Hostile 92% Download

2026-10-01_3771a87c695f83d38ac99fe53ecd4266_icedid_njrat_stealc

Native loader invokes PowerShell to add Defender exclusionsUnsigned dual persistence plus Defender exclusion
SHA-256e0e69f387d17c722f58d4978032002d1b7f28163127050bb1139d83015c7234f
URLhttps://tria.ge/api/v0/samples/261002-t8knfszy4r/sample
MaleculeK(Mc₂)O₈(C₇Er₄P₅CoDy₄As₅EuPr)H₈(Cm₆Db₄F₁₂Hf₃Mg₂Os₁₆Po₁₆Ti)Md₄(Bi₁₀PaSi)

Evidence

Native admin protocol file-modification packet 0x196f80–0x197270
⋯7 more rows
0x196ff000e7164001000000846e174001000000[email protected].@....
0x197000507c1740010000000000000000000000P|.@............
0x1970100000000000000000e48a144001000000...........@....
0x197020bcd51840010000000000000000000000...@............
0x1970300000000000000000d44e164001000000.........N.@....
0x197040785d174001000000c428154001000000x].@.....(.@....
0x19705000000000000000000000000000000000................
0x19706000000000000000000000000000000000................
0x19707000000000000000000000000000000000................
0x197080081f1c4001000000201e004001000000...@.... ..@....
0x197090a01e004001000000c01e004001000000...@.......@....
0x1970a04044004001000000001f004001000000@D.@.......@....
0x1970b0801e1c4001000000a01f004001000000...@.......@....
0x1970c0a01e004001000000c01e004001000000...@.......@....
0x1970d0601f004001000000001f004001000000`..@.......@....
0x1970e0f81d1c40010000003020004001000000[email protected] .@....
0x1970f0a01e004001000000c01e004001000000...@.......@....
0x197100f01f004001000000001f004001000000...@.......@....
0x197110701d1c40010000002021004001000000p..@.... !.@....
0x197120a01e004001000000c01e004001000000...@.......@....
0x197130e0200040010000008020004001000000. .@..... .@....
0x197140e81c1c40010000007023004001000000[email protected]#.@....
0x197150d0210040010000000022004001000000.!.@.....".@....
0x19716020230040010000005022004001000000 #[email protected]".@....
0x197170581c1c40010000001024004001000000X..@.....$.@....
0x197180303c004001000000403c0040010000000<.@....@<.@....
0x197190d023004001000000503c004001000000.#[email protected]<.@....
0x1971a000000000ffffffffffffffff28000000............(...
0x1971b00a000000ffffffffffffffff20000000............ ...
0x1971c013000000ffffffffffffffff20000000............ ...
0x1971d01c000000ffffffffffffffff30000000............0...
0x1971e025000000ffffffffffffffff20000000%........... ...
0x1971f02e000000ffffffffffffffff20000000............ ...
0x19720037000000ffffffffffffffff200000007........... ...
0x19721040000000ffffffffffffffff28000000@...........(...
0x1972204a000000ffffffffffffffff28000000J...........(...
0x19723054000000ffffffffffffffff28000000T...........(...
0x1972405e000000ffffffffffffffff20000000^........... ...
0x19725067000000ffffffffffffffff18000000g...............
0x19726070000000ffffffffffffffff18000000p...............
0x19727079000000ffffffffffffffff18000000y...............
Add-MpPreference command option prefix 0x19d458–0x19d748
⋯7 more rows
0x19d4c86f006c00650000005365727669636500o.l.e...Service.
0x19d4d8636d642e657865202f43202200000000cmd.exe /C "....
0x19d4e825642f25642f25642025643a25640000%d/%d/%d %d:%d..
0x19d4f84661696c656420746f206f70656e2066Failed to open f
0x19d508696c653a20000000f30f000000000000ile: ...........
0x19d518433a5c57696e646f77735c5379737465C:\Windows\Syste
0x19d5286d33325c636d642e6578650065786973m32\cmd.exe.exis
