bad5bc928811d90ca03e7b046339c5990ac4acd53df6812f350c96c508f37986

General

Target
2026-10-19_850dc47d7da4832c6718ef30f67047a9_cryptbot_icedid_luca-stealer_njrat_stealc
Size 7.9MB
Sample261020-rxexqa1vcy
SHA256 bad5bc928811d90ca03e7b046339c5990ac4acd53df6812f350c96c508f37986
MD5 850dc47d7da4832c6718ef30f67047a9
SHA1 ef86633732a0d175053cc76a6b66d1dc0e92d815
SHA512 06bf3366091eff57f4505c3d92438db61e7201f6a2f8e76eca30b62631335f41c74f347e0ae554fa37bc87eda29fbaefa7432defd105764628d70048fb146d6f
SSDEEP 196608:pp/lz/DshQrTRPakZOAoM2S0LwA9WpXwgwvyj:HBsqRSkZOHM9R0wXEyj
TLSH
T1AA863349D7A441F8F073A578CA924A06EB73BC0A4735E58F07EC99A70F336A09D15B93
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  2026-10-19_850dc47d7da4832c6718ef30f67047a9_cryptbot_icedid_luca-stealer_njrat_stealc
- Size 7.9MB
- SHA256 bad5bc928811d90ca03e7b046339c5990ac4acd53df6812f350c96c508f37986
- MD5 850dc47d7da4832c6718ef30f67047a9
- SHA1 ef86633732a0d175053cc76a6b66d1dc0e92d815
- SHA512 06bf3366091eff57f4505c3d92438db61e7201f6a2f8e76eca30b62631335f41c74f347e0ae554fa37bc87eda29fbaefa7432defd105764628d70048fb146d6f
- SSDEEP 196608:pp/lz/DshQrTRPakZOAoM2S0LwA9WpXwgwvyj:HBsqRSkZOHM9R0wXEyj
- TLSH
  T1AA863349D7A441F8F073A578CA924A06EB73BC0A4735E58F07EC99A70F336A09D15B93
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

defense_evasion discovery execution installer persistence privilege_escalation ransomware spyware stealer
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Creates a file in the Startup directory
  A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
  persistence privilege_escalation
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- AutoIT Executable
  AutoIT scripts compiled to PE executables.
- Drops file in System32 directory
behavioral1 behavioral2