General
- Target 2026-11-13_2e820f0b6ca1dd282017f415fcec3f6e_icedid_luca-stealer_njrat_stealc
- Size 4.1MB
- Sample261114-vba87afv2m
- SHA256 6d5daea97acf82f1f388271e08403d1400faee4273033f280232e480c4b31a2c
- MD5 2e820f0b6ca1dd282017f415fcec3f6e
- SHA1 375075a0de8f0dd80f72ad19ac18caebc7aa8777
- SHA512 ab83790f9932e2b5b77e734708966bc2f57555c0cddb0b729d80e8552a95f27252a74dc0bf7daa18063b50645ff5e3622be93d83e07d6d5d4f10ab3697c4f23c
- SSDEEP 49152:z9cNEp1M3oN47m5YSSFYkOqOhlVt9256vPNU9z6Km1wfMIMAMNMoMkM:q7jeXLKu
- TLSH T1CF16BF5FA7A401E8D16BD078CF455943E7B2B41A03A1A7EF259086A70F776F40E3E722
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-11-13_2e820f0b6ca1dd282017f415fcec3f6e_icedid_luca-stealer_njrat_stealc.exe
Resource
win10v2004-20260911-en
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-11-13_2e820f0b6ca1dd282017f415fcec3f6e_icedid_luca-stealer_njrat_stealc.exe
Resource
win11ltsc2024-20260911-en
4 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-11-13_2e820f0b6ca1dd282017f415fcec3f6e_icedid_luca-stealer_njrat_stealc
- Size 4.1MB
- SHA256 6d5daea97acf82f1f388271e08403d1400faee4273033f280232e480c4b31a2c
- MD5 2e820f0b6ca1dd282017f415fcec3f6e
- SHA1 375075a0de8f0dd80f72ad19ac18caebc7aa8777
- SHA512 ab83790f9932e2b5b77e734708966bc2f57555c0cddb0b729d80e8552a95f27252a74dc0bf7daa18063b50645ff5e3622be93d83e07d6d5d4f10ab3697c4f23c
- SSDEEP 49152:z9cNEp1M3oN47m5YSSFYkOqOhlVt9256vPNU9z6Km1wfMIMAMNMoMkM:q7jeXLKu
- TLSH T1CF16BF5FA7A401E8D16BD078CF455943E7B2B41A03A1A7EF259086A70F776F40E3E722
- MD5 SHA1 SHA512 SSDEEP TLSH
Score10/10Detects DarkSideRAT
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
Suspicious use of SetThreadContext