General
- Target 2026-08-22_d91882a7ffdc0d3b9ef639438b498dd7_icedid_njrat_stealc
- Size 4.2MB
- Sample260822-29gbesvxds
- SHA256 2b1b87a4a224d221eed3a61473945a5a92769528732026b9ec1c5fd6e9ed709a
- MD5 d91882a7ffdc0d3b9ef639438b498dd7
- SHA1 90d8b14d78c070a5716c548d0216cf688dc47263
- SHA512 981de222798e4651dd996d078d0906ee84254b6773d50a45e4f8fa11e9c2e8967e6440283dc48aa4fac9cade126328d1a507a2ca327601ac9a8b687c5d3c461c
- SSDEEP 98304:vbRTTngZBgw3GXWGoqZ92yVG/uzGNV9HkAVHL/5:vbRTbYCw3fByQyVG/uzGNVyAl1
- TLSH T16116E06BA26901FCD0BFD1B8C9165907EBB1780943A096DF07E056A62F67BE04F3E711
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-22_d91882a7ffdc0d3b9ef639438b498dd7_icedid_njrat_stealc.exe
Resource
win10v2004-20260513-en
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-22_d91882a7ffdc0d3b9ef639438b498dd7_icedid_njrat_stealc.exe
Resource
win11ltsc2024-20260709-en
7 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-22_d91882a7ffdc0d3b9ef639438b498dd7_icedid_njrat_stealc
- Size 4.2MB
- SHA256 2b1b87a4a224d221eed3a61473945a5a92769528732026b9ec1c5fd6e9ed709a
- MD5 d91882a7ffdc0d3b9ef639438b498dd7
- SHA1 90d8b14d78c070a5716c548d0216cf688dc47263
- SHA512 981de222798e4651dd996d078d0906ee84254b6773d50a45e4f8fa11e9c2e8967e6440283dc48aa4fac9cade126328d1a507a2ca327601ac9a8b687c5d3c461c
- SSDEEP 98304:vbRTTngZBgw3GXWGoqZ92yVG/uzGNV9HkAVHL/5:vbRTbYCw3fByQyVG/uzGNVyAl1
- TLSH T16116E06BA26901FCD0BFD1B8C9165907EBB1780943A096DF07E056A62F67BE04F3E711
- MD5 SHA1 SHA512 SSDEEP TLSH
Score7/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.