General
- Target 2026-08-19_8c5a5dd4913e07618f7a7dbcd585eadd_icedid_luca-stealer_njrat
- Size 1.4MB
- Sample260819-bzglbsbr7v
- SHA256 34b9f5eae0bedec1bd6f1bbc257e4c0da1f400bd5dfc8aec7d4337ac6f1096aa
- MD5 8c5a5dd4913e07618f7a7dbcd585eadd
- SHA1 1f42182da2b5b47b722f0a254b2c47f7b063cc6b
- SHA512 e2b0e9e47bcc11776a5fc4886ff6828e9c82ee77b5d94ac99857400de005aa33d4f161cad939928e4707b14065168f6896fc34ac13e619de010303ef75287c46
- SSDEEP 24576:jSfkw48Wa40CGmwSF4Hxy24/2ZYPtOgXh2c3UsgLA22HnVvdoRl:jSftc10fIF8yh/wMIc3UsgLA24npKR
- TLSH T16965025BA6E400FDE2F7C275CD415D46DAB2F84A47A0AA9F03E449920F237A09D3D763
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2026-08-19_8c5a5dd4913e07618f7a7dbcd585eadd_icedid_luca-stealer_njrat.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-19_8c5a5dd4913e07618f7a7dbcd585eadd_icedid_luca-stealer_njrat.exe
Resource
win11ltsc2024-20260710-en
3 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-19_8c5a5dd4913e07618f7a7dbcd585eadd_icedid_luca-stealer_njrat
- Size 1.4MB
- SHA256 34b9f5eae0bedec1bd6f1bbc257e4c0da1f400bd5dfc8aec7d4337ac6f1096aa
- MD5 8c5a5dd4913e07618f7a7dbcd585eadd
- SHA1 1f42182da2b5b47b722f0a254b2c47f7b063cc6b
- SHA512 e2b0e9e47bcc11776a5fc4886ff6828e9c82ee77b5d94ac99857400de005aa33d4f161cad939928e4707b14065168f6896fc34ac13e619de010303ef75287c46
- SSDEEP 24576:jSfkw48Wa40CGmwSF4Hxy24/2ZYPtOgXh2c3UsgLA22HnVvdoRl:jSftc10fIF8yh/wMIc3UsgLA24npKR
- TLSH T16965025BA6E400FDE2F7C275CD415D46DAB2F84A47A0AA9F03E449920F237A09D3D763
- MD5 SHA1 SHA512 SSDEEP TLSH
Score6/10-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.