General
- Target 2026-07-10_d753d03c2768399d114127d2d1d22f13_cryptbot_glassworm_icedid_luca-stealer_njrat_stealc
- Size 81.2MB
- Sample260710-1rdbdadz3x
- SHA256 81d9e4116eedb6dec8455913dc1bbb385fc9a50c42f310e5ef29c7524442f0a3
Score
10/10
Malware Config
Targets
-
- Target 2026-07-10_d753d03c2768399d114127d2d1d22f13_cryptbot_glassworm_icedid_luca-stealer_njrat_stealc
- Size 81.2MB
- SHA256 81d9e4116eedb6dec8455913dc1bbb385fc9a50c42f310e5ef29c7524442f0a3
Score9/10-
Detect binaries embedding considerable number of MFA browser extension IDs.
-
Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.
-
Badlisted process makes network request
Network request originating from process or tool commonly abused by malware.
-
Command and Scripting Interpreter: PowerShell
Powershell Invoke Web Request.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Indicator Removal: File Deletion
Adversaries may delete files left behind by the actions of their intrusion activity.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.