e14dbb996c169192ac68ecf3d042e6a33ce064c7fe55af2d81ef15541dee486a

General

Target
2026-08-20_09ef6d1bb2550d9e7813a34e0ac3cda0_glassworm_icedid_luca-stealer_mass-logger_njrat
Size 2.4MB
Sample260820-qkssdadf33
SHA256 e14dbb996c169192ac68ecf3d042e6a33ce064c7fe55af2d81ef15541dee486a
MD5 09ef6d1bb2550d9e7813a34e0ac3cda0
SHA1 a4422a9aac177dec1c81395a357066bfa9d97e40
SHA512 d2306d562ce0367911cccb7d775db78087822e9ede8a28ab09a32d83d44fcbcf61906d1a0ad90714db6a33d6cc22e49ab93842ce4d4d42771728422b0fd71717
SSDEEP 49152:T8CJhhKcoj15e4w8xhACEKzs57Xci5GLdRQKKYpWwl1+NY:T8CJfojPJw80Rp7XcOmfKYpfg
TLSH
T1D6B5E11A63F805A9F2FF9F75D8B14905CA32F84B9A34D74F0684449E0E73BA09D25B63
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-08-20_09ef6d1bb2550d9e7813a34e0ac3cda0_glassworm_icedid_luca-stealer_mass-logger_njrat
- Size 2.4MB
- SHA256 e14dbb996c169192ac68ecf3d042e6a33ce064c7fe55af2d81ef15541dee486a
- MD5 09ef6d1bb2550d9e7813a34e0ac3cda0
- SHA1 a4422a9aac177dec1c81395a357066bfa9d97e40
- SHA512 d2306d562ce0367911cccb7d775db78087822e9ede8a28ab09a32d83d44fcbcf61906d1a0ad90714db6a33d6cc22e49ab93842ce4d4d42771728422b0fd71717
- SSDEEP 49152:T8CJhhKcoj15e4w8xhACEKzs57Xci5GLdRQKKYpWwl1+NY:T8CJfojPJw80Rp7XcOmfKYpfg
- TLSH
  T1D6B5E11A63F805A9F2FF9F75D8B14905CA32F84B9A34D74F0684449E0E73BA09D25B63
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

collection discovery spyware stealer
- Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.
- Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers
- Detects executables containing possible sandbox analysis VM names
- Detects executables containing possible sandbox analysis VM usernames
- Detects executables embedding registry key / value combination indicative of disabling Windows Defen
- Detects executables referencing many confidential data stores found in browsers, mail clients, crypt
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- Suspicious use of SetThreadContext
behavioral1 behavioral2