General
- Target 2026-06-26_802bc17adb93ba7583fe5fbeab41f57f_cobalt-strike_glassworm_icedid_luca-stealer_njrat_stealc
- Size 751KB
- Sample260629-rx4abafx9w
- SHA256 ed678ba16bacdd965068901dc92f70baff99888ceb8d15d7ff480ddad798f73e
- MD5 802bc17adb93ba7583fe5fbeab41f57f
- SHA1 9f9d3302f82731bba48d988df2febfd8b9a8707e
- SHA512 c6c958918e85cc6483a7ec0d8df4ba3a01a9860cdadc8a6571f00c5139bac066bfd2018572218f80a6811ae29dda97eccc9ca95ca5d67675e9ddd81e6f7f9592
- SSDEEP 12288:MwO9OmQRCB1ny+FCiTbS8r05P9TT7JgVGXZs6O+IvtYvE+UH7fuSG:zmQRCB1yOfS2IVzrWz+Nq6
- TLSH T1E3F47D5BA7A4017CE1BBD178CF574902F6B1B84943706ADF07D08AA62F336E09A7E711
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
7 signatures
Behavioral task
behavioral1
Sample
2026-06-26_802bc17adb93ba7583fe5fbeab41f57f_cobalt-strike_glassworm_icedid_luca-stealer_njrat_stealc.exe
Resource
win10v2004-20260513-en
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-06-26_802bc17adb93ba7583fe5fbeab41f57f_cobalt-strike_glassworm_icedid_luca-stealer_njrat_stealc.exe
Resource
win11ltsc2024-20260629-en
6 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-06-26_802bc17adb93ba7583fe5fbeab41f57f_cobalt-strike_glassworm_icedid_luca-stealer_njrat_stealc
- Size 751KB
- SHA256 ed678ba16bacdd965068901dc92f70baff99888ceb8d15d7ff480ddad798f73e
- MD5 802bc17adb93ba7583fe5fbeab41f57f
- SHA1 9f9d3302f82731bba48d988df2febfd8b9a8707e
- SHA512 c6c958918e85cc6483a7ec0d8df4ba3a01a9860cdadc8a6571f00c5139bac066bfd2018572218f80a6811ae29dda97eccc9ca95ca5d67675e9ddd81e6f7f9592
- SSDEEP 12288:MwO9OmQRCB1ny+FCiTbS8r05P9TT7JgVGXZs6O+IvtYvE+UH7fuSG:zmQRCB1yOfS2IVzrWz+Nq6
- TLSH T1E3F47D5BA7A4017CE1BBD178CF574902F6B1B84943706ADF07D08AA62F336E09A7E711
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10-
Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.
-
Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers
-
Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion
-
Detects command variations typically used by ransomware
-
Detects executables embedding command execution via IExecuteCommand COM object
-
Detects ransomware indicator