4c4ce6d62096734bbaaa308c2dff0a6f1f23b550964dfecdbadf55b53d2eaa9f

General

Target
2026-08-06_a28511e602f968f47e5f82527c749371_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom
Size 17.1MB
Sample260807-arqnlathlc
SHA256 4c4ce6d62096734bbaaa308c2dff0a6f1f23b550964dfecdbadf55b53d2eaa9f
MD5 a28511e602f968f47e5f82527c749371
SHA1 47482b450e9a7779b48cab7cf8d38b988af339c9
SHA512 9ae9f4ca79fd9a3bd4bb30526ed5d05ee34daa3f98b52c34327f13758114a6f9055cefa23b5d668979c261741ac3d5ce76bf16ab80b3a86ab1b2a3741e800fa0
SSDEEP 98304:zQ3/7PCUT3ckCbbVOQ1L2wXRdyzWNQ4c0/G8QlY+ZNhLINU03t94L6ohEwkZlXhm:zQPrF3ckiTfJNQ+G8QlhBnLvhEnXheL
TLSH
T19E076C03F29651E9D06AC178872A5232B9717C494B30B5EF379CBA251F71FE0AA3CB15
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  2026-08-06_a28511e602f968f47e5f82527c749371_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom
- Size 17.1MB
- SHA256 4c4ce6d62096734bbaaa308c2dff0a6f1f23b550964dfecdbadf55b53d2eaa9f
- MD5 a28511e602f968f47e5f82527c749371
- SHA1 47482b450e9a7779b48cab7cf8d38b988af339c9
- SHA512 9ae9f4ca79fd9a3bd4bb30526ed5d05ee34daa3f98b52c34327f13758114a6f9055cefa23b5d668979c261741ac3d5ce76bf16ab80b3a86ab1b2a3741e800fa0
- SSDEEP 98304:zQ3/7PCUT3ckCbbVOQ1L2wXRdyzWNQ4c0/G8QlY+ZNhLINU03t94L6ohEwkZlXhm:zQPrF3ckiTfJNQ+G8QlhBnLvhEnXheL
- TLSH
  T19E076C03F29651E9D06AC178872A5232B9717C494B30B5EF379CBA251F71FE0AA3CB15
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

defense_evasion discovery persistence privilege_escalation spyware stealer trojan
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Checks whether UAC is enabled
  defense_evasion trojan
- Network Share Discovery
  Attempt to gather information on host network.
  discovery
- Drops file in System32 directory
behavioral1