General
- Target 2026-08-03_23c03c53f3fe7ed9f8924dd063363d47_cobalt-strike_glassworm_icedid_luca-stealer_njrat_ryuk_satacom_stealc_vidar
- Size 2.1MB
- Sample260804-pz1wvsbb64
- SHA256 7c2da493bc94736b1990c56d6c9eb5344d5ec5475723af71b3bbc94a2099806e
- MD5 23c03c53f3fe7ed9f8924dd063363d47
- SHA1 06357aef36d3ce06ed3f38a01d838b061c530c90
- SHA512 56c895489410c55af374e9d093a98c74600121e60b46f58620e6cf88d64a61a27e65fa9ba128688f75790e32b6dd665b72acb45cb7d6a33d7a9b39f874551a78
- SSDEEP 24576:kw4+3Wx0vCiV+wwcOvafECnGu7vCsylpbtrpOQjYi3Piwv1SKNwYe0jwTN+D/XVs:l4+GcFV9+sECnGkvCsQRpOQl/iwCl8
- TLSH T121A56C8D73E450AAC55680B88965F717D6B5740B03309BDB36D04AFF1E27BE9AA39320
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-03_23c03c53f3fe7ed9f8924dd063363d47_cobalt-strike_glassworm_icedid_luca-stealer_njrat_ryuk_satacom_stealc_vidar.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-03_23c03c53f3fe7ed9f8924dd063363d47_cobalt-strike_glassworm_icedid_luca-stealer_njrat_ryuk_satacom_stealc_vidar.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-03_23c03c53f3fe7ed9f8924dd063363d47_cobalt-strike_glassworm_icedid_luca-stealer_njrat_ryuk_satacom_stealc_vidar
- Size 2.1MB
- SHA256 7c2da493bc94736b1990c56d6c9eb5344d5ec5475723af71b3bbc94a2099806e
- MD5 23c03c53f3fe7ed9f8924dd063363d47
- SHA1 06357aef36d3ce06ed3f38a01d838b061c530c90
- SHA512 56c895489410c55af374e9d093a98c74600121e60b46f58620e6cf88d64a61a27e65fa9ba128688f75790e32b6dd665b72acb45cb7d6a33d7a9b39f874551a78
- SSDEEP 24576:kw4+3Wx0vCiV+wwcOvafECnGu7vCsylpbtrpOQjYi3Piwv1SKNwYe0jwTN+D/XVs:l4+GcFV9+sECnGkvCsQRpOQl/iwCl8
- TLSH T121A56C8D73E450AAC55680B88965F717D6B5740B03309BDB36D04AFF1E27BE9AA39320
- MD5 SHA1 SHA512 SSDEEP TLSH
Score7/10-
Executes dropped EXE
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.