General
- Target 2026-08-05_fac0dcf40f75f492d07862b5501db038_icedid_njrat_stealc
- Size 5.3MB
- Sample260805-c6c26acc59
- SHA256 cc034417ff60ee381183ee74314bf0f10a8028c7cf27b85291fec66d30501624
- MD5 fac0dcf40f75f492d07862b5501db038
- SHA1 e637b006935e574670e8fb038056df6632647232
- SHA512 10f5e87f51cc93819b556f107c29a2ac6f04bfc388ddfec2e7e461c52ee1e8849efdc05dd2c8c421b31e99a50be9293991f2943326cb3c26346cd70c59d6e085
- SSDEEP 98304:HbRTTngZBgw3GlWGoqZ92yVG/uzGNV9HkAVHL/DKmFfCVQ4q:HbRTbYCw3tByQyVG/uzGNVyAl3K8fCGv
- TLSH T18746F16BA26901FCD0BFD178C9165907EBB2780943A096CF17E056A62F63BE14F3E711
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-05_fac0dcf40f75f492d07862b5501db038_icedid_njrat_stealc.exe
Resource
win10v2004-20260513-en
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-05_fac0dcf40f75f492d07862b5501db038_icedid_njrat_stealc.exe
Resource
win11ltsc2024-20260709-en
7 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-05_fac0dcf40f75f492d07862b5501db038_icedid_njrat_stealc
- Size 5.3MB
- SHA256 cc034417ff60ee381183ee74314bf0f10a8028c7cf27b85291fec66d30501624
- MD5 fac0dcf40f75f492d07862b5501db038
- SHA1 e637b006935e574670e8fb038056df6632647232
- SHA512 10f5e87f51cc93819b556f107c29a2ac6f04bfc388ddfec2e7e461c52ee1e8849efdc05dd2c8c421b31e99a50be9293991f2943326cb3c26346cd70c59d6e085
- SSDEEP 98304:HbRTTngZBgw3GlWGoqZ92yVG/uzGNV9HkAVHL/DKmFfCVQ4q:HbRTbYCw3tByQyVG/uzGNVyAl3K8fCGv
- TLSH T18746F16BA26901FCD0BFD178C9165907EBB2780943A096CF17E056A62F63BE14F3E711
- MD5 SHA1 SHA512 SSDEEP TLSH
Score7/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.