

behavioral1

defense_evasionpersistence

behavioral2

defense_evasionpersistence

© 2018-2026

Terms | Privacy