Extracted

• • Target
    2026-07-08_7a2eeb226f1d1ea0f537727d80349aad_cobalt-strike_elex_glassworm_icedid_luca-stealer_njrat
  • Size 746KB
  • SHA256 d438b08e52f5cc79cedda248f8d918b494a37c31cd12647afc9cc543fa61bf3e
  • MD5 7a2eeb226f1d1ea0f537727d80349aad
  • SHA1 c2b36d64da2f756546c8677e1a7c5d570e468aac
  • SHA512 d9e5562571456b7775a6fbaf94d64d65187ce0cc823fb03e5cf8389b1807b68402090574ebbebecb275530fa9fd89a329b44e2e92bb941fd999de11e294baaaf
  • SSDEEP 12288:59CtpzwBLUK1Mpwy3OzQdyBxjbCFroh3l+C6E0+:59C/5yMwy3OzQdyXbCFQl+CN0+
  • TLSH
    T107F47C24B3F405A4F1FF9B7594B18522CA71F84A9A34CB8F159882AE0E73791DD34B63
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectioncredential_accessdiscoveryspywarestealeradwarepersistenceransomware

  • Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.

  • Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers

  • Detects executables containing possible sandbox analysis VM names

  • Detects executables containing possible sandbox analysis VM usernames

  • Detects executables embedding registry key / value combination indicative of disabling Windows Defen

  • Detects executables referencing many confidential data stores found in browsers, mail clients, crypt

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Uses browser remote debugging

    Can be used control the browser and steal sensitive information such as credentials and session cookies.

    credential_accessstealer

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2