coffloader | 2175fdeeeabb327f4ec7b842763d0b06246c5016f39dc3b3744fab32e779d93f

General

Target
2026-06-04_52aa7e71d78a07da3ea7335b5a798fb7_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc
Size 2.1MB
Sample260604-2nalragt5y
SHA256 2175fdeeeabb327f4ec7b842763d0b06246c5016f39dc3b3744fab32e779d93f
MD5 52aa7e71d78a07da3ea7335b5a798fb7
SHA1 82d71e448671c521b08235a6e047c0d2438fe574
SHA512 45e82f3937d335415c43c1ecb8445f33d49895de1ea89698ae50a280be587e5b73297747dffb02fd9b12e59daf4e877e0d69b307f1d229cb10a0fae803e6fbf6
SSDEEP 49152:IseEA7kO9WrsrIoplpD6aY+icF2QYFkfcA30b4g:QF++DBG4
TLSH
T154A5901762B800ECE277C1BCC9565A07D7B2F41613756BDB06908A962F27AE10FFE721
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-06-04_52aa7e71d78a07da3ea7335b5a798fb7_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc
- Size 2.1MB
- SHA256 2175fdeeeabb327f4ec7b842763d0b06246c5016f39dc3b3744fab32e779d93f
- MD5 52aa7e71d78a07da3ea7335b5a798fb7
- SHA1 82d71e448671c521b08235a6e047c0d2438fe574
- SHA512 45e82f3937d335415c43c1ecb8445f33d49895de1ea89698ae50a280be587e5b73297747dffb02fd9b12e59daf4e877e0d69b307f1d229cb10a0fae803e6fbf6
- SSDEEP 49152:IseEA7kO9WrsrIoplpD6aY+icF2QYFkfcA30b4g:QF++DBG4
- TLSH
  T154A5901762B800ECE277C1BCC9565A07D7B2F41613756BDB06908A962F27AE10FFE721
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution coffloader loader persistence privilege_escalation spyware stealer trojan
- Detects Coffloader
- Family: Coffloader
  Coffloader is an open-source beacon loader written in C.
  loader coffloader
- Windows security bypass
  defense_evasion trojan
- Detects Windows executables referencing non-Windows User-Agents
- Detects executables referencing many IR and analysis tools
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Registers new Windows logon scripts automatically executed at logon.
  persistence
- Windows security modification
  defense_evasion trojan
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2