General
- Target 2026-08-02_8f952ae834fef422ff3295fd6ba14ebd_icedid_luca-stealer_njrat_stealc
- Size 12.0MB
- Sample260802-dc2n4a11cs
- SHA256 93e19719ce3ccca84612f190ef1aaf651b432cc2a949b80425992bb9e4e8cc45
- MD5 8f952ae834fef422ff3295fd6ba14ebd
- SHA1 e2e77006e18a551eecc5ef025f210e981ef66d1a
- SHA512 cdce6a19b34562ecd8b9ba73edd440c3cbd9c84b9886864ac075337c9edccf50af66edda7947819bb92e92eb4cd738a112cafe6ed4aa7a2a683223083a151026
- SSDEEP 49152:Zb80JbB39FIV/nH5BOFiHLDnwqyaB2WZyBzuJyGbcvlb0nURHyFHyPJdvrBlqur:RVEV/HX3DWzAbqE0dvb4mRENf9
- TLSH T11AC674E4F1262BA4E437FD75641D7579839A5900FB39E03788FEEE2221B4DB408253A7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2026-08-02_8f952ae834fef422ff3295fd6ba14ebd_icedid_luca-stealer_njrat_stealc.exe
Resource
win10v2004-20260513-en
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-02_8f952ae834fef422ff3295fd6ba14ebd_icedid_luca-stealer_njrat_stealc.exe
Resource
win11ltsc2024-20260709-en
6 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-02_8f952ae834fef422ff3295fd6ba14ebd_icedid_luca-stealer_njrat_stealc
- Size 12.0MB
- SHA256 93e19719ce3ccca84612f190ef1aaf651b432cc2a949b80425992bb9e4e8cc45
- MD5 8f952ae834fef422ff3295fd6ba14ebd
- SHA1 e2e77006e18a551eecc5ef025f210e981ef66d1a
- SHA512 cdce6a19b34562ecd8b9ba73edd440c3cbd9c84b9886864ac075337c9edccf50af66edda7947819bb92e92eb4cd738a112cafe6ed4aa7a2a683223083a151026
- SSDEEP 49152:Zb80JbB39FIV/nH5BOFiHLDnwqyaB2WZyBzuJyGbcvlb0nURHyFHyPJdvrBlqur:RVEV/HX3DWzAbqE0dvb4mRENf9
- TLSH T11AC674E4F1262BA4E437FD75641D7579839A5900FB39E03788FEEE2221B4DB408253A7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10-
Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion
-
Enumerates VirtualBox registry keys
-
Looks for VirtualBox Guest Additions in registry
-
Looks for VMWare Tools registry key
-
Suspicious use of NtSetInformationThreadHideFromDebugger