General
- Target 2026-05-06_1d4cfd65a5f29386e1fb0c621d9979a5_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc
- Size 874KB
- Sample260506-lwk5fsey5v
- SHA256 6f0a24fda266cdd0238d82280c7ef21f96e14816a5a6eeb9c9960b22becb03e7
- MD5 1d4cfd65a5f29386e1fb0c621d9979a5
- SHA1 8369420c2706c3f76f786e7ed8b32bf87590ca45
- SHA512 64c3afae962ee811675e2861acfbb71847593e736096dfb14a03b350fbec4ea1827c9432bf04e571ecd3b247eea4eee8685b1fd8c17c0ef6c54f812e4898f15d
- SSDEEP 12288:2raG3vgFDcme0Z3Jm19O49TChi+yOPGN1sK/j9ivQ0obQ2vpfj4flmDxcTgKpNEv:un/8e0ZYfoGN1sKLoIhQ2
- TLSH T1CD155D1AE66800BDD0B7C6B4CE665D43D771F84A03706ADB03D05AA63F277E49A3EB11
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
3 signatures
Behavioral task
behavioral1
Sample
2026-05-06_1d4cfd65a5f29386e1fb0c621d9979a5_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe
Resource
win10v2004-20260130-en
6 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-05-06_1d4cfd65a5f29386e1fb0c621d9979a5_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc
- Size 874KB
- SHA256 6f0a24fda266cdd0238d82280c7ef21f96e14816a5a6eeb9c9960b22becb03e7
- MD5 1d4cfd65a5f29386e1fb0c621d9979a5
- SHA1 8369420c2706c3f76f786e7ed8b32bf87590ca45
- SHA512 64c3afae962ee811675e2861acfbb71847593e736096dfb14a03b350fbec4ea1827c9432bf04e571ecd3b247eea4eee8685b1fd8c17c0ef6c54f812e4898f15d
- SSDEEP 12288:2raG3vgFDcme0Z3Jm19O49TChi+yOPGN1sK/j9ivQ0obQ2vpfj4flmDxcTgKpNEv:un/8e0ZYfoGN1sKLoIhQ2
- TLSH T1CD155D1AE66800BDD0B7C6B4CE665D43D771F84A03706ADB03D05AA63F277E49A3EB11
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.