General
- Target 2026-06-30_6968c22d11844b24905cd4d4a0d062c2_icedid_njrat_stealc
- Size 4.0MB
- Sample260701-e6mygagt5t
- SHA256 8ad624dedbccdec8664d8bdb594e73488b9eb6c9dc9fa0793d13a4d0c2649bed
- MD5 6968c22d11844b24905cd4d4a0d062c2
- SHA1 c9a3615770b07b09169a4ce87811d716a75edb9d
- SHA512 3df62db385f28c88f4de68a6e297f8f76f6733af91e45f79ab5b8c3494385507b0f89772880464123bdadfd3f37e242d32a4d11134e56d0a1044e09afe7e2cca
- SSDEEP 98304:i+hBp75lKkBctWGoqZ92yVG/uzGNV9Hkl:i+hBtOkSgByQyVG/uzGNVyl
- TLSH T18B16D02BB26901E8D1BFD17CC9165907EBB2780543A0A7CF12E046A62F77BE14E7E315
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-06-30_6968c22d11844b24905cd4d4a0d062c2_icedid_njrat_stealc.exe
Resource
win10v2004-20260513-en
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-06-30_6968c22d11844b24905cd4d4a0d062c2_icedid_njrat_stealc.exe
Resource
win11ltsc2024-20260630-en
10 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-06-30_6968c22d11844b24905cd4d4a0d062c2_icedid_njrat_stealc
- Size 4.0MB
- SHA256 8ad624dedbccdec8664d8bdb594e73488b9eb6c9dc9fa0793d13a4d0c2649bed
- MD5 6968c22d11844b24905cd4d4a0d062c2
- SHA1 c9a3615770b07b09169a4ce87811d716a75edb9d
- SHA512 3df62db385f28c88f4de68a6e297f8f76f6733af91e45f79ab5b8c3494385507b0f89772880464123bdadfd3f37e242d32a4d11134e56d0a1044e09afe7e2cca
- SSDEEP 98304:i+hBp75lKkBctWGoqZ92yVG/uzGNV9Hkl:i+hBtOkSgByQyVG/uzGNVyl
- TLSH T18B16D02BB26901E8D1BFD17CC9165907EBB2780543A0A7CF12E046A62F77BE14E7E315
- MD5 SHA1 SHA512 SSDEEP TLSH
Score8/10-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Enumerates processes with tasklist