General
- Target 2026-08-23_201deb45d4d65a6c65cc9d4bb280bf1e_icedid_luca-stealer_njrat_stealc
- Size 1.5MB
- Sample260824-tcxcdawvds
- SHA256 1a9ded4fb936d2a0c71609224482f9031693f0ed27f314943a17262c6b9e7a95
- MD5 201deb45d4d65a6c65cc9d4bb280bf1e
- SHA1 a0a08ab1577acf92c747c6e827cccf06b4f2fc73
- SHA512 df4cdbc79a1dacb047c7ee24fabb3b6a4a2d2e3bf98a6371d2120fa7d7d1287739cfa315ab4e46ff86c84edcfb85d6d7917a62981a27ac6902e4578153d79a9e
- SSDEEP 24576:LzupmFDOfyDPyyMJk5ExxLDc3HpJgseStYCbClMYh8keS8hz4ol34/wC:vug4fWPJbWxxX6HpJgseSuC++1z4qewC
- TLSH T17765021FA7A809FDE177C675CD429902E676BC054B60AA9F03904DE70F736A05E3E362
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
2026-08-23_201deb45d4d65a6c65cc9d4bb280bf1e_icedid_luca-stealer_njrat_stealc.exe
Resource
win10v2004-20260513-en
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-23_201deb45d4d65a6c65cc9d4bb280bf1e_icedid_luca-stealer_njrat_stealc.exe
Resource
win11ltsc2024-20260709-en
4 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-23_201deb45d4d65a6c65cc9d4bb280bf1e_icedid_luca-stealer_njrat_stealc
- Size 1.5MB
- SHA256 1a9ded4fb936d2a0c71609224482f9031693f0ed27f314943a17262c6b9e7a95
- MD5 201deb45d4d65a6c65cc9d4bb280bf1e
- SHA1 a0a08ab1577acf92c747c6e827cccf06b4f2fc73
- SHA512 df4cdbc79a1dacb047c7ee24fabb3b6a4a2d2e3bf98a6371d2120fa7d7d1287739cfa315ab4e46ff86c84edcfb85d6d7917a62981a27ac6902e4578153d79a9e
- SSDEEP 24576:LzupmFDOfyDPyyMJk5ExxLDc3HpJgseStYCbClMYh8keS8hz4ol34/wC:vug4fWPJbWxxX6HpJgseSuC++1z4qewC
- TLSH T17765021FA7A809FDE177C675CD429902E676BC054B60AA9F03904DE70F736A05E3E362
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detects executables Discord URL observed in first stage droppers
-
UPX dump on OEP (original entry point)
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.