General
- Target 2026-07-31_888f33ae921678e97c4842e128d2b7fb_cobalt-strike_elex_glassworm_gobot_icedid_njrat
- Size 804KB
- Sample260731-gcd5ksvekc
- SHA256 d59ebaee8cacf430a2df2f21bf80dd1aae81aab6b0ea956ac80e78bea7808098
- MD5 888f33ae921678e97c4842e128d2b7fb
- SHA1 8815457223293a797de2d4964360ee750fe1c802
- SHA512 890c75697d0df5adbee38398d7a0c0036b13d9ebe52fa281d52008d50822b3ecefb5c112a1bf62fb2635d6567d03c33f0739c35f031c091fdc5d4ce65bb40ad3
- SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouN:0NA1Yakeer5+nsoy
- TLSH T15E05A4A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-31_888f33ae921678e97c4842e128d2b7fb_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
Resource
win10v2004-20260513-en
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-31_888f33ae921678e97c4842e128d2b7fb_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
Resource
win11ltsc2024-20260709-en
7 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-31_888f33ae921678e97c4842e128d2b7fb_cobalt-strike_elex_glassworm_gobot_icedid_njrat
- Size 804KB
- SHA256 d59ebaee8cacf430a2df2f21bf80dd1aae81aab6b0ea956ac80e78bea7808098
- MD5 888f33ae921678e97c4842e128d2b7fb
- SHA1 8815457223293a797de2d4964360ee750fe1c802
- SHA512 890c75697d0df5adbee38398d7a0c0036b13d9ebe52fa281d52008d50822b3ecefb5c112a1bf62fb2635d6567d03c33f0739c35f031c091fdc5d4ce65bb40ad3
- SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouN:0NA1Yakeer5+nsoy
- TLSH T15E05A4A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10-
Contacts a large (2150) amount of remote hosts
This may indicate a network scan to discover remotely running services.
-
Executes dropped EXE
-
Adds Run key to start application
-
Creates a large amount of network flows
This may indicate a network scan to discover remotely running services.