bff3583d04f0d5603ced9831eb7c45c1923bd90e2f7d5e5d2b32942d38cf6dc5

General

Target
2026-07-09_adb441372f365dcb1e59bcfc37a4ade8_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc
Size 1.5MB
Sample260709-mcnlxahv2s
SHA256 bff3583d04f0d5603ced9831eb7c45c1923bd90e2f7d5e5d2b32942d38cf6dc5
MD5 adb441372f365dcb1e59bcfc37a4ade8
SHA1 798e0fc22b1646783fa65f1cc692fde635c0e5a8
SHA512 09e76e7233bad0aa86a739062f54acd3fb58c236a839fd0f7f58d4f88429601a7c37d4b0f2336428ceec3623767628c2c6ac6b2ba0000f1cfd67c6faf5c94a6b
SSDEEP 24576:rkSjUdxt7Bmu5tihZk90dYhdtY6KvzQK2SnJAXvaCKq2FqieO:DjK7DtiSQYhdq6cL1J4aCHk
TLSH
T15E658D5BE66400BCD0ABC2B8CE565913EB7378594335AAEF07D0C9621F177E18A3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-07-09_adb441372f365dcb1e59bcfc37a4ade8_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc
- Size 1.5MB
- SHA256 bff3583d04f0d5603ced9831eb7c45c1923bd90e2f7d5e5d2b32942d38cf6dc5
- MD5 adb441372f365dcb1e59bcfc37a4ade8
- SHA1 798e0fc22b1646783fa65f1cc692fde635c0e5a8
- SHA512 09e76e7233bad0aa86a739062f54acd3fb58c236a839fd0f7f58d4f88429601a7c37d4b0f2336428ceec3623767628c2c6ac6b2ba0000f1cfd67c6faf5c94a6b
- SSDEEP 24576:rkSjUdxt7Bmu5tihZk90dYhdtY6KvzQK2SnJAXvaCKq2FqieO:DjK7DtiSQYhdq6cL1J4aCHk
- TLSH
  T15E658D5BE66400BCD0ABC2B8CE565913EB7378594335AAEF07D0C9621F177E18A3EB11
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware collection discovery persistence ransomware spyware stealer
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Reads WinSCP keys stored on the system
  Tries to access WinSCP stored sessions.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral1 behavioral2