General
- Target 2026-09-10_0f7f2876dbcdfcea9b9b657b8a0b93ba_icedid_njrat
- Size 2.0MB
- Sample260910-yqglasvgqc
- SHA256 a296c3c35efd77ec0ce03f7f00bb6ac986e4dbc3cc6d80dd8398c998157f637e
- MD5 0f7f2876dbcdfcea9b9b657b8a0b93ba
- SHA1 3ea1871a382ccb424d1200f0c511b149d8652410
- SHA512 11d53b193d8a652af2bf956c11f953ef2045bbff75b7b2497faedc7caebd2daf093a89603f5d3839d714478d57da88ac1d9e94e55849f25270419a443f6ab9bc
- SSDEEP 12288:8HQKiUdWvYKJ84XJV/9aQJWsqIkZeAFhMw4SteLHg6x6FUiXhXUap3YQS9b8dx0X:8w4Wv3J84XJlOtCAxFLUap6baiX
- TLSH T121A5D64BFBB611D1E4BAC13CE552322AFC7134A6833897D792859A0A5B70BE4ED3D740
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2026-09-10_0f7f2876dbcdfcea9b9b657b8a0b93ba_icedid_njrat.exe
Resource
win10v2004-20260513-en
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-09-10_0f7f2876dbcdfcea9b9b657b8a0b93ba_icedid_njrat.exe
Resource
win11ltsc2024-20260709-en
4 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-09-10_0f7f2876dbcdfcea9b9b657b8a0b93ba_icedid_njrat
- Size 2.0MB
- SHA256 a296c3c35efd77ec0ce03f7f00bb6ac986e4dbc3cc6d80dd8398c998157f637e
- MD5 0f7f2876dbcdfcea9b9b657b8a0b93ba
- SHA1 3ea1871a382ccb424d1200f0c511b149d8652410
- SHA512 11d53b193d8a652af2bf956c11f953ef2045bbff75b7b2497faedc7caebd2daf093a89603f5d3839d714478d57da88ac1d9e94e55849f25270419a443f6ab9bc
- SSDEEP 12288:8HQKiUdWvYKJ84XJV/9aQJWsqIkZeAFhMw4SteLHg6x6FUiXhXUap3YQS9b8dx0X:8w4Wv3J84XJlOtCAxFLUap6baiX
- TLSH T121A5D64BFBB611D1E4BAC13CE552322AFC7134A6833897D792859A0A5B70BE4ED3D740
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10-
Detects executables Discord URL observed in first stage droppers
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes a VBScript file via the Windows Script Host.