2c65e34c3bd83ea0263a134f897629d7c19a4566bfd109a41ff33ada43dc2584

General

Target
2026-07-15_846d5ca31c478f213b03229cbe3df74d_cobalt-strike_elex_glassworm_icedid_luca-stealer_njrat
Size 746KB
Sample260716-b48klsdz3v
SHA256 2c65e34c3bd83ea0263a134f897629d7c19a4566bfd109a41ff33ada43dc2584
MD5 846d5ca31c478f213b03229cbe3df74d
SHA1 e580684906d8419e0ae7fe4616a43461a22aea39
SHA512 7006de8ff9c34efc2bb0bc26c96fea2e6d9a37ef66775ae2d1ccd4221c264f7c32aa03c039553930e1813de8770211ac722985b9ef23e88d5654bc71dea641e6
SSDEEP 12288:X9CU0fce5KCjMppy3OzQdyBxjbCFroh3l+C6E0+:X9CFTJMpy3OzQdyXbCFQl+CN0+
TLSH
T1CFF47C28B3F405A4F1FF9B75D4B18522CA71B84B9A34CB8F1598829E0E737919D34B63
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-07-15_846d5ca31c478f213b03229cbe3df74d_cobalt-strike_elex_glassworm_icedid_luca-stealer_njrat
- Size 746KB
- SHA256 2c65e34c3bd83ea0263a134f897629d7c19a4566bfd109a41ff33ada43dc2584
- MD5 846d5ca31c478f213b03229cbe3df74d
- SHA1 e580684906d8419e0ae7fe4616a43461a22aea39
- SHA512 7006de8ff9c34efc2bb0bc26c96fea2e6d9a37ef66775ae2d1ccd4221c264f7c32aa03c039553930e1813de8770211ac722985b9ef23e88d5654bc71dea641e6
- SSDEEP 12288:X9CU0fce5KCjMppy3OzQdyBxjbCFroh3l+C6E0+:X9CFTJMpy3OzQdyXbCFQl+CN0+
- TLSH
  T1CFF47C28B3F405A4F1FF9B75D4B18522CA71B84B9A34CB8F1598829E0E737919D34B63
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

collection credential_access discovery spyware stealer
- Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.
- Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers
- Detects executables Discord URL observed in first stage droppers
- Detects executables containing possible sandbox analysis VM names
- Detects executables containing possible sandbox analysis VM usernames
- Detects executables embedding registry key / value combination indicative of disabling Windows Defen
- Detects executables referencing many confidential data stores found in browsers, mail clients, crypt
- Uses browser remote debugging
  Can be used control the browser and steal sensitive information such as credentials and session cookies.
  credential_access stealer
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral1 behavioral2