2026-08-04_e3fec5da19d56842af33def75e0cf651_cobalt-strike_elex_glassworm_icedid_luca-stealer_njrat_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-04_e3fec5da19d56842af33def75e0cf651_cobalt-strike_elex_glassworm_icedid_luca-stealer_njrat_stealc
Size 585KB
Sample260804-frlbrsdd75
SHA256 abcfc05a152466ea87684e78528ec2ee77532baecba26d1a928dca5e96024ea4
MD5 e3fec5da19d56842af33def75e0cf651
SHA1 0b076b6acc19ba27216642346bb2b7de957e4d66
SHA512 361fdd5c6d98ae4c28c90d449a7c507e2cb172079ebccd72f6fa7025483a8345377de844516e93004bdc611b8c9edf79a255ec57af50db8aa68c15c7bb374c17
SSDEEP 6144:tTQdVAUnt4AZu3Gl2g2R9+gcrzhL7m0dPu+1kEpacPWnV5MbrRLJdbQv7UEKnZ3H:t0bAUnqAZNgcrzYuG5h8sI9cD
TLSH
T113D46B49B3E80129F2BF8A7C98720545C7B1B8528B65E3DF0A9455D91E33BD0ED39B23
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detect binaries embedding considerable number of MFA browser extension IDs. 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_Binary_Embedded_MFA_Browser_Extension_IDs

Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_Binary_References_Browsers

Detects executables Discord URL observed in first stage droppers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_DiscordURL

Detects executables referencing many confidential data stores found in browsers, mail clients, crypt 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store

Detects executables using Telegram Chat Bot 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_TelegramChatBot

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-04_e3fec5da19d56842af33def75e0cf651_cobalt-strike_elex_glassworm_icedid_luca-stealer_njrat_stealc

File Explorer

2026-08-04_e3fec5da19d56842af33def75e0cf651_cobalt-strike_elex_glassworm_icedid_luca-stealer_njrat_stealc

.exe 585KB

2026-08-04_e3fec5da19d56842af33def75e0cf651_cobalt-strike_elex_glassworm_icedid_luca-stealer_njrat_stealc

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 abcfc05a152466ea87684e78528ec2ee77532baecba26d1a928dca5e96024ea4
MD5 e3fec5da19d56842af33def75e0cf651
SHA1 0b076b6acc19ba27216642346bb2b7de957e4d66
SHA512 361fdd5c6d98ae4c28c90d449a7c507e2cb172079ebccd72f6fa7025483a8345377de844516e93004bdc611b8c9edf79a255ec57af50db8aa68c15c7bb374c17
SSDEEP 6144:tTQdVAUnt4AZu3Gl2g2R9+gcrzhL7m0dPu+1kEpacPWnV5MbrRLJdbQv7UEKnZ3H:t0bAUnqAZNgcrzYuG5h8sI9cD
TLSH
T113D46B49B3E80129F2BF8A7C98720545C7B1B8528B65E3DF0A9455D91E33BD0ED39B23
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Detect binaries embedding considerable number of MFA browser extension IDs.
Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.
Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers
Detects executables Discord URL observed in first stage droppers
Detects executables referencing many confidential data stores found in browsers, mail clients, crypt
Detects executables using Telegram Chat Bot
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

604814

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

2026-08-04_e3fec5da19d56842af33def75e0cf651_cobalt-strike_elex_glassworm_icedid_luca-stealer_njrat_stealc

mscoree

dotnet