bbf011d4d08f381096c6038cccf86fac46ab6809682cf0acf3484b24f7533968

General

Target
2026-08-02_1b2df99df41259a011675746ab92327c_cobalt-strike_icedid_luca-stealer_ngrbot_njrat_stealc
Size 465KB
Sample260802-k1622sfr2y
SHA256 bbf011d4d08f381096c6038cccf86fac46ab6809682cf0acf3484b24f7533968
MD5 1b2df99df41259a011675746ab92327c
SHA1 2c1b686344dc59e9bb5c9b259b7c30b2d5e6db44
SHA512 a7b87769267f12b85864698e311fdf7cecef72c13c7c0b0c1733664d4ba0533921afc771664aeeb1067c0ebb42a025ef7565430143297b22d8accfd509112f7c
SSDEEP 6144:sMnuwrn2uwRkd9Oe574y39DwMCntISSMOiMBiJ4e1b4QbPvf2KyZNsAV2PyKCGxm:s0eRGmnzKV2404Sve7sAV2qLGxB+
TLSH
T1ADA46D29A69805F9F067C17CCA978D02E772780A0775DEEF07949A721F276D08E3DB12
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-08-02_1b2df99df41259a011675746ab92327c_cobalt-strike_icedid_luca-stealer_ngrbot_njrat_stealc
- Size 465KB
- SHA256 bbf011d4d08f381096c6038cccf86fac46ab6809682cf0acf3484b24f7533968
- MD5 1b2df99df41259a011675746ab92327c
- SHA1 2c1b686344dc59e9bb5c9b259b7c30b2d5e6db44
- SHA512 a7b87769267f12b85864698e311fdf7cecef72c13c7c0b0c1733664d4ba0533921afc771664aeeb1067c0ebb42a025ef7565430143297b22d8accfd509112f7c
- SSDEEP 6144:sMnuwrn2uwRkd9Oe574y39DwMCntISSMOiMBiJ4e1b4QbPvf2KyZNsAV2PyKCGxm:s0eRGmnzKV2404Sve7sAV2qLGxB+
- TLSH
  T1ADA46D29A69805F9F067C17CCA978D02E772780A0775DEEF07949A721F276D08E3DB12
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

defense_evasion discovery spyware stealer
- Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers
- Detects executables containing possible sandbox analysis VM names
- Detects executables containing possible sandbox analysis VM usernames
- Detects executables containing possible sandbox system UUIDs
- Drops file in Drivers directory
- Deletes itself
- Executes dropped EXE
- Modifies file permissions
  discovery
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- Hide Artifacts: Hidden Files and Directories
  defense_evasion
behavioral1 behavioral2