General
- Target 2026-10-08_5797b1517a46711a5419883796aabfd0_cryptbot_icedid_luca-stealer_njrat_stealc
- Size 3.4MB
- Sample261009-rqq2eabd67
- SHA256 6dcadeb26ccb9f3ac847da173a45b64255d2b31073bfed1aaae708d487fd79b5
- MD5 5797b1517a46711a5419883796aabfd0
- SHA1 5fea4933b199aa41121470a1fa788682f7364ebb
- SHA512 cf467f77a3f3983c3e371cfdf52cdd7b3e20d5256e6c82c59da41311338847b10dc30bacb005663b5da60bf3f41b6c69f95f41deef7e81de85a3ceb7538a29c1
- SSDEEP 98304:lKAg1+oDDg/gvsnyHQFPDRVEawV/HtGNV5:lM+L/sRwVjd
- TLSH T1CDF5129EDABD81F7D1B386788E550816E67E3D0A57B0219F4398BC914E3BA42DE7D300
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-10-08_5797b1517a46711a5419883796aabfd0_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Resource
win10v2004-20260911-en
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-10-08_5797b1517a46711a5419883796aabfd0_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Resource
win11ltsc2024-20260911-en
11 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-10-08_5797b1517a46711a5419883796aabfd0_cryptbot_icedid_luca-stealer_njrat_stealc
- Size 3.4MB
- SHA256 6dcadeb26ccb9f3ac847da173a45b64255d2b31073bfed1aaae708d487fd79b5
- MD5 5797b1517a46711a5419883796aabfd0
- SHA1 5fea4933b199aa41121470a1fa788682f7364ebb
- SHA512 cf467f77a3f3983c3e371cfdf52cdd7b3e20d5256e6c82c59da41311338847b10dc30bacb005663b5da60bf3f41b6c69f95f41deef7e81de85a3ceb7538a29c1
- SSDEEP 98304:lKAg1+oDDg/gvsnyHQFPDRVEawV/HtGNV5:lM+L/sRwVjd
- TLSH T1CDF5129EDABD81F7D1B386788E550816E67E3D0A57B0219F4398BC914E3BA42DE7D300
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10-
UPX dump on OEP (original entry point)
-
Disables Task Manager via registry modification
-
ACProtect 1.3x - 1.4x DLL software
Detects file using ACProtect software.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL