General
- Target 2026-08-17_85a6fa3417ecec39b55189fbe9b761bb_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc
- Size 853KB
- Sample260817-gyzcmsvamf
- SHA256 debefc1bd41c9d1d37a48dfd8d456b2219cd516bf44af21e067cb785b4e73473
- MD5 85a6fa3417ecec39b55189fbe9b761bb
- SHA1 9e89a102fb62796e7966a2d883e694a63cd67794
- SHA512 0e660d06eb733ba39e04cd2a5aadc0439551607fc9c5830674b7051725d5d4a1178ff400aeec04eeac4ebfd3ed13aebfb45969f6744cf82d77957d80aab0af34
- SSDEEP 12288:Cd9WwcV5ShXb7X3z2NcLDV1FLywTtjEF/Nka+hmFu2vpfjyflmDxcTgKpNE1LzJj:uTDXb7X3pWgtjERya9u2C
- TLSH T153055C16A66400BDE0B7C6B4CA665D43E772B84B03306ADB07D05EA63F277D45A3EF12
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Behavioral task
behavioral1
Sample
2026-08-17_85a6fa3417ecec39b55189fbe9b761bb_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe
Resource
win10v2004-20260513-en
6 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-17_85a6fa3417ecec39b55189fbe9b761bb_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc
- Size 853KB
- SHA256 debefc1bd41c9d1d37a48dfd8d456b2219cd516bf44af21e067cb785b4e73473
- MD5 85a6fa3417ecec39b55189fbe9b761bb
- SHA1 9e89a102fb62796e7966a2d883e694a63cd67794
- SHA512 0e660d06eb733ba39e04cd2a5aadc0439551607fc9c5830674b7051725d5d4a1178ff400aeec04eeac4ebfd3ed13aebfb45969f6744cf82d77957d80aab0af34
- SSDEEP 12288:Cd9WwcV5ShXb7X3z2NcLDV1FLywTtjEF/Nka+hmFu2vpfjyflmDxcTgKpNE1LzJj:uTDXb7X3pWgtjERya9u2C
- TLSH T153055C16A66400BDE0B7C6B4CA665D43E772B84B03306ADB07D05EA63F277D45A3EF12
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1