Extracted

• • Target
    2026-10-23_372a3827eb2bb7f63324bdc0f14d9baf_icedid
  • Size 1.6MB
  • SHA256 704bb0e175805cdbcd8d0293f35fc6dc0ac8e4a936a854fe7e2ae122bd6a1868
  • MD5 372a3827eb2bb7f63324bdc0f14d9baf
  • SHA1 9a1f9b1ad8bd748cd77767e88326b750bb0e3a4c
  • SHA512 f7e87a0e1879dad66027d6735ca94529865d13dfc6c62a3ac25a4098d945d7a3c6dcd977f36c112a401f6b602faf46a28376f4bb2745cf75c2c9e706fea182b3
  • SSDEEP 24576:GDGW7Th9u9w7LcnQ/tbw/2Mkjy6Fr7g0on:AGIoIcQ/lFTjN4
  • TLSH
    T13175EF04A659B4D8D02644F788C2771DAA36BE4072C05ECA3ECE72756E367E0EDDBE50
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  d4faab834f3a2625be81ca35628d47badefense_evasiondiscoveryexecution2cloaderloaderpersistenceprivilege_escalationransomwarespywarestealer

  • Family: 2CLoader

    2CLoader is a Windows loader written in C++ that delivers stealers such as Vidar and Remus.

    loader2cloader

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Registers new Windows logon scripts automatically executed at logon.

    persistence

  • Adds Run key to start application

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory

  behavioral1behavioral2