General
- Target 2026-07-09_d7f7041cd39217211ea4bfb5ab70d6e5_cobalt-strike_elex_glassworm_gobot_icedid_njrat
- Size 804KB
- Sample260709-ttbr1adt6m
- SHA256 e8a32716241a1530b3b32bd316453ebeec82b47dc8a428a4beab015c86464195
- MD5 d7f7041cd39217211ea4bfb5ab70d6e5
- SHA1 c873483a521c749953bfdbadb86f6820b64b7ce3
- SHA512 0496e674b7d4d744e9b507ed5085fdf5d1e04cb1755231ab76ff1783db15c78cc04fd97b5ceb5c673a70d2f8f0f89b032721f74f69c21d384f2e8727ffad6c14
- SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouP:0NA1Yakeer5+nsoS
- TLSH T18F05A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-09_d7f7041cd39217211ea4bfb5ab70d6e5_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
Resource
win10v2004-20260513-en
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-09_d7f7041cd39217211ea4bfb5ab70d6e5_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
Resource
win11ltsc2024-20260709-en
7 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-09_d7f7041cd39217211ea4bfb5ab70d6e5_cobalt-strike_elex_glassworm_gobot_icedid_njrat
- Size 804KB
- SHA256 e8a32716241a1530b3b32bd316453ebeec82b47dc8a428a4beab015c86464195
- MD5 d7f7041cd39217211ea4bfb5ab70d6e5
- SHA1 c873483a521c749953bfdbadb86f6820b64b7ce3
- SHA512 0496e674b7d4d744e9b507ed5085fdf5d1e04cb1755231ab76ff1783db15c78cc04fd97b5ceb5c673a70d2f8f0f89b032721f74f69c21d384f2e8727ffad6c14
- SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouP:0NA1Yakeer5+nsoS
- TLSH T18F05A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10-
Contacts a large (1942) amount of remote hosts
This may indicate a network scan to discover remotely running services.
-
Executes dropped EXE
-
Adds Run key to start application
-
Creates a large amount of network flows
This may indicate a network scan to discover remotely running services.