0x19d5387473000000000000720075006e006100ts......r.u.n.a.
0x19d54873000000000000007363687461736b73s.......schtasks
0x19d558202f5175657279202f544e2022506565 /Query /TN "Pee
0x19d5687243726561746f722200000000000000rCreator".......
0x19d57822202f66203e6e756c20323e6e756c00" /f >nul 2>nul.
0x19d58800000000000000007265672061646420........reg add
0x19d59822484b43555c536f6674776172655c4d"HKCU\Software\M
0x19d5a86963726f736f66745c57696e646f7773icrosoft\Windows
0x19d5b85c43757272656e7456657273696f6e5c\CurrentVersion\
0x19d5c852756e22202f76205065657243726561Run" /v PeerCrea
0x19d5d8746f72202f74205245475f535a202f64tor /t REG_SZ /d
0x19d5e8202200000000000022202f5343204f4e "......" /SC ON
0x19d5f84c4f474f4e202f524c20484947484553LOGON /RL HIGHES
0x19d60854202f46203e6e756c20323e6e756c00T /F >nul 2>nul.
0x19d6187363687461736b73202f437265617465schtasks /Create
0x19d628202f544e20225065657243726561746f /TN "PeerCreato
0x19d6387222202f545220220000000000000000r" /TR "........
0x19d6480000000000000000706f776572736865........powershe
0x19d6586c6c202d436f6d6d616e642022416464ll -Command "Add
0x19d6682d4d70507265666572656e6365202d45-MpPreference -E
0x19d67878636c7573696f6e506174682024656exclusionPath $en
0x19d688763a4150504441544122000000000000v:APPDATA"......
0x19d6985c50656572536572766963655c506565\PeerService\Pee
0x19d6a872536572766963652e65786500000000rService.exe....
0x19d6b800000000000000007265672061646420........reg add
⋯9 more rows
Enumerate installed system locales 0x1b36c0–0x1b37f0
⋯5 more rows
0x1b37107472696e67457800020000000f000000tringEx.........
0x1b3720456e756d53797374656d4c6f63616c65EnumSystemLocale
0x1b37307345780000000000000000000f000000sEx.............
0x1b374047657444617465466f726d6174457800GetDateFormatEx.
⋯11 more rows
WS2_32 Winsock DLL import 0x1e777e–0x1e789e
⋯5 more rows
0x1e77cea5006672656561646472696e666f0000..freeaddrinfo..
0x1e77de5753325f33322e646c6c00004f004d46WS2_32.dll..O.MF
0x1e77ee456e756d446576696365536f75726365EnumDeviceSource
⋯11 more rows
Binary imports ADVAPI32.dll 0x1e7e54–0x1e8044
0x1e7e546174655265736f757263655700009d05ateResourceW....
0x1e7e64536c656570001b024765744375727265Sleep...GetCurre
0x1e7e746e744469726563746f72795700007f01ntDirectoryW....
0x1e7e8446696e64436c6f7365008a0146696e64FindClose...Find
0x1e7e94466972737446696c6557000096014669FirstFileW....Fi
⋯4 more rows
0x1e7ee4756d446973706c61794d6f6e69746f72umDisplayMonitor
0x1e7ef47300110353656e64496e70757400c801s...SendInput...
0x1e7f0447657453797374656d4d657472696373GetSystemMetrics
0x1e7f14000068024c6f6164537472696e675700..h.LoadStringW.
0x1e7f245553455233322e646c6c00004c015348USER32.dll..L.SH
0x1e7f34476574466f6c64657250617468410000GetFolderPathA..
0x1e7f44ac015368656c6c457865637574654100..ShellExecuteA.
0x1e7f54af015368656c6c457865637574654578..ShellExecuteEx
0x1e7f6457005348454c4c33322e646c6c007a01W.SHELL32.dll.z.
0x1e7f74476574557365724e616d654100002000GetUserNameA.. .
0x1e7f84416c6c6f63617465416e64496e697469AllocateAndIniti
0x1e7f94616c697a6553696400005f0043686563alizeSid.._.Chec
0x1e7fa46b546f6b656e4d656d62657273686970kTokenMembership
0x1e7fb400003401467265655369640041445641..4.FreeSid.ADVA
0x1e7fc4504933322e646c6c0000b001466f726dPI32.dll....Form
0x1e7fd461744d657373616765410000df034c6fatMessageA....Lo
⋯7 more rows

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.