669446e7a34b3cd2ceee93a24668a51d3207383a8f11ee1add724cf3a339fb04

General

Target
2026-07-18_cb522e003e286600640c8875e000ea68_icedid_luca-stealer_njrat
Size 1022KB
Sample260718-s5p84aex9m
SHA256 669446e7a34b3cd2ceee93a24668a51d3207383a8f11ee1add724cf3a339fb04
MD5 cb522e003e286600640c8875e000ea68
SHA1 119f410217c180da76fabd0c971c50adebafed7c
SHA512 e310342f955d93414726ec5c3d978f3e4fdf6c7abaf5fd9f4f1dfed8f86ec85025f7f5d807575e97ee1bf7ff74fb3ad84931909c95d0e6cc23646c23959b8252
SSDEEP 24576:r0Vaxj6UrPzLkyKFELUTJLaFaJNfEV5vNSDUTyX5kln7ojX0Oh9zQJ3JZy5MrtA5:4clrbLkyEELUTJLaFaJNsV5FSD+yX5km
TLSH
T11525AE08FAA408ECE5BED17D8D08C177D6B375BC0716E6DF2A29C2620B135D0397AB59
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

Malware Config

Targets

- Target
  2026-07-18_cb522e003e286600640c8875e000ea68_icedid_luca-stealer_njrat
- Size 1022KB
- SHA256 669446e7a34b3cd2ceee93a24668a51d3207383a8f11ee1add724cf3a339fb04
- MD5 cb522e003e286600640c8875e000ea68
- SHA1 119f410217c180da76fabd0c971c50adebafed7c
- SHA512 e310342f955d93414726ec5c3d978f3e4fdf6c7abaf5fd9f4f1dfed8f86ec85025f7f5d807575e97ee1bf7ff74fb3ad84931909c95d0e6cc23646c23959b8252
- SSDEEP 24576:r0Vaxj6UrPzLkyKFELUTJLaFaJNfEV5vNSDUTyX5kln7ojX0Oh9zQJ3JZy5MrtA5:4clrbLkyEELUTJLaFaJNsV5FSD+yX5km
- TLSH
  T11525AE08FAA408ECE5BED17D8D08C177D6B375BC0716E6DF2A29C2620B135D0397AB59
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

defense_evasion discovery spyware stealer
- Detect binaries embedding considerable number of MFA browser extension IDs.
- Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.
- Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers
- Detects executables containing bas64 encoded gzip files
- Enumerates VirtualBox registry keys
  defense_evasion
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  defense_evasion
- Looks for VirtualBox Guest Additions in registry
  defense_evasion
- Looks for VMWare Tools registry key
  defense_evasion
- Looks for VMWare services registry key.
  defense_evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2