General
- Target 2026-08-20_a892af23da871e7895ac42bad052cfac_icedid_njrat_stealc
- Size 3.5MB
- Sample260820-lrdvkshq4z
- SHA256 3d3461c78d2d4c541b81d9dbb61ec2ba24710b888d73650564a3e3149173a7dc
- MD5 a892af23da871e7895ac42bad052cfac
- SHA1 b3bc2ddcfe090eec4d14e77d6cd428e56a457904
- SHA512 553bc36697529c81bac40d65a5dd9479d6d9a93bb317693a78cf5a8c3b6a3c9037ec8facd72ac2b3d9f92f79096aeb38111296ce952b7a5dc4458be3db005e6a
- SSDEEP 49152:C03bRTzgORAg92pjyf2rzGshgwsh+TNsAhQCQu2XG8ZoI9Z9rqyI44HppuzGxHHM:1bRTTngZBgw3GvWGoqZ92yVG/uzGNVa
- TLSH T1CC06D06BA26902FCD4BFD178C9165907EBB1780943A096DF06E057A62F63BE04F3E711
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-20_a892af23da871e7895ac42bad052cfac_icedid_njrat_stealc.exe
Resource
win10v2004-20260513-en
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-20_a892af23da871e7895ac42bad052cfac_icedid_njrat_stealc.exe
Resource
win11ltsc2024-20260709-en
7 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-20_a892af23da871e7895ac42bad052cfac_icedid_njrat_stealc
- Size 3.5MB
- SHA256 3d3461c78d2d4c541b81d9dbb61ec2ba24710b888d73650564a3e3149173a7dc
- MD5 a892af23da871e7895ac42bad052cfac
- SHA1 b3bc2ddcfe090eec4d14e77d6cd428e56a457904
- SHA512 553bc36697529c81bac40d65a5dd9479d6d9a93bb317693a78cf5a8c3b6a3c9037ec8facd72ac2b3d9f92f79096aeb38111296ce952b7a5dc4458be3db005e6a
- SSDEEP 49152:C03bRTzgORAg92pjyf2rzGshgwsh+TNsAhQCQu2XG8ZoI9Z9rqyI44HppuzGxHHM:1bRTTngZBgw3GvWGoqZ92yVG/uzGNVa
- TLSH T1CC06D06BA26902FCD4BFD178C9165907EBB1780943A096DF06E057A62F63BE04F3E711
- MD5 SHA1 SHA512 SSDEEP TLSH
Score7/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.