Extracted

• • Target
    2026-10-23_3e1d717274f07928b9a5b4a49b1208fa_icedid
  • Size 1.3MB
  • SHA256 97c5414772d73ff86f3c6a03ad3b821b96c974d35f9274189441047aa30bd4f8
  • MD5 3e1d717274f07928b9a5b4a49b1208fa
  • SHA1 40d92de60f381e551ff810c20e899ddb8f81ff6f
  • SHA512 45cd9e6b12f80fe8a945d3ff47ca8a4ad06fa9b1e7b74ab279318758078b13ca47d4eefd43f904acfdebf5fe58c159dc8a504a2c05163d44b7f855f2b53b48d7
  • SSDEEP 24576:M9GU9nW9n44AMJmAXEhnQABFR2uQknQ/tbw/2Mkjy6Fr7g0oc:0GrNtA4mA0hQABF1QkQ/lFTjN4
  • TLSH
    T1F655F014A659B4D8D16605F388C2371DAA2ABE0172D05ECA3ECF72756E353E0EDE7E10
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  e4ebec06055ebb9a45191a3be18c8e74defense_evasiondiscoveryexecution2cloaderloaderpersistenceprivilege_escalationransomwarespywarestealer

  • Family: 2CLoader

    2CLoader is a Windows loader written in C++ that delivers stealers such as Vidar and Remus.

    loader2cloader

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Registers new Windows logon scripts automatically executed at logon.

    persistence

  • Adds Run key to start application

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory

  behavioral1behavioral2