Extracted

• • Target
    2026-10-23_d65fa6904df2a7d9c9da3c345c92c62c_icedid
  • Size 1.5MB
  • SHA256 41e0063265db010f688217594b78a5d8f88eac6844f0683299ebbe7bccd6d99a
  • MD5 d65fa6904df2a7d9c9da3c345c92c62c
  • SHA1 e9cf7c87997bcb500409cdc62e14115b941734b2
  • SHA512 7507a3f2b8246b6089df5171bc2b91b806a070378a2b7c9e7bea2c73c77afb58e8a430169ec735fe6640da4250b426ecad259df7f9563b6d1c4c160f8cb439e2
  • SSDEEP 24576:+/SKXX00UVuDhhnQ/tbw/2Mkjy6Fr7g0oM:cSuUsHQ/lFTjN4
  • TLSH
    T144751288B6A2A0ECE17745B888720E12F7373D8147509BAF3344473AAF732A47D5DB25
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  969f89283db6ef0ba4d7d777bcfd7c3adefense_evasiondiscoveryexecution2cloaderloaderpersistenceprivilege_escalationransomwarespywarestealer

  • Family: 2CLoader

    2CLoader is a Windows loader written in C++ that delivers stealers such as Vidar and Remus.

    loader2cloader

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Registers new Windows logon scripts automatically executed at logon.

    persistence

  • Adds Run key to start application

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory

  behavioral1behavioral2