602ef6b3e02fd1f7c4694e09a942e8a9d48ec1b73051b9e07947660b1f2a8851

Analysis

max time kernel
150s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/11/2026, 19:40

Target
2026-11-09_52896fe3c9108168966ab9cd99fb5453_icedid_luca-stealer_njrat_stealc.exe
Size 2.1MB
Sample261110-ydm8baae33
SHA256 602ef6b3e02fd1f7c4694e09a942e8a9d48ec1b73051b9e07947660b1f2a8851
MD5 52896fe3c9108168966ab9cd99fb5453
SHA1 ec052640117e6ee50455d8ea5382f84ed3b23ad6
SHA512 8a59d7373f35de596472af1a5f79b39d4974f9add13bb0816a98d74c163ce00e65df47fb59313ff011cb921600a56057d6124a3d3f9a126bf53bae0325d7a039
SSDEEP 49152:kXq5RQnZEMnIQJwJ+YP/QAPYTysIWEOifkT:2zEMI0wJAui
TLSH
T155A5C169A25426B8D06BC534D5336E0AF2F2341A0F7487EF73E995C02F775D09A3AB12
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
3928	mhyprot.sys

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
808	Process not Found

C:\Users\Admin\AppData\Local\Temp\2026-11-09_52896fe3c9108168966ab9cd99fb5453_icedid_luca-stealer_njrat_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-09_52896fe3c9108168966ab9cd99fb5453_icedid_luca-stealer_njrat_stealc.exe"
1⤵
PID:1544

C:\ProgramData\cfext\mhyprot.sys
C:\ProgramData\cfext\mhyprot.sys
1⤵
- Executes dropped EXE
PID:3928

mhyprot.sys

Path C:\ProgramData\cfext\mhyprot.sys
Size 1.2MB
SHA256 509628b6d16d2428031311d7bd2add8d5f5160e9ecc0cd909f1e82bbbb3234d6
MD5 4b817d0e7714b9d43db43ae4a22a161e
SHA1 0466e90bf0e83b776ca8716e01d35a8a2e5f96d3
SHA512 ac28c73991b69b3a554c6a7af8da1cb751dc6253557c1c6b1b42653997e05dbf6ea345d4085ce92ab9e711348324029a84177565f0a73e021d27777ce35acfbf
SSDEEP 24576:XK4EjF0nVJuF3Fo9J/0HJ+SdPcRwQAP777nMyIysIWEOHyLuXk/fk0mxD:6MnIQJwJ+YP/QAPYTysIWEOifkTJ
TLSH
T13A45AFBD62442618C41A88345133BE48B1F7211A4FB946FBB1EBFAC0776FC95DA25F06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download