General
- Target 2026-08-11_430b0e473bac737f1859a1b3aabea4cf_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc
- Size 853KB
- Sample260812-abz74ahd73
- SHA256 26fdc35467c2bd1d85a54fed6a8c3a84773b48e85b8d3ff669d4ac157ec4dc90
- MD5 430b0e473bac737f1859a1b3aabea4cf
- SHA1 e7c0a1c7c9a3a8586566b49cf1de8792855f7e51
- SHA512 3d95f8074d0b77214dfd05f9cf4114f2e5d73a8fc14bdf9b3de4f3031b42cedb913d7d2e766b3e0e0dec78da86d142778793d8f4d521f0fae19737fe02e9b914
- SSDEEP 12288:Od9WwcV5ShXb7X3z2NcLDV1FLywTtjEF/Nka+hmFW2vpfjyflmDxcTgKpNE1LzJp:qTDXb7X3pWgtjERya9W2k
- TLSH T1B9055C16A66400BDE0B7C6B4CA665D43E772B84B03306ADB07D05EA63F277D45A3EF12
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Behavioral task
behavioral1
Sample
2026-08-11_430b0e473bac737f1859a1b3aabea4cf_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe
Resource
win10v2004-20260513-en
6 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-11_430b0e473bac737f1859a1b3aabea4cf_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc
- Size 853KB
- SHA256 26fdc35467c2bd1d85a54fed6a8c3a84773b48e85b8d3ff669d4ac157ec4dc90
- MD5 430b0e473bac737f1859a1b3aabea4cf
- SHA1 e7c0a1c7c9a3a8586566b49cf1de8792855f7e51
- SHA512 3d95f8074d0b77214dfd05f9cf4114f2e5d73a8fc14bdf9b3de4f3031b42cedb913d7d2e766b3e0e0dec78da86d142778793d8f4d521f0fae19737fe02e9b914
- SSDEEP 12288:Od9WwcV5ShXb7X3z2NcLDV1FLywTtjEF/Nka+hmFW2vpfjyflmDxcTgKpNE1LzJp:qTDXb7X3pWgtjERya9W2k
- TLSH T1B9055C16A66400BDE0B7C6B4CA665D43E772B84B03306ADB07D05EA63F277D45A3EF12
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1