General
- Target 2026-07-28_aca33936b6e3640351da7b1fd9e4f904_icedid_njrat_stealc
- Size 6.7MB
- Sample260729-aw5cjsstew
- SHA256 cac5bf496e92386e10f80eb4cb6f2faae3024c56c60a4cb8299ab73ea4fa299d
- MD5 aca33936b6e3640351da7b1fd9e4f904
- SHA1 63ac8ac84c6ad31c0431b6d68b4ced4696ee06ae
- SHA512 47a89724021698e37029f2e8a0c7e0474520706afafe0c69ea1f301be7fd55c180e7c1208aa151254baa2ee299b93e9292199482dbfc6ab0c4d67b93bc2caa62
- SSDEEP 196608:e+hBw+kWByQyVG/uzGNVyAl3K8fCGnbP3JzATC4C2:xw+1NSG/lVrl3KExL3JzATzC2
- TLSH T13866016B726901E8E1BFD17CC9065907EBB2780543A0A7DF12E046A62F77BE14E3E711
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-28_aca33936b6e3640351da7b1fd9e4f904_icedid_njrat_stealc.exe
Resource
win10v2004-20260513-en
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-28_aca33936b6e3640351da7b1fd9e4f904_icedid_njrat_stealc.exe
Resource
win11ltsc2024-20260709-en
11 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-28_aca33936b6e3640351da7b1fd9e4f904_icedid_njrat_stealc
- Size 6.7MB
- SHA256 cac5bf496e92386e10f80eb4cb6f2faae3024c56c60a4cb8299ab73ea4fa299d
- MD5 aca33936b6e3640351da7b1fd9e4f904
- SHA1 63ac8ac84c6ad31c0431b6d68b4ced4696ee06ae
- SHA512 47a89724021698e37029f2e8a0c7e0474520706afafe0c69ea1f301be7fd55c180e7c1208aa151254baa2ee299b93e9292199482dbfc6ab0c4d67b93bc2caa62
- SSDEEP 196608:e+hBw+kWByQyVG/uzGNVyAl3K8fCGnbP3JzATC4C2:xw+1NSG/lVrl3KExL3JzATzC2
- TLSH T13866016B726901E8E1BFD17CC9065907EBB2780543A0A7DF12E046A62F77BE14E3E711
- MD5 SHA1 SHA512 SSDEEP TLSH
Score8/10-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Enumerates processes with tasklist