General
- Target 2026-08-19_5f84426bd150e1bb3f36af9491d8fbbd_icedid_njrat_stealc
- Size 5.7MB
- Sample260819-stzy6axcjb
- SHA256 2cb5d8e235741686beac037d6c7c188cb9d84a92acc10e1e0908eec9a5e6f0fd
- MD5 5f84426bd150e1bb3f36af9491d8fbbd
- SHA1 895c772e90fa8e366ed6007c2334e93d5ec2b43f
- SHA512 e61b3e8e0a1a0048e824853484cbe404628051f156a215c2d1f836ab8473d021c4a2702a352c26b3f60420f032caa76f17a96720380327719406804a7ce35e91
- SSDEEP 98304:xbRTTngZBgw3GuWGoqZ92yVG/uzGNV9HkAVHL/DKmFfCVQ42+SMWNxl:xbRTbYCw3cByQyVG/uzGNVyAl3K8fCGJ
- TLSH T1C656F16BA26901FCD1BFD178C9165907EBB2780943A096CF16E057A62F63BE04F3E711
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-19_5f84426bd150e1bb3f36af9491d8fbbd_icedid_njrat_stealc.exe
Resource
win10v2004-20260513-en
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-19_5f84426bd150e1bb3f36af9491d8fbbd_icedid_njrat_stealc.exe
Resource
win11ltsc2024-20260709-en
7 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-19_5f84426bd150e1bb3f36af9491d8fbbd_icedid_njrat_stealc
- Size 5.7MB
- SHA256 2cb5d8e235741686beac037d6c7c188cb9d84a92acc10e1e0908eec9a5e6f0fd
- MD5 5f84426bd150e1bb3f36af9491d8fbbd
- SHA1 895c772e90fa8e366ed6007c2334e93d5ec2b43f
- SHA512 e61b3e8e0a1a0048e824853484cbe404628051f156a215c2d1f836ab8473d021c4a2702a352c26b3f60420f032caa76f17a96720380327719406804a7ce35e91
- SSDEEP 98304:xbRTTngZBgw3GuWGoqZ92yVG/uzGNV9HkAVHL/DKmFfCVQ42+SMWNxl:xbRTbYCw3cByQyVG/uzGNVyAl3K8fCGJ
- TLSH T1C656F16BA26901FCD1BFD178C9165907EBB2780943A096CF16E057A62F63BE04F3E711
- MD5 SHA1 SHA512 SSDEEP TLSH
Score7/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.