General
- Target 2026-08-10_ee0f8fa0e83ac203b60ad616787f11a6_icedid_poet-rat
- Size 1.2MB
- Sample260810-1ce7estxct
- SHA256 5312a7bbca3377ebce81b7e35ec1af39bac94a4fc2edb180d0108bf8cacc03b3
- MD5 ee0f8fa0e83ac203b60ad616787f11a6
- SHA1 f8ac6656fa716b1ab259c368f319a35019c2b7ec
- SHA512 bf9bd8ed07f5921e71bc3b305fca5b85ef1b19ad495eb4e9a0cebd7629a20bcfcf09bb6d22dc2f74e774b1327faf3c683c219e287f1181053eaa77da3ed9ff1f
- SSDEEP 24576:UulcIx7iWEyyvIdmVRzNEbOIAjPXosVHnVexb/PJ6SZZo9crdXeD:nCRzNEb1OhHoR569cwD
- TLSH T13E5512765D94B9F4D3FE9538C0164573E7FA2C3A4310975BCBA0AD022F275908E3AB29
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-10_ee0f8fa0e83ac203b60ad616787f11a6_icedid_poet-rat.exe
Resource
win10v2004-20260513-en
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-10_ee0f8fa0e83ac203b60ad616787f11a6_icedid_poet-rat.exe
Resource
win11ltsc2024-20260709-en
7 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-10_ee0f8fa0e83ac203b60ad616787f11a6_icedid_poet-rat
- Size 1.2MB
- SHA256 5312a7bbca3377ebce81b7e35ec1af39bac94a4fc2edb180d0108bf8cacc03b3
- MD5 ee0f8fa0e83ac203b60ad616787f11a6
- SHA1 f8ac6656fa716b1ab259c368f319a35019c2b7ec
- SHA512 bf9bd8ed07f5921e71bc3b305fca5b85ef1b19ad495eb4e9a0cebd7629a20bcfcf09bb6d22dc2f74e774b1327faf3c683c219e287f1181053eaa77da3ed9ff1f
- SSDEEP 24576:UulcIx7iWEyyvIdmVRzNEbOIAjPXosVHnVexb/PJ6SZZo9crdXeD:nCRzNEb1OhHoR569cwD
- TLSH T13E5512765D94B9F4D3FE9538C0164573E7FA2C3A4310975BCBA0AD022F275908E3AB29
- MD5 SHA1 SHA512 SSDEEP TLSH
Score7/10Checks computer location settings
Looks up country code configured in the registry, likely geofence.
Executes dropped EXE
Loads dropped DLL
Drops file in System32 directory
Suspicious use of NtSetInformationThreadHideFromDebugger