3f83b78e92aed78894c2deb7a653ec3377f0b7b2460d86a93b5425627003717a

General

Target
2026-07-15_73a47d5045e60bcb6700cebbfbf65da3_icedid_luca-stealer_njrat_stealc
Size 1.5MB
Sample260715-c5qa4ah13q
SHA256 3f83b78e92aed78894c2deb7a653ec3377f0b7b2460d86a93b5425627003717a
MD5 73a47d5045e60bcb6700cebbfbf65da3
SHA1 7913342a257ce39117534e6e7ab9957f495e8bd0
SHA512 d09283bd603242cbc1e8deea2b9bf5f51b06fa5277586bacbf2415f133ff2bcdf968f2663790c5e7bcdadbe3b6d41905a665a6ac208721df06f45e0c5b8ed1b0
SSDEEP 12288:wVIlreN504NGmeg7Q9BEFO0m24RbNqeJHlyguf04FZk+:wVI9eVGmP8BkdgkezkZd
TLSH
T1E075AE6DCB7426AEC84DB37F89A08147A5A5398D02D7CDBD60C48C7C3C4397B6E2D698
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion discovery

Malware Config

Targets

- Target
  2026-07-15_73a47d5045e60bcb6700cebbfbf65da3_icedid_luca-stealer_njrat_stealc
- Size 1.5MB
- SHA256 3f83b78e92aed78894c2deb7a653ec3377f0b7b2460d86a93b5425627003717a
- MD5 73a47d5045e60bcb6700cebbfbf65da3
- SHA1 7913342a257ce39117534e6e7ab9957f495e8bd0
- SHA512 d09283bd603242cbc1e8deea2b9bf5f51b06fa5277586bacbf2415f133ff2bcdf968f2663790c5e7bcdadbe3b6d41905a665a6ac208721df06f45e0c5b8ed1b0
- SSDEEP 12288:wVIlreN504NGmeg7Q9BEFO0m24RbNqeJHlyguf04FZk+:wVI9eVGmP8BkdgkezkZd
- TLSH
  T1E075AE6DCB7426AEC84DB37F89A08147A5A5398D02D7CDBD60C48C7C3C4397B6E2D698
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

defense_evasion discovery
- Detect binaries embedding considerable number of MFA browser extension IDs.
- Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.
- Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers
- Detects executables containing bas64 encoded gzip files
- Enumerates VirtualBox registry keys
  defense_evasion
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  defense_evasion
- Looks for VirtualBox Guest Additions in registry
  defense_evasion
- Looks for VMWare Tools registry key
  defense_evasion
- Looks for VMWare services registry key.
  defense_evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

5

T1497

Credential Access

Discovery

Query Registry

7

T1012

System Information Discovery

2

T1082

Virtualization/Sandbox Evasion

5

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Detect binaries embedding considerable number of MFA browser extension IDs.

Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers

Detects executables containing bas64 encoded gzip files

Enumerates VirtualBox registry keys

Identifies VirtualBox via ACPI registry values (likely anti-VM)

Looks for VirtualBox Guest Additions in registry

Looks for VMWare Tools registry key

Looks for VMWare services registry key.

Checks BIOS information in registry

Checks installed software on the system

Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2