General
- Target 2026-07-30_75045d72bc8a8aaeb52c8f54ef37269a_cobalt-strike_glassworm_icedid_mespinoza_njrat_ryuk
- Size 4.8MB
- Sample260730-3jvlsssvct
- SHA256 d7548a2242e4f259cff64459e52709c453746c23be25bde4a5d3750e357bb1c5
- MD5 75045d72bc8a8aaeb52c8f54ef37269a
- SHA1 b5e7eef5fb967a37f699cab047475cace5bc8131
- SHA512 c359c5cd9c1bb5892a447c5d3408e8ed531db402ec722f9b6fbd6bb22ffc9b7c13860602446878f4ab6e863ff51441cba034729d4ce4b94ad923a3207c1b1b63
- SSDEEP 98304:slCoXUVJtZ/XcF2FPJJsv6tWKFdu9Cg6oZLIX:slBXUVeiJsv6tWKFdu9Cgk
- TLSH T183367B6BB2A512A9D3B7C174C2931657D9727809CF30BADB026863951B376F05B3E338
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-30_75045d72bc8a8aaeb52c8f54ef37269a_cobalt-strike_glassworm_icedid_mespinoza_njrat_ryuk.exe
Resource
win10v2004-20260513-en
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-30_75045d72bc8a8aaeb52c8f54ef37269a_cobalt-strike_glassworm_icedid_mespinoza_njrat_ryuk.exe
Resource
win11ltsc2024-20260709-en
6 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-30_75045d72bc8a8aaeb52c8f54ef37269a_cobalt-strike_glassworm_icedid_mespinoza_njrat_ryuk
- Size 4.8MB
- SHA256 d7548a2242e4f259cff64459e52709c453746c23be25bde4a5d3750e357bb1c5
- MD5 75045d72bc8a8aaeb52c8f54ef37269a
- SHA1 b5e7eef5fb967a37f699cab047475cace5bc8131
- SHA512 c359c5cd9c1bb5892a447c5d3408e8ed531db402ec722f9b6fbd6bb22ffc9b7c13860602446878f4ab6e863ff51441cba034729d4ce4b94ad923a3207c1b1b63
- SSDEEP 98304:slCoXUVJtZ/XcF2FPJJsv6tWKFdu9Cg6oZLIX:slBXUVeiJsv6tWKFdu9Cgk
- TLSH T183367B6BB2A512A9D3B7C174C2931657D9727809CF30BADB026863951B376F05B3E338
- MD5 SHA1 SHA512 SSDEEP TLSH
Score7/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.