6d00c68f3fb4eb6df5e35b56c34555e261ccde509e7c566d25b206edc65fe929

General

Target
2026-07-23_1c362fa6c460bc1ef3a92a6b5b3f523f_icedid_luca-stealer_njrat_stealc
Size 7.0MB
Sample260723-p99lrazbkd
SHA256 6d00c68f3fb4eb6df5e35b56c34555e261ccde509e7c566d25b206edc65fe929
MD5 1c362fa6c460bc1ef3a92a6b5b3f523f
SHA1 f4b0fd2d6e93c163fe2aba81df57e0e4b42046ce
SHA512 b26ca6d7b623f7b43f565acabb0a923fd46235ffaadfd9e18d067c2cd5915d9ca4788facc8a12eb7ffcb16b78aef2b6de8adc954508709c05c9fb4ee9fc57b52
SSDEEP 24576:Meckj8axsjaj5tutb5UiRVEiZPAWb7XSwuv:V16m2gyVJt7w
TLSH
T180760A3E05930F7CC6E09DB9957D5A96FF2AA04F1FF05876B6C800F918865AC9F26903
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

Malware Config

Targets

- Target
  2026-07-23_1c362fa6c460bc1ef3a92a6b5b3f523f_icedid_luca-stealer_njrat_stealc
- Size 7.0MB
- SHA256 6d00c68f3fb4eb6df5e35b56c34555e261ccde509e7c566d25b206edc65fe929
- MD5 1c362fa6c460bc1ef3a92a6b5b3f523f
- SHA1 f4b0fd2d6e93c163fe2aba81df57e0e4b42046ce
- SHA512 b26ca6d7b623f7b43f565acabb0a923fd46235ffaadfd9e18d067c2cd5915d9ca4788facc8a12eb7ffcb16b78aef2b6de8adc954508709c05c9fb4ee9fc57b52
- SSDEEP 24576:Meckj8axsjaj5tutb5UiRVEiZPAWb7XSwuv:V16m2gyVJt7w
- TLSH
  T180760A3E05930F7CC6E09DB9957D5A96FF2AA04F1FF05876B6C800F918865AC9F26903
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

credential_access defense_evasion discovery execution spyware stealer
- Looks for VirtualBox Guest Additions in registry
  defense_evasion
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Downloads MZ/PE file
- Looks for VMWare Tools registry key
  defense_evasion
- Uses browser remote debugging
  Can be used control the browser and steal sensitive information such as credentials and session cookies.
  credential_access stealer
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral1 behavioral2