Extracted

• • Target
    2026-10-22_61eecc2ca5275594a8b4fe37e6063d06_icedid
  • Size 1.6MB
  • SHA256 9481f3c009886b49f9b72c387b8c3398c03aa4810c06f118fa2893a6843b54d2
  • MD5 61eecc2ca5275594a8b4fe37e6063d06
  • SHA1 e4cc3f2ce7a943213699182ef73973c29445c150
  • SHA512 a73760b05ffb1239a4b73f5452101414d043a2cd345ce5bfaa1c1b1971bccabd487a0094d295a06d659c34a400a03fc9bc440ae596e5b3f4169b534d7d6dffe0
  • SSDEEP 24576:7DMgR15Ok5hFsbxnQ/tbw/2Mkjy6Fr7g0oD:HMLaFsVQ/lFTjN4
  • TLSH
    T13F85F11E77DA22D9C96659F088970293AF2B3FD587D18B0B9B3171359D321B0AC7EB10
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  30f6560bb845c60836062406f2f41bb0defense_evasiondiscoveryexecution2cloaderloaderpersistenceprivilege_escalationransomwarespywarestealer

  • Family: 2CLoader

    2CLoader is a Windows loader written in C++ that delivers stealers such as Vidar and Remus.

    loader2cloader

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Registers new Windows logon scripts automatically executed at logon.

    persistence

  • Adds Run key to start application

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory

  behavioral1behavioral2