General
- Target 2026-07-01_55c1a88f6a43e18c8b9be70f6934710b_icedid_njrat_stealc
- Size 3.8MB
- Sample260701-stdqxsaz6s
- SHA256 718b58db5547c67c648b588f84def39519b5f5ac325b8563da31e5cd3b9a05df
- MD5 55c1a88f6a43e18c8b9be70f6934710b
- SHA1 2bade35c163c5ecdf682fb2eb29c478ae5c7a1c5
- SHA512 ccea7ec094d423d3d7b3c16109ef96c106986a2dba62f3c2aabae34c829f1634d7dbed9bc0f3334441eb440addbd8825f9e4c0c9e544909f154b9a78d207b0bf
- SSDEEP 98304:s+hBp75lKkBcgWGoqZ92yVG/uzGNV9Hkv:s+hBtOkSXByQyVG/uzGNVyv
- TLSH T16206D02BB26901E8D1BFD17CC9165907EBB2780503A0A7DF12E046A62F77BE14E7E315
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-01_55c1a88f6a43e18c8b9be70f6934710b_icedid_njrat_stealc.exe
Resource
win10v2004-20260513-en
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-01_55c1a88f6a43e18c8b9be70f6934710b_icedid_njrat_stealc.exe
Resource
win11ltsc2024-20260629-en
10 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-01_55c1a88f6a43e18c8b9be70f6934710b_icedid_njrat_stealc
- Size 3.8MB
- SHA256 718b58db5547c67c648b588f84def39519b5f5ac325b8563da31e5cd3b9a05df
- MD5 55c1a88f6a43e18c8b9be70f6934710b
- SHA1 2bade35c163c5ecdf682fb2eb29c478ae5c7a1c5
- SHA512 ccea7ec094d423d3d7b3c16109ef96c106986a2dba62f3c2aabae34c829f1634d7dbed9bc0f3334441eb440addbd8825f9e4c0c9e544909f154b9a78d207b0bf
- SSDEEP 98304:s+hBp75lKkBcgWGoqZ92yVG/uzGNV9Hkv:s+hBtOkSXByQyVG/uzGNVyv
- TLSH T16206D02BB26901E8D1BFD17CC9165907EBB2780503A0A7DF12E046A62F77BE14E7E315
- MD5 SHA1 SHA512 SSDEEP TLSH
Score8/10-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Enumerates processes with tasklist