General
- Target 2026-07-01_45ddd00cb8a3a34b7c46d7dd96b373a6_icedid_njrat_stealc
- Size 5.3MB
- Sample260701-vrabtsaz8k
- SHA256 1efda7014618c8d8a573af753c9988719f29122f5e005d25ecba1a102f630b66
- MD5 45ddd00cb8a3a34b7c46d7dd96b373a6
- SHA1 dd7d48b4da39ee377edbb0e5ed9ead1a5259ea31
- SHA512 4c41c8be66aeaa55c095ff74a0849cdd0211f2f5489aac9510edc04af5fd43d4a748d2f2cd67b2eb32005fcc65bd6f0392c535f8f96a2a86167f336a5cd57fe8
- SSDEEP 98304:M+hBp75lKkBcWWGoqZ92yVG/uzGNV9HkAVHL/DKmFfCVQ4b:M+hBtOkSxByQyVG/uzGNVyAl3K8fCGo
- TLSH T18D46F12BB26901E8D1BFD17CC9065907EBB2780543A0A7CF12E046A62F77BE14E7E715
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-01_45ddd00cb8a3a34b7c46d7dd96b373a6_icedid_njrat_stealc.exe
Resource
win10v2004-20260513-en
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-01_45ddd00cb8a3a34b7c46d7dd96b373a6_icedid_njrat_stealc.exe
Resource
win11ltsc2024-20260629-en
10 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-01_45ddd00cb8a3a34b7c46d7dd96b373a6_icedid_njrat_stealc
- Size 5.3MB
- SHA256 1efda7014618c8d8a573af753c9988719f29122f5e005d25ecba1a102f630b66
- MD5 45ddd00cb8a3a34b7c46d7dd96b373a6
- SHA1 dd7d48b4da39ee377edbb0e5ed9ead1a5259ea31
- SHA512 4c41c8be66aeaa55c095ff74a0849cdd0211f2f5489aac9510edc04af5fd43d4a748d2f2cd67b2eb32005fcc65bd6f0392c535f8f96a2a86167f336a5cd57fe8
- SSDEEP 98304:M+hBp75lKkBcWWGoqZ92yVG/uzGNV9HkAVHL/DKmFfCVQ4b:M+hBtOkSxByQyVG/uzGNVyAl3K8fCGo
- TLSH T18D46F12BB26901E8D1BFD17CC9065907EBB2780543A0A7CF12E046A62F77BE14E7E715
- MD5 SHA1 SHA512 SSDEEP TLSH
Score8/10-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Enumerates processes with tasklist