General
- Target 2026-06-30_6639e93857be51e3e2a7df7312fcb512_icedid_njrat_stealc
- Size 4.2MB
- Sample260701-e8ls7aet9r
- SHA256 c6eb6dd4c7125281c5b56ea3c6505cfece37b91ab04d242068cd1ad468bfe241
- MD5 6639e93857be51e3e2a7df7312fcb512
- SHA1 64edb55c8146362c829a2f1ba3da3348130e6678
- SHA512 498d3baf4d6ad1ee1caa602b786335b8df4acef3db3551a9091adce270ec01e85af6202caf5b2b0bd9d32f6a727e661a57fba1c9225b3af6d256c6026cbdfccd
- SSDEEP 98304:i+hBp751Kkxc3WGoqZ92yVG/uzGNV9HkAVHL/s:i+hBt+kCmByQyVG/uzGNVyAlQ
- TLSH T10C26E02BB26901E8D1BFD17CC9065907EBB2780543A0A7DF12E046A62F77BE14E7E315
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-06-30_6639e93857be51e3e2a7df7312fcb512_icedid_njrat_stealc.exe
Resource
win10v2004-20260513-en
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-06-30_6639e93857be51e3e2a7df7312fcb512_icedid_njrat_stealc.exe
Resource
win11ltsc2024-20260629-en
10 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-06-30_6639e93857be51e3e2a7df7312fcb512_icedid_njrat_stealc
- Size 4.2MB
- SHA256 c6eb6dd4c7125281c5b56ea3c6505cfece37b91ab04d242068cd1ad468bfe241
- MD5 6639e93857be51e3e2a7df7312fcb512
- SHA1 64edb55c8146362c829a2f1ba3da3348130e6678
- SHA512 498d3baf4d6ad1ee1caa602b786335b8df4acef3db3551a9091adce270ec01e85af6202caf5b2b0bd9d32f6a727e661a57fba1c9225b3af6d256c6026cbdfccd
- SSDEEP 98304:i+hBp751Kkxc3WGoqZ92yVG/uzGNV9HkAVHL/s:i+hBt+kCmByQyVG/uzGNVyAlQ
- TLSH T10C26E02BB26901E8D1BFD17CC9065907EBB2780543A0A7DF12E046A62F77BE14E7E315
- MD5 SHA1 SHA512 SSDEEP TLSH
Score8/10-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Enumerates processes with tasklist