500d429539494b3b8dc0069e8a6cd55b67d910a6155407fed62cad5db7871975

General

Target
2026-07-15_27b9227f21ac36a3b79a7ce971bcd218_cobalt-strike_elex_glassworm_icedid_luca-stealer_njrat
Size 746KB
Sample260715-s7vxcsbs7t
SHA256 500d429539494b3b8dc0069e8a6cd55b67d910a6155407fed62cad5db7871975
MD5 27b9227f21ac36a3b79a7ce971bcd218
SHA1 101ba3f2ada6c6c96fd5d18a0076b34c845ce499
SHA512 f4f12be1de238399c0a9e47485727277ea99a6fccbe2a7b1e12672ff492f23c224a2770da25be7adf69f3872a85981cacca9b9122960deec8bffe1e770ff3432
SSDEEP 12288:v9Czsyd5cHs1Mpyy3OzQdyBxjbCFroh3l+C6E0+:v9C5AAMyy3OzQdyXbCFQl+CN0+
TLSH
T144F47C24B3F405A4F1FF9B75D4B18422DA71B84A9A34CB8F159882AE0E33791DD74B63
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-07-15_27b9227f21ac36a3b79a7ce971bcd218_cobalt-strike_elex_glassworm_icedid_luca-stealer_njrat
- Size 746KB
- SHA256 500d429539494b3b8dc0069e8a6cd55b67d910a6155407fed62cad5db7871975
- MD5 27b9227f21ac36a3b79a7ce971bcd218
- SHA1 101ba3f2ada6c6c96fd5d18a0076b34c845ce499
- SHA512 f4f12be1de238399c0a9e47485727277ea99a6fccbe2a7b1e12672ff492f23c224a2770da25be7adf69f3872a85981cacca9b9122960deec8bffe1e770ff3432
- SSDEEP 12288:v9Czsyd5cHs1Mpyy3OzQdyBxjbCFroh3l+C6E0+:v9C5AAMyy3OzQdyXbCFQl+CN0+
- TLSH
  T144F47C24B3F405A4F1FF9B75D4B18422DA71B84A9A34CB8F159882AE0E33791DD74B63
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

collection credential_access discovery spyware stealer
- Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.
- Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers
- Detects executables containing possible sandbox analysis VM names
- Detects executables containing possible sandbox analysis VM usernames
- Detects executables embedding registry key / value combination indicative of disabling Windows Defen
- Detects executables referencing many confidential data stores found in browsers, mail clients, crypt
- Uses browser remote debugging
  Can be used control the browser and steal sensitive information such as credentials and session cookies.
  credential_access stealer
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral1 behavioral2