Extracted

• • Target
    2026-10-08_055012eb62274fd68b42425a622339ee_cryptbot_icedid_luca-stealer_njrat_stealc
  • Size 2.1MB
  • SHA256 324afa86af33503726ec8fad39a7bb7b36890c26097dba54171fa4260d296426
  • MD5 055012eb62274fd68b42425a622339ee
  • SHA1 ac29e2e91167a59c2325eab7d7c4b20716a343e8
  • SHA512 34bd39fc5ba4d4cb386699a066c13f905e6935acd677bdd5bff54992de6261bca2d5af5ae2c23bd6dff828090f851a57774ba15209f1ec3d532b0848bb2625cf
  • SSDEEP 49152:mKA5/fBrjvOsyZ8vMG5OyN3z9OX3h35xs07nxVCrbz8Y/Fh5bw1rSmADEWtRq2wd:mKANUE5ywYf1SBqsRkuw3
  • TLSH
    T1BDA5F12CD7E404AED076E1B4DDB25A2DE2373C191B72DA4F13ADB99A2F336408935712
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutionvjw0rmpersistenceprivilege_escalationransomwarespywarestealertrojanupxworm

  • Family: Vjw0rm

    Vjw0rm is a remote access trojan written in JavaScript.

    trojanwormvjw0rm

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2behavioral3behavioral4