1d5ae22fa1cdd0a9d2ff0316930eed0929f113938578145134a7a066dd6d34de

General

Target
2026-08-12_2ff4c9eaa23347cfc8d7c0ba93bf8541_icedid_luca-stealer_njrat_stealc
Size 1.8MB
Sample260812-thd3zsyshs
SHA256 1d5ae22fa1cdd0a9d2ff0316930eed0929f113938578145134a7a066dd6d34de
MD5 2ff4c9eaa23347cfc8d7c0ba93bf8541
SHA1 eb2a002c475961558d1db4951feb869a2665e24d
SHA512 4d44f318ee1b08eab42dc84e670f1efec0c763a5791057bdf33cbd46caec6f1b068a4cc2198aa1d1ac91216ff0268696969d20c051090c826e44f7a38e2820bf
SSDEEP 24576:39S0IXLMf76QeGIyshw3iV3YhWJo8UrwY8UffT0JTF1mKn5wjywn6e2+im:t2Xu6BfypiVW8UrfrgbmAwdcm
TLSH
T1FA858F16A3A401F8D0ABC179C9465607EBB2744917B09BDF17D04AAA6F23EF11F3E721
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-08-12_2ff4c9eaa23347cfc8d7c0ba93bf8541_icedid_luca-stealer_njrat_stealc
- Size 1.8MB
- SHA256 1d5ae22fa1cdd0a9d2ff0316930eed0929f113938578145134a7a066dd6d34de
- MD5 2ff4c9eaa23347cfc8d7c0ba93bf8541
- SHA1 eb2a002c475961558d1db4951feb869a2665e24d
- SHA512 4d44f318ee1b08eab42dc84e670f1efec0c763a5791057bdf33cbd46caec6f1b068a4cc2198aa1d1ac91216ff0268696969d20c051090c826e44f7a38e2820bf
- SSDEEP 24576:39S0IXLMf76QeGIyshw3iV3YhWJo8UrwY8UffT0JTF1mKn5wjywn6e2+im:t2Xu6BfypiVW8UrfrgbmAwdcm
- TLSH
  T1FA858F16A3A401F8D0ABC179C9465607EBB2744917B09BDF17D04AAA6F23EF11F3E721
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

discovery persistence spyware stealer
- Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.
- Detects executables containing SQL queries to confidential data stores. Observed in infostealers
- Detects executables containing URLs to raw contents of a Github gist
- Detects executables containing possible sandbox analysis VM names
- Detects executables containing possible sandbox analysis VM usernames
- Detects executables referencing many IR and analysis tools
- Detects executables referencing virtualization MAC addresses
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
behavioral1 behavioral2