c1dd188325bfb2d8ea2582bcb5dfd901deadc6881c256eb9a20f4ed48123ec5f

General

Target
2026-07-05_7b76ead2107d6e3c557fb3c30a60de70_cobalt-strike_elex_glassworm_icedid_luca-stealer_njrat
Size 746KB
Sample260705-l85dvsbx7z
SHA256 c1dd188325bfb2d8ea2582bcb5dfd901deadc6881c256eb9a20f4ed48123ec5f
MD5 7b76ead2107d6e3c557fb3c30a60de70
SHA1 40da371e147491cb13a13aa8d6b4a577561451be
SHA512 b7220923e2309941116bdaf8bc014bfc1d46becde0815bff01053b20c1c87aeedf3ed528d52af99122f8bd4f9de54be9d3f9801465dc0d73a5c3aec2d171f4ec
SSDEEP 12288:f9C9K2Y6OHvYz9Mp3y3OzQdyBxjbCFroh3l+C6E0+:f9CwcjM3y3OzQdyXbCFQl+CN0+
TLSH
T1BDF47C28B3F405A4F1FF9B75D4B18522CA71B84B9A34CB8F1598829E0E337919D74B63
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-07-05_7b76ead2107d6e3c557fb3c30a60de70_cobalt-strike_elex_glassworm_icedid_luca-stealer_njrat
- Size 746KB
- SHA256 c1dd188325bfb2d8ea2582bcb5dfd901deadc6881c256eb9a20f4ed48123ec5f
- MD5 7b76ead2107d6e3c557fb3c30a60de70
- SHA1 40da371e147491cb13a13aa8d6b4a577561451be
- SHA512 b7220923e2309941116bdaf8bc014bfc1d46becde0815bff01053b20c1c87aeedf3ed528d52af99122f8bd4f9de54be9d3f9801465dc0d73a5c3aec2d171f4ec
- SSDEEP 12288:f9C9K2Y6OHvYz9Mp3y3OzQdyBxjbCFroh3l+C6E0+:f9CwcjM3y3OzQdyXbCFQl+CN0+
- TLSH
  T1BDF47C28B3F405A4F1FF9B75D4B18522CA71B84B9A34CB8F1598829E0E337919D74B63
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

collection credential_access discovery spyware stealer
- Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.
- Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers
- Detects executables containing possible sandbox analysis VM names
- Detects executables containing possible sandbox analysis VM usernames
- Detects executables embedding registry key / value combination indicative of disabling Windows Defen
- Detects executables referencing many confidential data stores found in browsers, mail clients, crypt
- Uses browser remote debugging
  Can be used control the browser and steal sensitive information such as credentials and session cookies.
  credential_access stealer
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
behavioral1 behavioral2