General
- Target 2026-11-06_ca5c6ebe2b374a59d359a57ff7591e15_icedid_stealc
- Size 29.1MB
- Sample261107-3fc8cawtas
- SHA256 bf2409e99816638c603599faec3c4171e853ec1f7a3218cd2448a12266964dc4
Score
10/10
Malware Config
Targets
-
- Target 2026-11-06_ca5c6ebe2b374a59d359a57ff7591e15_icedid_stealc
- Size 29.1MB
- SHA256 bf2409e99816638c603599faec3c4171e853ec1f7a3218cd2448a12266964dc4
Score10/10Family: RuRAT
RuRAT is a remote admin tool sold as legitimate software but regularly abused in malicious phishing campaigns.
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
Creates a file in the Startup directory
A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
Executes dropped EXE
Loads dropped DLL
Badlisted process makes network request
Network request originating from process or tool commonly abused by malware.
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
Drops file in System32 directory
MITRE ATT&CK Enterprise v16
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Modify Registry
1Subvert Trust Controls
1Install Root Certificate
1