General
- Target 2026-08-14_2a5a8d3bbb17e5b6d70b2b198e2c6604_icedid_njrat_stealc
- Size 1.9MB
- Sample260814-mq85rsssdx
- SHA256 470c30ad84daee2362a97adcb1c83c921faa19038ec09f06255cca2a3a883063
- MD5 2a5a8d3bbb17e5b6d70b2b198e2c6604
- SHA1 7b2ca74866bcf513f1b0954218fe9617e220e040
- SHA512 27415d41da46062957a12c35cf4dfcf1d3d1c1d94b0a98f5a60c70031bfad9ca0304fb9b37508dbfe54e2ca567ab3068011ffb4fefb46ce4c44d7e0582406989
- SSDEEP 49152:r03bRTzgORAg92pjyf2rzGshgwsh+TJEcLCy:AbRTTngZBgw3+k
- TLSH T1C0957D2BA26901BCF1FFD178C9965907FBF1780543A096CF02E097A62B67BE0463E711
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-14_2a5a8d3bbb17e5b6d70b2b198e2c6604_icedid_njrat_stealc.exe
Resource
win10v2004-20260513-en
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-14_2a5a8d3bbb17e5b6d70b2b198e2c6604_icedid_njrat_stealc.exe
Resource
win11ltsc2024-20260709-en
5 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-14_2a5a8d3bbb17e5b6d70b2b198e2c6604_icedid_njrat_stealc
- Size 1.9MB
- SHA256 470c30ad84daee2362a97adcb1c83c921faa19038ec09f06255cca2a3a883063
- MD5 2a5a8d3bbb17e5b6d70b2b198e2c6604
- SHA1 7b2ca74866bcf513f1b0954218fe9617e220e040
- SHA512 27415d41da46062957a12c35cf4dfcf1d3d1c1d94b0a98f5a60c70031bfad9ca0304fb9b37508dbfe54e2ca567ab3068011ffb4fefb46ce4c44d7e0582406989
- SSDEEP 49152:r03bRTzgORAg92pjyf2rzGshgwsh+TJEcLCy:AbRTTngZBgw3+k
- TLSH T1C0957D2BA26901BCF1FFD178C9965907FBF1780543A096CF02E097A62B67BE0463E711
- MD5 SHA1 SHA512 SSDEEP TLSH
Score7/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.