General
- Target 2026-08-20_88bcf5aab47e8ba0ba64f25c2406ba33_icedid_luca-stealer_njrat_stealc
- Size 5.7MB
- Sample260820-pgp2msbr6s
- SHA256 09d562838a75b503b609b5e96d178ae356cac57607e387e8e474578baf7ebf04
- MD5 88bcf5aab47e8ba0ba64f25c2406ba33
- SHA1 a59bf50d2834a810c6d8756eef77d09cfb8ab16c
- SHA512 607f739f6fcc36af770b4ea640d910b175640a930f0826b6e3e1d6075839e254e25da8dd86be57b50f4243aa669f250c3501243d898012869666de69e03abc29
- SSDEEP 98304:Jtp8rwdbFrSLN0dSJKeKbWnvVTnPo4RwRj0BN7ySSbL3sUiy3viOQ:JvHZGRQSJPegtfSjSRZwh
- TLSH T192562346B2F401FCE07B9D79C98A9A07EB757818036059DF13D409952FA77E09BBA313
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-20_88bcf5aab47e8ba0ba64f25c2406ba33_icedid_luca-stealer_njrat_stealc.exe
Resource
win10v2004-20260513-en
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-20_88bcf5aab47e8ba0ba64f25c2406ba33_icedid_luca-stealer_njrat_stealc.exe
Resource
win11ltsc2024-20260709-en
9 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-20_88bcf5aab47e8ba0ba64f25c2406ba33_icedid_luca-stealer_njrat_stealc
- Size 5.7MB
- SHA256 09d562838a75b503b609b5e96d178ae356cac57607e387e8e474578baf7ebf04
- MD5 88bcf5aab47e8ba0ba64f25c2406ba33
- SHA1 a59bf50d2834a810c6d8756eef77d09cfb8ab16c
- SHA512 607f739f6fcc36af770b4ea640d910b175640a930f0826b6e3e1d6075839e254e25da8dd86be57b50f4243aa669f250c3501243d898012869666de69e03abc29
- SSDEEP 98304:Jtp8rwdbFrSLN0dSJKeKbWnvVTnPo4RwRj0BN7ySSbL3sUiy3viOQ:JvHZGRQSJPegtfSjSRZwh
- TLSH T192562346B2F401FCE07B9D79C98A9A07EB757818036059DF13D409952FA77E09BBA313
- MD5 SHA1 SHA512 SSDEEP TLSH
Score8/10-
Downloads MZ/PE file
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Executes dropped EXE
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.