06ae2f39134f1bec68f34e6e0d14271fd87d54425a2e87d5bfdf39a10b7a58f2

General

Target
2026-07-29_6092c380332af86dd4a8c0b2a2e07ac5_glassworm_icedid_luca-stealer_njrat
Size 4.4MB
Sample260729-2lmtastgkd
SHA256 06ae2f39134f1bec68f34e6e0d14271fd87d54425a2e87d5bfdf39a10b7a58f2
MD5 6092c380332af86dd4a8c0b2a2e07ac5
SHA1 b54c92eb6aada547806e5ddd1a6efffb97603c42
SHA512 cb4884bd4bcc083c4020c48095dd2b38199f3184b1cc3cf2b18f8922be738654d2f0b2fa4c6d3c0ecd5447e1d76de5becb3d9c248c3f769ce6bb32839f5682e5
SSDEEP 98304:AuWhEDPyTyUJ6vORttlsSP92ftyk98fN4wgOpPOWPAXqQ8oILPsT2Czs:nDQpPvZQ8rbsT2U
TLSH
T117268D47E3A480E9D4ABC179C60B9237E7B2F8491635BB9B13D45F662F23B606B1D310
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-07-29_6092c380332af86dd4a8c0b2a2e07ac5_glassworm_icedid_luca-stealer_njrat
- Size 4.4MB
- SHA256 06ae2f39134f1bec68f34e6e0d14271fd87d54425a2e87d5bfdf39a10b7a58f2
- MD5 6092c380332af86dd4a8c0b2a2e07ac5
- SHA1 b54c92eb6aada547806e5ddd1a6efffb97603c42
- SHA512 cb4884bd4bcc083c4020c48095dd2b38199f3184b1cc3cf2b18f8922be738654d2f0b2fa4c6d3c0ecd5447e1d76de5becb3d9c248c3f769ce6bb32839f5682e5
- SSDEEP 98304:AuWhEDPyTyUJ6vORttlsSP92ftyk98fN4wgOpPOWPAXqQ8oILPsT2Czs:nDQpPvZQ8rbsT2U
- TLSH
  T117268D47E3A480E9D4ABC179C60B9237E7B2F8491635BB9B13D45F662F23B606B1D310
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

credential_access discovery execution persistence privilege_escalation spyware stealer
- Detects executables containing SQL queries to confidential data stores. Observed in infostealers
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Command and Scripting Interpreter: PowerShell
  Powershell Invoke Web Request.
  execution
- Loads dropped DLL
- Reads ssh keys stored on the system
  Tries to access SSH used by SSH programs.
  spyware stealer
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
behavioral1 behavioral2