Analysis
- max time kernel
150s - max time network
115s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
21/08/2026, 01:58
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-21_2cc4d5be874b626b2fadd749b7f9bb47_icedid_stealc.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-21_2cc4d5be874b626b2fadd749b7f9bb47_icedid_stealc.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
General
- Target 2026-08-21_2cc4d5be874b626b2fadd749b7f9bb47_icedid_stealc.exe
- Size 6.1MB
- Sample260821-cd6trshb23
- SHA256 9cfbc8235dc69bd323d1426ecdad559baefdeb71fe735abd040f9b475fafc0b8
- MD5 2cc4d5be874b626b2fadd749b7f9bb47
- SHA1 705c155c931ec7f06514903cef437749f7e1d5d9
- SHA512 75a7460dd65500a9dfa8e192f7de25054dcc27fd7c3728d74c9c3ffc0f50f8f29bc2f1ad1429ec17c59bfcb020bf99112451934e18cbfdc4bc61efa4a4ec7462
- SSDEEP 49152:dnP5LW+SBmG1JYCzI72bHsC+V2NLrfqZyLfRRRGkXpm6fRd47+IO0mSlbmx+:ifRd47ZO0FlbmQ
- TLSH T1F956CF0779988A49C10260BE1BCE79E8C733B9AAC0874447B65BFBB96C572F14D1787C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 7 IoCs
resource yara_rule behavioral2/memory/3920-7-0x0000000180000000-0x000000018030F000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs behavioral2/memory/3920-11-0x0000000180000000-0x000000018030F000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs behavioral2/memory/3920-12-0x0000000180000000-0x000000018030F000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs behavioral2/memory/3920-10-0x0000000180000000-0x000000018030F000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs behavioral2/memory/3920-9-0x0000000180000000-0x000000018030F000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs behavioral2/memory/3920-8-0x0000000180000000-0x000000018030F000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs behavioral2/memory/3920-0-0x0000000180000000-0x000000018030F000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs - Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 7 IoCs
resource yara_rule behavioral2/memory/3920-7-0x0000000180000000-0x000000018030F000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/3920-11-0x0000000180000000-0x000000018030F000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/3920-12-0x0000000180000000-0x000000018030F000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/3920-10-0x0000000180000000-0x000000018030F000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/3920-9-0x0000000180000000-0x000000018030F000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/3920-8-0x0000000180000000-0x000000018030F000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/3920-0-0x0000000180000000-0x000000018030F000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers - Detects executables containing SQL queries to confidential data stores. Observed in infostealers 7 IoCs
resource yara_rule behavioral2/memory/3920-7-0x0000000180000000-0x000000018030F000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral2/memory/3920-11-0x0000000180000000-0x000000018030F000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral2/memory/3920-12-0x0000000180000000-0x000000018030F000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral2/memory/3920-10-0x0000000180000000-0x000000018030F000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral2/memory/3920-9-0x0000000180000000-0x000000018030F000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral2/memory/3920-8-0x0000000180000000-0x000000018030F000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral2/memory/3920-0-0x0000000180000000-0x000000018030F000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore