General
- Target 2026-07-02_59d3932b4486a7a750b5c7fe1187623f_icedid_njrat_stealc
- Size 4.9MB
- Sample260702-zepcfaev5s
- SHA256 79da8c21cbe45c46d225e76ae945013a9bd2c421a856f9727051ca94286f39be
- MD5 59d3932b4486a7a750b5c7fe1187623f
- SHA1 3d54b3df66fb9b7b3f3fc6bbc07e5dd10dd39921
- SHA512 2e48fa82fcd14118c5684f41c4971ae1e233444b31b4cdf4b4ee6c511a0ab83a583d83fc02fdbceab87811892891c001a44e1987798c1cae8938ffdd8723fcb6
- SSDEEP 98304:i+hBp75lKkBcFWGoqZ92yVG/uzGNV9HkAVHL/DKmFf1:i+hBtOkSoByQyVG/uzGNVyAl3K8f1
- TLSH T12236E12BB26901E8D1BFD17CC9165907EBB2780543A0A7CF12E046A62F77BE14E7E315
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-02_59d3932b4486a7a750b5c7fe1187623f_icedid_njrat_stealc.exe
Resource
win10v2004-20260513-en
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-02_59d3932b4486a7a750b5c7fe1187623f_icedid_njrat_stealc.exe
Resource
win11ltsc2024-20260629-en
10 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-02_59d3932b4486a7a750b5c7fe1187623f_icedid_njrat_stealc
- Size 4.9MB
- SHA256 79da8c21cbe45c46d225e76ae945013a9bd2c421a856f9727051ca94286f39be
- MD5 59d3932b4486a7a750b5c7fe1187623f
- SHA1 3d54b3df66fb9b7b3f3fc6bbc07e5dd10dd39921
- SHA512 2e48fa82fcd14118c5684f41c4971ae1e233444b31b4cdf4b4ee6c511a0ab83a583d83fc02fdbceab87811892891c001a44e1987798c1cae8938ffdd8723fcb6
- SSDEEP 98304:i+hBp75lKkBcFWGoqZ92yVG/uzGNV9HkAVHL/DKmFf1:i+hBtOkSoByQyVG/uzGNVyAl3K8f1
- TLSH T12236E12BB26901E8D1BFD17CC9165907EBB2780543A0A7CF12E046A62F77BE14E7E315
- MD5 SHA1 SHA512 SSDEEP TLSH
Score8/10-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Enumerates processes with tasklist