General
- Target 2026-08-09_8c4dbf77bca04a2517de1ac221ebeae0_conti_glassworm
- Size 479KB
- Sample260809-l2bszadk61
- SHA256 aa22f20034e3aa186e17fcb81618ff21e54f809b506c429cd865d7670cad09b3
- MD5 8c4dbf77bca04a2517de1ac221ebeae0
- SHA1 4e5c37bdd747ef0ff5b5c2038fbc93113c9fcf2e
- SHA512 1a53e0d13a87db1150d01e8f441491da6d81cb155ac1c867b83d278867fad31188c8025d09a8d5ea9f66b622c8dd5aa9a9d38b2d7cec5a86bfc27ddf272796de
- SSDEEP 6144:jPpa9czYoBoblKlwP0NdqaP/y1yzFK3SLzk6hPeKILxsoYC4xvwW:NBobElwPAdqaS18zk6FRILxsTlwW
- TLSH T1BAA44B53F3A326ECD57BC2749AA6A772F931BC251230AE2E5650C7311D31F809A3DB16
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
8 signatures
Behavioral task
behavioral1
Sample
2026-08-09_8c4dbf77bca04a2517de1ac221ebeae0_conti_glassworm.exe
Resource
win10v2004-20260513-en
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-09_8c4dbf77bca04a2517de1ac221ebeae0_conti_glassworm.exe
Resource
win11ltsc2024-20260709-en
8 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-09_8c4dbf77bca04a2517de1ac221ebeae0_conti_glassworm
- Size 479KB
- SHA256 aa22f20034e3aa186e17fcb81618ff21e54f809b506c429cd865d7670cad09b3
- MD5 8c4dbf77bca04a2517de1ac221ebeae0
- SHA1 4e5c37bdd747ef0ff5b5c2038fbc93113c9fcf2e
- SHA512 1a53e0d13a87db1150d01e8f441491da6d81cb155ac1c867b83d278867fad31188c8025d09a8d5ea9f66b622c8dd5aa9a9d38b2d7cec5a86bfc27ddf272796de
- SSDEEP 6144:jPpa9czYoBoblKlwP0NdqaP/y1yzFK3SLzk6hPeKILxsoYC4xvwW:NBobElwPAdqaS18zk6FRILxsTlwW
- TLSH T1BAA44B53F3A326ECD57BC2749AA6A772F931BC251230AE2E5650C7311D31F809A3DB16
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10-
Detect binaries embedding considerable number of MFA browser extension IDs.
-
Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.
-
Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers
-
Detects executables containing SQL queries to confidential data stores. Observed in infostealers
-
Detects executables referencing many IR and analysis tools
-
Detects executables referencing many Password Manager software clients. Observed in infostealers
-
Detects executables referencing many confidential data stores found in browsers, mail clients, crypt