Analysis
- max time kernel
148s - max time network
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
21/08/2026, 02:00
Static task
static1
4 signatures
Behavioral task
behavioral1
Sample
2026-08-21_1bd096cf1ead5bba792a664a456d8560_icedid_luca-stealer_njrat_stealc.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-21_1bd096cf1ead5bba792a664a456d8560_icedid_luca-stealer_njrat_stealc.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
General
- Target 2026-08-21_1bd096cf1ead5bba792a664a456d8560_icedid_luca-stealer_njrat_stealc.exe
- Size 1.2MB
- Sample260821-cfcnpsep7y
- SHA256 b36e256ad43c45578390029ba3f6da52942414ce56742b29fa8f37aeb4368bf3
- MD5 1bd096cf1ead5bba792a664a456d8560
- SHA1 2fbf93cf6634ccebc794c6b4a6cb2f00b669e0e4
- SHA512 5bdf893efa48f8468cacf599f544ed3ba155bf97bfb707631b41f98f1cd7c4c8e705246d4c355376051e99ad64ce9ee1cf898e01a1feb3eba3044926ff6bf8d7
- SSDEEP 24576:lb4YOMpC2b/Vd9m02aoElLldATPi1KOBiTnmKSj2:ltOMwqd20CwfATP9xTnlS2
- TLSH T1C7458D52B6E440A9E0B7D134D9A2560BEA7178871330AEDF27DC055C2F737D04A7EBA2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
Malware Config
Signatures
- Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
flow ioc 1 raw.githubusercontent.com 2 raw.githubusercontent.com - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3312 2026-08-21_1bd096cf1ead5bba792a664a456d8560_icedid_luca-stealer_njrat_stealc.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3312 2026-08-21_1bd096cf1ead5bba792a664a456d8560_icedid_luca-stealer_njrat_stealc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-21_1bd096cf1ead5bba792a664a456d8560_icedid_luca-stealer_njrat_stealc.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-21_1bd096cf1ead5bba792a664a456d8560_icedid_luca-stealer_njrat_stealc.exe"1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:3312
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\.jod_identity.png
- Size 4.1MB
- SHA256 21d3081a3db34a987c87097016f002ceede6abe32752b59c17e7f32bb1239c24
- MD5 ccd304539076a6e33e6ddbb1e53d2217
- SHA1 c4d8df327396f226e6a2638be8ef718ef13bb8c6
- SHA512 e1e1b91514027c0cbd1788e807cad655c22d8d4e1698a5f6a79514c046261652126e70f864b7969774da937a0e4f385435d9a5c0c20d34c67947f5e603907eae
- SSDEEP 98304:03CvSjfmVHgFzaR8DWz6FOYNfEUvA0uQkg5nhVu4o/TW:M8qOAG6E6fEUvAzeBhGrW
- TLSH T12B1633C18CC5B4F6D997897E48343545C2EDA634AB76B8E03863E5C8BD9D1E68B63F00
- MD5 SHA1 SHA512 SSDEEP TLSH