General
- Target 2026-07-20_81cbc27f49e2df193d854c3d25f377cc_icedid_njrat_stealc
- Size 3.4MB
- Sample260720-s73l7se14n
- SHA256 f273d482643448fe40f475a34eff266aa6bc0af2dd0bc50dfb28387af7378a6a
- MD5 81cbc27f49e2df193d854c3d25f377cc
- SHA1 6f5c6b5f81f77cc638a9024f880239aa0b02dd7d
- SHA512 5d508013a9acab8569b9569bfbd32f9450f45322c8936ce8f44e450e899e281617fecb4fe883e8221d0f09a9839bd0d766e5b84a273f6796cc46b2b99f25de44
- SSDEEP 49152:s++Mx9P91XZhIl8pFJ8HsKkZrn5SHLZQu2XG8ZoI9Z9rqyI44HppuzGxHHY49:s+hxpLJlKkvsWWGoqZ92yVG/uzGNV9
- TLSH T147F5C02BB26901E8E1BFD17CC9165907EBB1780503A0A7DF12E046A62F77BE14E7E315
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-20_81cbc27f49e2df193d854c3d25f377cc_icedid_njrat_stealc.exe
Resource
win10v2004-20260513-en
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-20_81cbc27f49e2df193d854c3d25f377cc_icedid_njrat_stealc.exe
Resource
win11ltsc2024-20260710-en
11 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-20_81cbc27f49e2df193d854c3d25f377cc_icedid_njrat_stealc
- Size 3.4MB
- SHA256 f273d482643448fe40f475a34eff266aa6bc0af2dd0bc50dfb28387af7378a6a
- MD5 81cbc27f49e2df193d854c3d25f377cc
- SHA1 6f5c6b5f81f77cc638a9024f880239aa0b02dd7d
- SHA512 5d508013a9acab8569b9569bfbd32f9450f45322c8936ce8f44e450e899e281617fecb4fe883e8221d0f09a9839bd0d766e5b84a273f6796cc46b2b99f25de44
- SSDEEP 49152:s++Mx9P91XZhIl8pFJ8HsKkZrn5SHLZQu2XG8ZoI9Z9rqyI44HppuzGxHHY49:s+hxpLJlKkvsWWGoqZ92yVG/uzGNV9
- TLSH T147F5C02BB26901E8E1BFD17CC9165907EBB1780503A0A7DF12E046A62F77BE14E7E315
- MD5 SHA1 SHA512 SSDEEP TLSH
Score8/10-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Enumerates processes with tasklist