Extracted

• • Target
    2026-08-12_328295bb9d509db7e74245a425dbb7d7_cobalt-strike_glassworm_icedid_luca-stealer_njrat
  • Size 2.4MB
  • SHA256 f013d927d4057f32bafbcb9f464b5203616529b190175be44ba509d7ba76efe6
  • MD5 328295bb9d509db7e74245a425dbb7d7
  • SHA1 21e1efbd1c54303071bab4e56b60af17f74149c9
  • SHA512 e9aef54d656d1b9c9e57e7e5b5f8cdd867dc70042047965a071f004b8145f97f761d47c93aa18fd0746cb860f16cf6933340db670586cd8a0d5e9a127b1c9596
  • SSDEEP 49152:ScIKmjtitHaaNZV/Ovfe/PFJdG5CYUzDC0QOu/rT:jAtCHaaHVmv2HFJgAvxeT
  • TLSH
    T106C5D01AA3B400FCD0B7D2B4CE569907DBB2B8461234969F03D189A62F67B719F3E711
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryoverwatchspywarestealer

  • Family: OverWatch

    OverWatch is a Windows stealer written in C++.

    stealeroverwatch

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  behavioral1behavioral2