coffloader | 7c491b8c127d288c15682c3084a17778035dc921e5aea6ebd995e77152f46f5d

General

Target
2026-06-29_fab5dfabb17e55cabfc38b6f5d92287b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc
Size 2.6MB
Sample260630-bdb4qact8j
SHA256 7c491b8c127d288c15682c3084a17778035dc921e5aea6ebd995e77152f46f5d
MD5 fab5dfabb17e55cabfc38b6f5d92287b
SHA1 e7ed19c83e657395acbeff1a1c1f428a0c7b8616
SHA512 2a04c203447692c2eab2303bf863c8090e5f0c04b637208a3764b86aa2d79cb5485bbeefc3e344c47519572061a1fc2891f80b94967f2030e807a828ca063d04
SSDEEP 24576:z2MzTw7qIJIAUXFkAHWJv0FLd4Cba2EBTbe2GUm66Jz9/lG3T8uaQ+HUYP0/Ys:zJWJIAUXFNL+jCK3/+T
TLSH
T1FFD5C646E77680E1D4BAC1398612A627FCB1389DC378A7DB8B514B565F22BE0DE3D340
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-06-29_fab5dfabb17e55cabfc38b6f5d92287b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc
- Size 2.6MB
- SHA256 7c491b8c127d288c15682c3084a17778035dc921e5aea6ebd995e77152f46f5d
- MD5 fab5dfabb17e55cabfc38b6f5d92287b
- SHA1 e7ed19c83e657395acbeff1a1c1f428a0c7b8616
- SHA512 2a04c203447692c2eab2303bf863c8090e5f0c04b637208a3764b86aa2d79cb5485bbeefc3e344c47519572061a1fc2891f80b94967f2030e807a828ca063d04
- SSDEEP 24576:z2MzTw7qIJIAUXFkAHWJv0FLd4Cba2EBTbe2GUm66Jz9/lG3T8uaQ+HUYP0/Ys:zJWJIAUXFNL+jCK3/+T
- TLSH
  T1FFD5C646E77680E1D4BAC1398612A627FCB1389DC378A7DB8B514B565F22BE0DE3D340
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

credential_access defense_evasion execution spyware stealer trojan
- Suspicious use of NtCreateProcessExOtherParentProcess
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Reads WinSCP keys stored on the system
  Tries to access WinSCP stored sessions.
  spyware stealer
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Windows security modification
  defense_evasion trojan
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
behavioral1 behavioral2