Extracted

• • Target
    2026-10-22_3ffab6f8faa408e79c21b9b269b7079c_icedid
  • Size 1.6MB
  • SHA256 55c6e423759740b1bcd5b09c843a6d97fbc241ec7fc74e88886c3148c6e95274
  • MD5 3ffab6f8faa408e79c21b9b269b7079c
  • SHA1 67f0b7ea61db0ff6ce39e65e928587b4a83853b1
  • SHA512 16114ba8b8a3b927af1490d5076693087d391b2a10f330c9a4756d26c405ff9cb75ef86cda27e2fd8c0b3f50cac8ce75cf2e3d50fefb79cdeff8ee90cba0aa0d
  • SSDEEP 24576:JDGW7Th9u9w7LbnQ/tbw/2Mkjy6Fr7g0op:NGIoIbQ/lFTjN4
  • TLSH
    T11575EF04A659B4D8D02644F788C2771DAA36BE4072C05ECA3ECE72756E367E0EDDBE50
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  d4faab834f3a2625be81ca35628d47badefense_evasiondiscoveryexecution2cloaderloaderpersistenceprivilege_escalationransomwarespywarestealer

  • Family: 2CLoader

    2CLoader is a Windows loader written in C++ that delivers stealers such as Vidar and Remus.

    loader2cloader

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Registers new Windows logon scripts automatically executed at logon.

    persistence

  • Adds Run key to start application

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory

  behavioral1behavioral2