General
- Target 2026-08-09_e8a57e6778516d8c6973668fe18c0537_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc
- Size 879KB
- Sample260809-lp9t8scq8t
- SHA256 58cc6ddf9c3378cea975ea681f152a2d4790caf4bbcf1ee1e5251f900ca82ee8
- MD5 e8a57e6778516d8c6973668fe18c0537
- SHA1 d3ca31be839559dd724a1742f924cb04ff7c53f8
- SHA512 386d6d3dfab5c69fc06f793b0385f789537bd922fda5761f06e1e2700166f49be13ad859549f6acf537127430a84baceb14056a21a55161be59c2a1125c968da
- SSDEEP 12288:vcFzPyOOwOz5XdcIaDkZFai8E82kEsbxiqdrS/dwyKbl/WKrJTnHG2vpfjjflmDG:er05XdcjonJsX8dwyKblv1DG23n
- TLSH T1B5156D16A66400BDD0B7C6B4CE665D43E771B84A0370AADB03D05EA63E277E45E3EF12
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Behavioral task
behavioral1
Sample
2026-08-09_e8a57e6778516d8c6973668fe18c0537_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe
Resource
win10v2004-20260513-en
6 signatures
150 seconds
Malware Config
Extracted
Family
-
blakcsee_stealer
C2
-
94.183.168.16
Targets
-
- Target 2026-08-09_e8a57e6778516d8c6973668fe18c0537_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc
- Size 879KB
- SHA256 58cc6ddf9c3378cea975ea681f152a2d4790caf4bbcf1ee1e5251f900ca82ee8
- MD5 e8a57e6778516d8c6973668fe18c0537
- SHA1 d3ca31be839559dd724a1742f924cb04ff7c53f8
- SHA512 386d6d3dfab5c69fc06f793b0385f789537bd922fda5761f06e1e2700166f49be13ad859549f6acf537127430a84baceb14056a21a55161be59c2a1125c968da
- SSDEEP 12288:vcFzPyOOwOz5XdcIaDkZFai8E82kEsbxiqdrS/dwyKbl/WKrJTnHG2vpfjjflmDG:er05XdcjonJsX8dwyKblv1DG23n
- TLSH T1B5156D16A66400BDD0B7C6B4CE665D43E771B84A0370AADB03D05EA63E277E45E3EF12
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1