General
- Target 2026-10-10_2688dd9d319b2eff0364fba7c082034b_icedid_luca-stealer_njrat
- Size 58.4MB
- Sample261011-xa9fpseg56
- SHA256 cb29c63493284a2c08bee8a93d171640d5283fb9273be682b02043ff5566a970
- MD5 2688dd9d319b2eff0364fba7c082034b
- SHA1 269e3fec7e3ebe8f9f2cf7e87685a461b8d03a2b
- SHA512 3495095c1c311f1715573c683d4d3e2e16e369f7a96987763ad7cd03fc3703d084d50c95b21e4c61c049834ace39b9b5c176c0bc15ca79648b0b052bea39c086
- SSDEEP 98304:siUiAwxALHg6tJCQrBH3Z1DfwLDCXvfXK20c/2QKFLODsWxbCf5k8TM/eehqgPOz:siUiTxALHg3QL1rvi21uLqwW84o
- TLSH T1FBD7CC98C6CB123FCD762CB85F3CE34EDA5A47A893245785687E5E8413712A51BE0EF0
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
3 signatures
Behavioral task
behavioral1
Sample
2026-10-10_2688dd9d319b2eff0364fba7c082034b_icedid_luca-stealer_njrat.exe
Resource
win10v2004-20260911-en
6 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-10-10_2688dd9d319b2eff0364fba7c082034b_icedid_luca-stealer_njrat
- Size 58.4MB
- SHA256 cb29c63493284a2c08bee8a93d171640d5283fb9273be682b02043ff5566a970
- MD5 2688dd9d319b2eff0364fba7c082034b
- SHA1 269e3fec7e3ebe8f9f2cf7e87685a461b8d03a2b
- SHA512 3495095c1c311f1715573c683d4d3e2e16e369f7a96987763ad7cd03fc3703d084d50c95b21e4c61c049834ace39b9b5c176c0bc15ca79648b0b052bea39c086
- SSDEEP 98304:siUiAwxALHg6tJCQrBH3Z1DfwLDCXvfXK20c/2QKFLODsWxbCf5k8TM/eehqgPOz:siUiTxALHg3QL1rvi21uLqwW84o
- TLSH T1FBD7CC98C6CB123FCD762CB85F3CE34EDA5A47A893245785687E5E8413712A51BE0EF0
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1