General
- Target 2026-08-08_cfc69ad8fc25904cbd0820f5ea29202e_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc
- Size 879KB
- Sample260808-c6bjbs1xav
- SHA256 cebea1c8b06af0841d7bb7aeef869fc6b3579c15f6a749a8d02fc17872144386
- MD5 cfc69ad8fc25904cbd0820f5ea29202e
- SHA1 d9a95632e26d12e5c703d97c4158b9ad8107de70
- SHA512 a95dcdd1709637de4c3050e3ece7835c7ca05c750457876c06cda87489526ea967ddb15868ec4bc93ef02049c10f9e12a944dee2595e05911cb57ba2129f7c1d
- SSDEEP 12288:mTdsKDjxeLC76kCzpiZ9t2HEynabAt0kooVZubKBY/7EN4+Mjpj2vpfj5flmDxcL:mKUV76kCkfaaQHZubKBYYm/pj2RX
- TLSH T1EF156C16A66400BDE0B7C6B4CE665D43E771B84B0370AADB03D05EA63F277D45A3EB12
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Behavioral task
behavioral1
Sample
2026-08-08_cfc69ad8fc25904cbd0820f5ea29202e_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe
Resource
win10v2004-20260513-en
6 signatures
150 seconds
Malware Config
Extracted
Family
-
blakcsee_stealer
C2
-
94.183.168.16
Targets
-
- Target 2026-08-08_cfc69ad8fc25904cbd0820f5ea29202e_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc
- Size 879KB
- SHA256 cebea1c8b06af0841d7bb7aeef869fc6b3579c15f6a749a8d02fc17872144386
- MD5 cfc69ad8fc25904cbd0820f5ea29202e
- SHA1 d9a95632e26d12e5c703d97c4158b9ad8107de70
- SHA512 a95dcdd1709637de4c3050e3ece7835c7ca05c750457876c06cda87489526ea967ddb15868ec4bc93ef02049c10f9e12a944dee2595e05911cb57ba2129f7c1d
- SSDEEP 12288:mTdsKDjxeLC76kCzpiZ9t2HEynabAt0kooVZubKBY/7EN4+Mjpj2vpfj5flmDxcL:mKUV76kCkfaaQHZubKBYYm/pj2RX
- TLSH T1EF156C16A66400BDE0B7C6B4CE665D43E771B84B0370AADB03D05EA63F277D45A3EB12
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1