5762bd699f7c5ca861355179b765ec21f1bf3f7544fc8e6c764521d0a5ddb405

General

Target
2026-06-29_5c775c6eb5bb2cbadca0e0a0a31b716f_icedid_luca-stealer_njrat_stealc
Size 1.0MB
Sample260630-k5kdvaby5n
SHA256 5762bd699f7c5ca861355179b765ec21f1bf3f7544fc8e6c764521d0a5ddb405
MD5 5c775c6eb5bb2cbadca0e0a0a31b716f
SHA1 7338724da07586ec769c2ada19a0e738f54c5c09
SHA512 60eae05cee5a3eca07477fdfd2b3a40f2f632e5a2760f6fd63299a47dc8184c727cfa8b7e1dc5d56aa374adcae1b4f3871a39e7b39382042a74676a1233d8b67
SSDEEP 24576:Z5znhezm7Hlp6pafsHxFa3oQZT9vm5whHfFWqBSihB1AX75Xi5yWpjdp1crTtkts:nQzm7Hlp6pa0RFa3oQZT9vm5wVFWqBSx
TLSH
T14035AE18F6A010ECE5BEE1788D08817BD6B334BC076697DB2A19C6652B135D03DBFB58
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion discovery

Malware Config

Targets

- Target
  2026-06-29_5c775c6eb5bb2cbadca0e0a0a31b716f_icedid_luca-stealer_njrat_stealc
- Size 1.0MB
- SHA256 5762bd699f7c5ca861355179b765ec21f1bf3f7544fc8e6c764521d0a5ddb405
- MD5 5c775c6eb5bb2cbadca0e0a0a31b716f
- SHA1 7338724da07586ec769c2ada19a0e738f54c5c09
- SHA512 60eae05cee5a3eca07477fdfd2b3a40f2f632e5a2760f6fd63299a47dc8184c727cfa8b7e1dc5d56aa374adcae1b4f3871a39e7b39382042a74676a1233d8b67
- SSDEEP 24576:Z5znhezm7Hlp6pafsHxFa3oQZT9vm5whHfFWqBSihB1AX75Xi5yWpjdp1crTtkts:nQzm7Hlp6pa0RFa3oQZT9vm5wVFWqBSx
- TLSH
  T14035AE18F6A010ECE5BEE1788D08817BD6B334BC076697DB2A19C6652B135D03DBFB58
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

defense_evasion discovery
- Detect binaries embedding considerable number of MFA browser extension IDs.
- Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.
- Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers
- Detects executables containing bas64 encoded gzip files
- Detects executables referencing combination of virtualization drivers
- Enumerates VirtualBox registry keys
  defense_evasion
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  defense_evasion
- Looks for VirtualBox Guest Additions in registry
  defense_evasion
- Looks for VMWare Tools registry key
  defense_evasion
- Looks for VMWare services registry key.
  defense_evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

5

T1497

Credential Access

Discovery

Query Registry

7

T1012

System Information Discovery

2

T1082

Virtualization/Sandbox Evasion

5

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Detect binaries embedding considerable number of MFA browser extension IDs.

Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers

Detects executables containing bas64 encoded gzip files

Detects executables referencing combination of virtualization drivers

Enumerates VirtualBox registry keys

Identifies VirtualBox via ACPI registry values (likely anti-VM)

Looks for VirtualBox Guest Additions in registry

Looks for VMWare Tools registry key

Looks for VMWare services registry key.

Checks BIOS information in registry

Checks installed software on the system

Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2