dd2f4553f1fdf71c119c244c1c5b4cdbc95554a8c7c4f6aa986ca7b166cfddfc

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-31_301351e9761065bdeaf26cd397ad02c4_cobalt-strike_glassworm_icedid_njrat_satacom_stealc
Size 1.3MB
Sample260731-pcrdxaszay
SHA256 dd2f4553f1fdf71c119c244c1c5b4cdbc95554a8c7c4f6aa986ca7b166cfddfc
MD5 301351e9761065bdeaf26cd397ad02c4
SHA1 1c924f6ffb1f6374c569eb44ed5dbbe156f19503
SHA512 c72ce39f98c740b303980444611d3dccf35f6b09894c4cae2293bf357f6c6307a308883121f1c90fc3aa6853d3d84de410caee9c10acb3fc73bb093114296158
SSDEEP 24576:DN3wqrd1eKMvrjruts2ctE/bo8piJm1MB1vcAzRxvnfACgLE/:2qxgSS2cm/cI1MFRxvnj
TLSH
T1FD55CF55B2B441F8D27BE178C986960BFA723C8603309ADB13E805991F677F09EBE711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Language

Deobfuscated

Source

URLs

exe.dropper
http://badhacks.lol/AstralCore.pdb

Extracted

Language

Deobfuscated

Source

URLs

exe.dropper
http://badhacks.lol/AstralSDK.pdb

Extracted

Language

Deobfuscated

Source

URLs

exe.dropper
http://badhacks.lol/AstralCore.deps.json

Extracted

Language

Deobfuscated

Source

URLs

exe.dropper
http://badhacks.lol/Astral.Addons.Client.pdb

Extracted

Language

Deobfuscated

Source

URLs

exe.dropper
http://badhacks.lol/AstralCore.IL2CPP.dll

Extracted

Language

Deobfuscated

Source

URLs

exe.dropper
http://badhacks.lol/AstralCore.runtimeconfig.json

Extracted

Language

Deobfuscated

Source

URLs

exe.dropper
http://badhacks.lol/AstralSDK.dll

Extracted

Language

Deobfuscated

Source

URLs

exe.dropper
http://badhacks.lol/Iced.dll

Extracted

Language

Deobfuscated

Source

URLs

exe.dropper
http://badhacks.lol/AstralCore.IL2CPP.pdb

Extracted

Language

Deobfuscated

Source

URLs

exe.dropper
http://badhacks.lol/Astral.Addons.Client.dll

Extracted

Language

Deobfuscated

Source

URLs

exe.dropper
http://badhacks.lol/AstralCore.dll

Extracted

Language

Deobfuscated

Source

URLs

exe.dropper
http://badhacks.lol/Mono.Cecil.dll

Targets

- Target
  2026-07-31_301351e9761065bdeaf26cd397ad02c4_cobalt-strike_glassworm_icedid_njrat_satacom_stealc
- Size 1.3MB
- SHA256 dd2f4553f1fdf71c119c244c1c5b4cdbc95554a8c7c4f6aa986ca7b166cfddfc
- MD5 301351e9761065bdeaf26cd397ad02c4
- SHA1 1c924f6ffb1f6374c569eb44ed5dbbe156f19503
- SHA512 c72ce39f98c740b303980444611d3dccf35f6b09894c4cae2293bf357f6c6307a308883121f1c90fc3aa6853d3d84de410caee9c10acb3fc73bb093114296158
- SSDEEP 24576:DN3wqrd1eKMvrjruts2ctE/bo8piJm1MB1vcAzRxvnfACgLE/:2qxgSS2cm/cI1MFRxvnj
- TLSH
  T1FD55CF55B2B441F8D27BE178C986960BFA723C8603309ADB13E805991F677F09EBE711
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Downloads MZ/PE file
- Executes dropped EXE
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Targets

Badlisted process makes network request

Downloads MZ/PE file

Executes dropped EXE

Command and Scripting Interpreter: PowerShell

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2