9f5183b3d2f4edc35eadff3671e837436b323676735d16fe576d2cfca43fd1a5

General

Target
2026-06-25_b9e4d5b31bca7e97e55083f688ed533f_cobalt-strike_elex_glassworm_icedid_luca-stealer_njrat
Size 746KB
Sample260629-yy2lfaev3z
SHA256 9f5183b3d2f4edc35eadff3671e837436b323676735d16fe576d2cfca43fd1a5
MD5 b9e4d5b31bca7e97e55083f688ed533f
SHA1 360091f9e2526503fd6522ca1002da28ad09d96f
SHA512 52db168615593ef75850fcaadd3d6a6de374f92cd350c10f3b6cec1f612a1cf8ebc40cf7cd033e6fc155ad010b4fec655a36a7a1f2e94d86cc03cdfdd354aa3b
SSDEEP 12288:u9CflJ16DPMpLy3OzQdyBxjbCFroh3l+C6E0+:u9CtGMLy3OzQdyXbCFQl+CN0+
TLSH
T1F5F47C24B3F405A4F1FF9B75D4B18422CA71B84A9A34CB8F159882AE0E73791DD74B63
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-06-25_b9e4d5b31bca7e97e55083f688ed533f_cobalt-strike_elex_glassworm_icedid_luca-stealer_njrat
- Size 746KB
- SHA256 9f5183b3d2f4edc35eadff3671e837436b323676735d16fe576d2cfca43fd1a5
- MD5 b9e4d5b31bca7e97e55083f688ed533f
- SHA1 360091f9e2526503fd6522ca1002da28ad09d96f
- SHA512 52db168615593ef75850fcaadd3d6a6de374f92cd350c10f3b6cec1f612a1cf8ebc40cf7cd033e6fc155ad010b4fec655a36a7a1f2e94d86cc03cdfdd354aa3b
- SSDEEP 12288:u9CflJ16DPMpLy3OzQdyBxjbCFroh3l+C6E0+:u9CtGMLy3OzQdyXbCFQl+CN0+
- TLSH
  T1F5F47C24B3F405A4F1FF9B75D4B18422CA71B84A9A34CB8F159882AE0E73791DD74B63
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

collection credential_access defense_evasion discovery spyware stealer
- Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.
- Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers
- Detects executables containing possible sandbox analysis VM names
- Detects executables containing possible sandbox analysis VM usernames
- Detects executables embedding registry key / value combination indicative of disabling Windows Defen
- Detects executables referencing many confidential data stores found in browsers, mail clients, crypt
- Disables Task Manager via registry modification
  defense_evasion
- Uses browser remote debugging
  Can be used control the browser and steal sensitive information such as credentials and session cookies.
  credential_access stealer
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
behavioral1 behavioral2