c09e13a04f548595edf0f71f2d8d0f3a6538251557c54bdc75efc145ceb95b9e

General

Target
2026-07-10_7cd44f06fef816b4f0b96c7716cd904f_agent-tesla_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc
Size 5.6MB
Sample260710-gs5bpsdz6r
SHA256 c09e13a04f548595edf0f71f2d8d0f3a6538251557c54bdc75efc145ceb95b9e
MD5 7cd44f06fef816b4f0b96c7716cd904f
SHA1 4ae3eb639ac79d5d02b7100b498f1f484b656fc5
SHA512 6341f98af298eb6484425c3b7ea3f0b8b8102af7335fc335456bf1fefe9fd3f9ac8e015b8e7138b65e1030d15fffff660700dc32901c3bf208517473a168fa5b
SSDEEP 49152:zRZb90wMwgGIj5oq6jZWpcvqC2Sud21qCmM1NgsmQ29W5U3PKP3JLKIBDXNtQnzv:dZ/6FgqbpCm39WJknHxor4F0d
TLSH
T18556BF46B3A840DCD072D1BC865BA603D372385507206BEB33D09A6A2F77AD45FBE791
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware spyware

Malware Config

Targets

- Target
  2026-07-10_7cd44f06fef816b4f0b96c7716cd904f_agent-tesla_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc
- Size 5.6MB
- SHA256 c09e13a04f548595edf0f71f2d8d0f3a6538251557c54bdc75efc145ceb95b9e
- MD5 7cd44f06fef816b4f0b96c7716cd904f
- SHA1 4ae3eb639ac79d5d02b7100b498f1f484b656fc5
- SHA512 6341f98af298eb6484425c3b7ea3f0b8b8102af7335fc335456bf1fefe9fd3f9ac8e015b8e7138b65e1030d15fffff660700dc32901c3bf208517473a168fa5b
- SSDEEP 49152:zRZb90wMwgGIj5oq6jZWpcvqC2Sud21qCmM1NgsmQ29W5U3PKP3JLKIBDXNtQnzv:dZ/6FgqbpCm39WJknHxor4F0d
- TLSH
  T18556BF46B3A840DCD072D1BC865BA603D372385507206BEB33D09A6A2F77AD45FBE791
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

adware spyware
- Detects executables (downlaoders) containing URLs to raw contents of a paste
- Detects executables containing commands for clearing Windows Event Logs
- Detects executables referencing many IR and analysis tools
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Drops desktop.ini file(s)
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Detects executables (downlaoders) containing URLs to raw contents of a paste

Detects executables containing commands for clearing Windows Event Logs

Detects executables referencing many IR and analysis tools

Checks computer location settings

Executes dropped EXE

Drops desktop.ini file(s)

Looks up external IP address via web service

Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2