Extracted

• • Target
    2026-04-09_68e0700a55d5ebf47bbb963509bb3d21_amadey_cobalt-strike_elex_glassworm_luca-stealer_lynx_njrat
  • Size 930KB
  • SHA256 bb724c4456df4ae98ae541ad3e6ae51e230c9d43428653a87a9e1d6daa3ad619
  • MD5 68e0700a55d5ebf47bbb963509bb3d21
  • SHA1 1a153c994f29e5840efae0c4756e86a672dcec6f
  • SHA512 82a9f5182c9739cdca630b9f6c0989b12991eb1dcec074356f0b6e528b2bcc3b02fe503deec37e82d3b22716e0e75a82159b102aa79dc9a1c4541d6cc4bf80c4
  • SSDEEP 12288:S4XnYeuNN5J2OTLoCeWL1Jer5+n0A1Yfer:jnYJNAGURdA
  • TLSH
    T1A9153863EB818AE9E65E04365FA48154972EF121AB0F6361795C130DCF5338B8F66E3C
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  credential_accessdiscoveryxehookspywarestealer

  • Detect Xehook Payload

  • Xehook family

    xehook

  • Xehook stealer

    Xehook is an infostealer written in C#.

    stealerxehook

  • Detect binaries embedding considerable number of MFA browser extension IDs.

  • Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.

  • Detects executables referencing many confidential data stores found in browsers, mail clients, crypt

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Suspicious use of SetThreadContext

  behavioral1behavioral2