General
- Target 2026-07-31_6d27a7c7328101bd409568a3fd25e9e6_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc
- Size 879KB
- Sample260731-nwct7aswcz
- SHA256 31ba12e230d90e464b920163bd1f71a0901fb6d8a2628d3f17c3ebd76cd60229
- MD5 6d27a7c7328101bd409568a3fd25e9e6
- SHA1 ecd78e71696e45800f44ef0bf50c559883e317fe
- SHA512 db3bc7d5f64770b0bec8e59c1a48ff679f41b89ed0f0faa0de26736ab3fd465a155c595591b69cd743a98aed8a84b43391b9e59f0d1846d25f3493183b2fc500
- SSDEEP 12288:1TdsKDjxeLC76MCzJiZ9t2HECnaD8v0kooVZubKBY/7EN4+MjpU2vpfj5flmDxcx:1KUF76MCEf6aeHZubKBYYm/pU2zX
- TLSH T1F4156C16A66400BDE0B7C6B4CE665D43E771B84B0370AADB03D05EA63F277D45A3EB12
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Behavioral task
behavioral1
Sample
2026-07-31_6d27a7c7328101bd409568a3fd25e9e6_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe
Resource
win10v2004-20260513-en
6 signatures
150 seconds
Malware Config
Extracted
Family
-
blakcsee_stealer
C2
-
94.183.168.16
Targets
-
- Target 2026-07-31_6d27a7c7328101bd409568a3fd25e9e6_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc
- Size 879KB
- SHA256 31ba12e230d90e464b920163bd1f71a0901fb6d8a2628d3f17c3ebd76cd60229
- MD5 6d27a7c7328101bd409568a3fd25e9e6
- SHA1 ecd78e71696e45800f44ef0bf50c559883e317fe
- SHA512 db3bc7d5f64770b0bec8e59c1a48ff679f41b89ed0f0faa0de26736ab3fd465a155c595591b69cd743a98aed8a84b43391b9e59f0d1846d25f3493183b2fc500
- SSDEEP 12288:1TdsKDjxeLC76MCzJiZ9t2HECnaD8v0kooVZubKBY/7EN4+MjpU2vpfj5flmDxcx:1KUF76MCEf6aeHZubKBYYm/pU2zX
- TLSH T1F4156C16A66400BDE0B7C6B4CE665D43E771B84B0370AADB03D05EA63F277D45A3EB12
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1