General
- Target 2026-06-28_2dd0182930d515d3d1043c5b1c41168d_icedid_njrat_stealc
- Size 5.7MB
- Sample260628-3lencsht7l
- SHA256 c8dcf43d1f26b324b4a89f1feea30a216cd1267aac4cab763b8ffbda337a790c
- MD5 2dd0182930d515d3d1043c5b1c41168d
- SHA1 74a09ca968297c9d5417ade5b911927d67be3114
- SHA512 3c061ff30f58d018f28d4f6f1024b497cf237fcaa50fc2260a0416c2df1b16c867034a0aace1aa751d178ebb9848b7dc6063a8fa9bbaffdf3b00ad86726c16f9
- SSDEEP 98304:s+hBp75lKkBcxWGoqZ92yVG/uzGNV9HkAVHL/DKmFfCVQ42+SMWN:s+hBtOkSsByQyVG/uzGNVyAl3K8fCGnh
- TLSH T14056F12BB26901E8D1BFD17CC9065907EBB2780503A0A7CF12E046A62F77BE14E7E715
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-06-28_2dd0182930d515d3d1043c5b1c41168d_icedid_njrat_stealc.exe
Resource
win10v2004-20260513-en
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-06-28_2dd0182930d515d3d1043c5b1c41168d_icedid_njrat_stealc.exe
Resource
win11ltsc2024-20260618-en
10 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-06-28_2dd0182930d515d3d1043c5b1c41168d_icedid_njrat_stealc
- Size 5.7MB
- SHA256 c8dcf43d1f26b324b4a89f1feea30a216cd1267aac4cab763b8ffbda337a790c
- MD5 2dd0182930d515d3d1043c5b1c41168d
- SHA1 74a09ca968297c9d5417ade5b911927d67be3114
- SHA512 3c061ff30f58d018f28d4f6f1024b497cf237fcaa50fc2260a0416c2df1b16c867034a0aace1aa751d178ebb9848b7dc6063a8fa9bbaffdf3b00ad86726c16f9
- SSDEEP 98304:s+hBp75lKkBcxWGoqZ92yVG/uzGNV9HkAVHL/DKmFfCVQ42+SMWN:s+hBtOkSsByQyVG/uzGNVyAl3K8fCGnh
- TLSH T14056F12BB26901E8D1BFD17CC9065907EBB2780503A0A7CF12E046A62F77BE14E7E715
- MD5 SHA1 SHA512 SSDEEP TLSH
Score8/10-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Enumerates processes with tasklist