Extracted

• • Target
    2026-10-23_7be0c0b80d00bd308130dd9de1e2ffeb_icedid
  • Size 1.6MB
  • SHA256 8890ae3c28d6d9a29150d61661bca21170025c92a03e6ba6ab94c297c8b30f48
  • MD5 7be0c0b80d00bd308130dd9de1e2ffeb
  • SHA1 b53dfefe3f80b6cce4ab7a548a6a8fb39223fe2d
  • SHA512 60114fa1d665aefaf902df860ff33159b592df54790e983f9cf7c4dc45c583c210e8e66447386ab0e9f559f9797dcad5f54154d6b5857aba61f2b2e0b392f4e0
  • SSDEEP 24576:HDGW7Th9u9w7LDXnQ/tbw/2Mkjy6Fr7g0oA:jGIoIDXQ/lFTjN4
  • TLSH
    T1D475EF04A659B4D8D02604F788C2771DAA36BE4472C05EDA3ECE72756E367E0EDDBE10
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  d4faab834f3a2625be81ca35628d47badefense_evasiondiscoveryexecution2cloaderloaderpersistenceprivilege_escalationransomwarespywarestealer

  • Family: 2CLoader

    2CLoader is a Windows loader written in C++ that delivers stealers such as Vidar and Remus.

    loader2cloader

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Registers new Windows logon scripts automatically executed at logon.

    persistence

  • Adds Run key to start application

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory

  behavioral1behavioral2