General
- Target 2026-07-23_68161f197989f637403175eb82d4785d_icedid_njrat_stealc
- Size 5.3MB
- Sample260724-bmek7sen31
- SHA256 0b26ccbdb6107b37e9dd87f827f28ca24eb1fddd324d9766c061bc23bbacf418
- MD5 68161f197989f637403175eb82d4785d
- SHA1 857fd8f9e0a07e4f08c15721f8d252c497ab4d82
- SHA512 a5e27da43b58f74585150896dc4e0724357340c67cf79541282bc11ca8018ad315873ada0a4eb14044824aa20125a449f1178dd1f4cbb40069aa748b31cf9c13
- SSDEEP 98304:4+hxpLJlKkvs/WGoqZ92yVG/uzGNV9HkAVHL/DKmFfCVQ4q:4+hx9ekE+ByQyVG/uzGNVyAl3K8fCGb
- TLSH T1E746F12BB26901E8D1BFD17CC9065907EBB2780543A0A7CF12E046A62F77BE14E7E715
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-23_68161f197989f637403175eb82d4785d_icedid_njrat_stealc.exe
Resource
win10v2004-20260513-en
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-23_68161f197989f637403175eb82d4785d_icedid_njrat_stealc.exe
Resource
win11ltsc2024-20260710-en
11 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-23_68161f197989f637403175eb82d4785d_icedid_njrat_stealc
- Size 5.3MB
- SHA256 0b26ccbdb6107b37e9dd87f827f28ca24eb1fddd324d9766c061bc23bbacf418
- MD5 68161f197989f637403175eb82d4785d
- SHA1 857fd8f9e0a07e4f08c15721f8d252c497ab4d82
- SHA512 a5e27da43b58f74585150896dc4e0724357340c67cf79541282bc11ca8018ad315873ada0a4eb14044824aa20125a449f1178dd1f4cbb40069aa748b31cf9c13
- SSDEEP 98304:4+hxpLJlKkvs/WGoqZ92yVG/uzGNV9HkAVHL/DKmFfCVQ4q:4+hx9ekE+ByQyVG/uzGNVyAl3K8fCGb
- TLSH T1E746F12BB26901E8D1BFD17CC9065907EBB2780543A0A7CF12E046A62F77BE14E7E715
- MD5 SHA1 SHA512 SSDEEP TLSH
Score8/10-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Enumerates processes with tasklist