General
- Target 2026-05-18_7d2ebc199a8ad08f3a1e02884394448d_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc
- Size 874KB
- Sample260518-mg5e8aev2l
- SHA256 bd77e5598f47d4bbc59e5b19a0f9e43702ab6b551c0e80b02534bfbc977649f4
- MD5 7d2ebc199a8ad08f3a1e02884394448d
- SHA1 54d810af0f817a5f86f36ffa5ed610694de982f3
- SHA512 d3989adf74f8b139734e147e3460a30e0b40297fc4b5fa891bfbf6de20723717baeb4897da9c8a0974a5d66e5f075586580af271e1e8172461220b11f22739c3
- SSDEEP 12288:O9KG6EwibnUchC97UlCiYUZshreupPVNMe1R/OiMWAYNs2vpfj4flmDxcTgKpNE+:U3zqchwucVNMe1RXDHs2c
- TLSH T161156D1AE66800BDD0B7C6B4CE665D43D771B84B03705ADB03D05AA63F277E49A3EB11
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
3 signatures
Behavioral task
behavioral1
Sample
2026-05-18_7d2ebc199a8ad08f3a1e02884394448d_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe
Resource
win10v2004-20260513-en
6 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-05-18_7d2ebc199a8ad08f3a1e02884394448d_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc
- Size 874KB
- SHA256 bd77e5598f47d4bbc59e5b19a0f9e43702ab6b551c0e80b02534bfbc977649f4
- MD5 7d2ebc199a8ad08f3a1e02884394448d
- SHA1 54d810af0f817a5f86f36ffa5ed610694de982f3
- SHA512 d3989adf74f8b139734e147e3460a30e0b40297fc4b5fa891bfbf6de20723717baeb4897da9c8a0974a5d66e5f075586580af271e1e8172461220b11f22739c3
- SSDEEP 12288:O9KG6EwibnUchC97UlCiYUZshreupPVNMe1R/OiMWAYNs2vpfj4flmDxcTgKpNE+:U3zqchwucVNMe1RXDHs2c
- TLSH T161156D1AE66800BDD0B7C6B4CE665D43D771B84B03705ADB03D05AA63F277E49A3EB11
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.