General
- Target 2026-08-14_c34c43c58cbf162831b8c1891ddcd055_icedid_stealc
- Size 12.8MB
- Sample260814-hha6jsfg84
- SHA256 33b3a9086a62d03d5a01e97c1f07fff34946b18a479f6c124bf4a342ab287d61
- MD5 c34c43c58cbf162831b8c1891ddcd055
- SHA1 cdf4e4b180e4642670098c2dc8cad18765df1a54
- SHA512 c4515890855bbfd5101abc2fbf66cbc855507f8be0227455f4324582e84e577517c86c7e7105aee624e234ae65343ffaeff24dfb20861d79f5a60ca3ce292604
- SSDEEP 49152:V/MhHCfGECNIdJGBBVjNj7aYHwb/qSm5FIZMsTkCv7ntAOGE9H+dzUyZ/6YSuDXF:Vm9v
- TLSH T1CAD6E733744A329BC8920472E122A0B38DBDF976672692E5E45F801C39EE0ED556FF71
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-14_c34c43c58cbf162831b8c1891ddcd055_icedid_stealc.exe
Resource
win10v2004-20260513-en
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-14_c34c43c58cbf162831b8c1891ddcd055_icedid_stealc.exe
Resource
win11ltsc2024-20260709-en
9 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-14_c34c43c58cbf162831b8c1891ddcd055_icedid_stealc
- Size 12.8MB
- SHA256 33b3a9086a62d03d5a01e97c1f07fff34946b18a479f6c124bf4a342ab287d61
- MD5 c34c43c58cbf162831b8c1891ddcd055
- SHA1 cdf4e4b180e4642670098c2dc8cad18765df1a54
- SHA512 c4515890855bbfd5101abc2fbf66cbc855507f8be0227455f4324582e84e577517c86c7e7105aee624e234ae65343ffaeff24dfb20861d79f5a60ca3ce292604
- SSDEEP 49152:V/MhHCfGECNIdJGBBVjNj7aYHwb/qSm5FIZMsTkCv7ntAOGE9H+dzUyZ/6YSuDXF:Vm9v
- TLSH T1CAD6E733744A329BC8920472E122A0B38DBDF976672692E5E45F801C39EE0ED556FF71
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10-
Detect binaries embedding considerable number of MFA browser extension IDs.
-
Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.
-
Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers
-
Detects executables containing SQL queries to confidential data stores. Observed in infostealers
-
Detects executables referencing many Password Manager software clients. Observed in infostealers
-
Detects executables referencing many confidential data stores found in browsers, mail clients, crypt
-
Maps connected drives based on registry
Disk information is often read in order to detect sandboxing environments.