General
- Target 2026-06-28_9769f13c18e99db17ebeadb07d924bf1_icedid_njrat_stealc
- Size 6.1MB
- Sample260628-y85e3set2n
- SHA256 e465e582155db76d4f857e86c73cdabee04d661b9b49986815b87b7a8b8ee7d1
- MD5 9769f13c18e99db17ebeadb07d924bf1
- SHA1 201748bfb88edb7e8ea10a4455cb0400a8c573ee
- SHA512 7710bdf85ba67d5609e3217ea591af301082bf8ab7b85045b02d5e0d875dd5e5ad20490e9b2b89e22537bf5d969256e5f75bfd025c523f92937a26e1b0a1c8ed
- SSDEEP 196608:s+hBtOkSsByQyVG/uzGNVyAl3K8fCGnbP3J9:7tO4NSG/lVrl3KExL3J9
- TLSH T19856F12BB26901E8D1BFD17CC9165907EBB2780543A0A7CF12E046A62F77BE14E7E705
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-06-28_9769f13c18e99db17ebeadb07d924bf1_icedid_njrat_stealc.exe
Resource
win10v2004-20260513-en
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-06-28_9769f13c18e99db17ebeadb07d924bf1_icedid_njrat_stealc.exe
Resource
win11ltsc2024-20260617-en
10 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-06-28_9769f13c18e99db17ebeadb07d924bf1_icedid_njrat_stealc
- Size 6.1MB
- SHA256 e465e582155db76d4f857e86c73cdabee04d661b9b49986815b87b7a8b8ee7d1
- MD5 9769f13c18e99db17ebeadb07d924bf1
- SHA1 201748bfb88edb7e8ea10a4455cb0400a8c573ee
- SHA512 7710bdf85ba67d5609e3217ea591af301082bf8ab7b85045b02d5e0d875dd5e5ad20490e9b2b89e22537bf5d969256e5f75bfd025c523f92937a26e1b0a1c8ed
- SSDEEP 196608:s+hBtOkSsByQyVG/uzGNVyAl3K8fCGnbP3J9:7tO4NSG/lVrl3KExL3J9
- TLSH T19856F12BB26901E8D1BFD17CC9165907EBB2780543A0A7CF12E046A62F77BE14E7E705
- MD5 SHA1 SHA512 SSDEEP TLSH
Score8/10-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Enumerates processes with tasklist