General
- Target 2026-08-03_cb89efe42ee17d7d6e81ae2749f5ee85_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc
- Size 1.3MB
- Sample260803-cmp8dawflh
- SHA256 a58e960020dd56eb5ee58d6099877b57db29b764bc03fce972fd135a766fd279
- MD5 cb89efe42ee17d7d6e81ae2749f5ee85
- SHA1 d883b2d0488ef391a0dbec177f7063764e89fdc5
- SHA512 5ea152b8028e44c8383926a80a42f21d8d04263ef185a514a5453e81a5054b43f4bd12cb1d8883288a05d7aaed707012b9264fe8213ad5e87aa40bba0b571de1
- SSDEEP 24576:4+8TJ3p8epZzS3z13Pem1n9Xozsr8zbhN6GwXOGIh4:KOemBmmXXozsr8zlLwJIh
- TLSH T1F655AD646A0409BCEBF1B638DBDA421193A13D52037655CF13D47F8A3E37ED2AE7A211
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-03_cb89efe42ee17d7d6e81ae2749f5ee85_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe
Resource
win10v2004-20260513-en
16 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-03_cb89efe42ee17d7d6e81ae2749f5ee85_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc
- Size 1.3MB
- SHA256 a58e960020dd56eb5ee58d6099877b57db29b764bc03fce972fd135a766fd279
- MD5 cb89efe42ee17d7d6e81ae2749f5ee85
- SHA1 d883b2d0488ef391a0dbec177f7063764e89fdc5
- SHA512 5ea152b8028e44c8383926a80a42f21d8d04263ef185a514a5453e81a5054b43f4bd12cb1d8883288a05d7aaed707012b9264fe8213ad5e87aa40bba0b571de1
- SSDEEP 24576:4+8TJ3p8epZzS3z13Pem1n9Xozsr8zbhN6GwXOGIh4:KOemBmmXXozsr8zlLwJIh
- TLSH T1F655AD646A0409BCEBF1B638DBDA421193A13D52037655CF13D47F8A3E37ED2AE7A211
- MD5 SHA1 SHA512 SSDEEP TLSH
Score7/10-
Executes dropped EXE
-
Creates a large amount of network flows
This may indicate a network scan to discover remotely running services.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops file in System32 directory
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1