General
- Target 2026-07-07_9f7fff48b9258b5fb4a218bac6f9627a_glassworm_icedid_luca-stealer_njrat_stealc
- Size 2.1MB
- Sample260707-h65easct61
- SHA256 8ba2a3311b49394817aa1320b5172e163be1e0f8edd6ea27b2a07ac2eeb6a719
Malware Config
Targets
-
- Target 2026-07-07_9f7fff48b9258b5fb4a218bac6f9627a_glassworm_icedid_luca-stealer_njrat_stealc
- Size 2.1MB
- SHA256 8ba2a3311b49394817aa1320b5172e163be1e0f8edd6ea27b2a07ac2eeb6a719
Score10/10Detects Coffloader
Family: Coffloader
Coffloader is an open-source beacon loader written in C.
Windows security bypass
- Custom signature
Detects Windows executables referencing non-Windows User-Agents
- Custom signature
Detects executables referencing many IR and analysis tools
Command and Scripting Interpreter: PowerShell
Run Powershell and hide display window.
Event Triggered Execution: Component Object Model Hijacking
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
Executes dropped EXE
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
Registers new Windows logon scripts automatically executed at logon.
Windows security modification
Adds Run key to start application
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
Suspicious use of NtSetInformationThreadHideFromDebugger
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Boot or Logon Initialization Scripts
1Logon Script (Windows)
1Event Triggered Execution
1Component Object Model Hijacking
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Boot or Logon Initialization Scripts
1Logon Script (Windows)
1Event Triggered Execution
1Component Object Model Hijacking
1