ddadb0a034068f1509c63646558dc76b73b5ea8f9df6297e39e31947234e97aa

General

Target
2026-07-09_9c852e05375c93fd9fe017a737950111_cobalt-strike_glassworm_icedid_njrat_redline-stealer_stealc
Size 508KB
Sample260709-j283csfw4v
SHA256 ddadb0a034068f1509c63646558dc76b73b5ea8f9df6297e39e31947234e97aa
MD5 9c852e05375c93fd9fe017a737950111
SHA1 bf66a67e5ee2ab92b15dbeee219b7da71eb986f9
SHA512 1f70c7e43fdd5fd926762b88810b8b8436596ef6aa428fd47946b2d9aae5709f914eac52d145677abb349587510451835c1e21b96425690aef5e5f6ac26eec71
SSDEEP 6144:S+0JDsbAqTa+kcg5ckbjIfSSlAz9JEKn1qB786LD5mCeF5ef0KgQOvh0h2FOkKc:yDsnEOSS8gijNzQO6Oecb0jZqd
TLSH
T104B47C58B3E81969F2BF863CD8630505D7B2B8165722E7CF1B9415E92F337C09A39722
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-07-09_9c852e05375c93fd9fe017a737950111_cobalt-strike_glassworm_icedid_njrat_redline-stealer_stealc
- Size 508KB
- SHA256 ddadb0a034068f1509c63646558dc76b73b5ea8f9df6297e39e31947234e97aa
- MD5 9c852e05375c93fd9fe017a737950111
- SHA1 bf66a67e5ee2ab92b15dbeee219b7da71eb986f9
- SHA512 1f70c7e43fdd5fd926762b88810b8b8436596ef6aa428fd47946b2d9aae5709f914eac52d145677abb349587510451835c1e21b96425690aef5e5f6ac26eec71
- SSDEEP 6144:S+0JDsbAqTa+kcg5ckbjIfSSlAz9JEKn1qB786LD5mCeF5ef0KgQOvh0h2FOkKc:yDsnEOSS8gijNzQO6Oecb0jZqd
- TLSH
  T104B47C58B3E81969F2BF863CD8630505D7B2B8165722E7CF1B9415E92F337C09A39722
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

collection credential_access spyware stealer adware persistence ransomware
- Detect binaries embedding considerable number of MFA browser extension IDs.
- Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.
- Detects executables referencing many confidential data stores found in browsers, mail clients, crypt
- Detects executables using Telegram Chat Bot
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Reads WinSCP keys stored on the system
  Tries to access WinSCP stored sessions.
  spyware stealer
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Accesses Microsoft Outlook profiles
  collection
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral1 behavioral2