General
- Target 2026-07-14_90f5cf0e1b2dfeba6ffdcefbe2d8d754_icedid_njrat_stealc
- Size 2.6MB
- Sample260714-hal8vafy6n
- SHA256 7633528efa54c2dd3a8864e61119d53e74fe0f563aa9c053797db1a5adabf3e1
- MD5 90f5cf0e1b2dfeba6ffdcefbe2d8d754
- SHA1 0e9e1f407b32787c2966060042bd0f7558c4b460
- SHA512 97458579400d1e169c2de2e986770ad88c213da4a15856021d99908edf292812f22feeaf90bd977d274c790771f06ef7580df1821b455613935e9f1fe619e34b
- SSDEEP 49152:iO5skBmhtoWUIfmbKsWjErxn9iDXXFCMF4EHaYXJ0x:FOtLUIfRc4VCc4EHrJ0x
- TLSH T176C5CFD273EC4489E0377174DA51490FE6727424072187DFBF950AAD8E7AAE0CB3AB52
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-14_90f5cf0e1b2dfeba6ffdcefbe2d8d754_icedid_njrat_stealc.exe
Resource
win10v2004-20260513-en
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-14_90f5cf0e1b2dfeba6ffdcefbe2d8d754_icedid_njrat_stealc.exe
Resource
win11ltsc2024-20260710-en
10 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-14_90f5cf0e1b2dfeba6ffdcefbe2d8d754_icedid_njrat_stealc
- Size 2.6MB
- SHA256 7633528efa54c2dd3a8864e61119d53e74fe0f563aa9c053797db1a5adabf3e1
- MD5 90f5cf0e1b2dfeba6ffdcefbe2d8d754
- SHA1 0e9e1f407b32787c2966060042bd0f7558c4b460
- SHA512 97458579400d1e169c2de2e986770ad88c213da4a15856021d99908edf292812f22feeaf90bd977d274c790771f06ef7580df1821b455613935e9f1fe619e34b
- SSDEEP 49152:iO5skBmhtoWUIfmbKsWjErxn9iDXXFCMF4EHaYXJ0x:FOtLUIfRc4VCc4EHrJ0x
- TLSH T176C5CFD273EC4489E0377174DA51490FE6727424072187DFBF950AAD8E7AAE0CB3AB52
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10-
Enumerates VirtualBox registry keys
-
Looks for VirtualBox Guest Additions in registry
-
Downloads MZ/PE file
-
Looks for VMWare Tools registry key
-
Looks for VMWare services registry key.
-
Executes dropped EXE
-
Suspicious use of NtSetInformationThreadHideFromDebugger