General
- Target 2026-05-22_f089b61aabea687709e1128a6258a3da_glassworm_icedid_luca-stealer_njrat
- Size 2.1MB
- Sample260523-aahxesbt2z
- SHA256 7c36e0b9268defbea30674a6f8590cb53b92699bafbe7d231fa374bf0b41c35b
Score
10/10
Malware Config
Targets
-
- Target 2026-05-22_f089b61aabea687709e1128a6258a3da_glassworm_icedid_luca-stealer_njrat
- Size 2.1MB
- SHA256 7c36e0b9268defbea30674a6f8590cb53b92699bafbe7d231fa374bf0b41c35b
Score10/10-
Suspicious use of NtCreateUserProcessOtherParentProcess
-
Detect binaries embedding considerable number of MFA browser extension IDs.
-
Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.
-
Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers
-
Detects command variations typically used by ransomware
-
Detects executables containing SQL queries to confidential data stores. Observed in infostealers
-
Detects executables containing artifacts associated with disabling Widnows Defender
-
Detects executables embedding registry key / value combination indicative of disabling Windows Defen
-
Detects executables referencing many Password Manager software clients. Observed in infostealers
-
Detects executables referencing many email and collaboration clients. Observed in information steale
-
Badlisted process makes network request
Network request originating from process or tool commonly abused by malware.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Reads WinSCP keys stored on the system
Tries to access WinSCP stored sessions.
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Registers new Windows logon scripts automatically executed at logon.
-
Accesses Microsoft Outlook profiles
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.