General
- Target 2026-08-22_d015017802a1ab788422be9fe7ff3a17_cobalt-strike_glassworm_icedid_luca-stealer_njrat_stealc
- Size 462KB
- Sample260822-312rfagg77
- SHA256 0b91078ce5f197d5eada20886539a4309e9a27531eeab3e84f0e5d3935c75d4b
- MD5 d015017802a1ab788422be9fe7ff3a17
- SHA1 9e127a4794dccaf342107d38002411f4dd924508
- SHA512 cbfe7af66110d3cae11d28d5de3cf6ad093e6a99c32aa9372c5d16e2427d9e85d973f6ea659e67362acd4b82677e84f71b072bcd35ae80347cf8430982ad3963
- SSDEEP 6144:NJSwpI8qcj3yKOybyjUpbJgvTmF2QCK8ad2eT2V55VHBqiI:bIo27W9QQCK662V3Vhq
- TLSH T19DA47D26979401F9E0B7D278CE475D42EB71780A03B1AADF03D099B25F676E05E3EB12
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
3 signatures
Behavioral task
behavioral1
Sample
2026-08-22_d015017802a1ab788422be9fe7ff3a17_cobalt-strike_glassworm_icedid_luca-stealer_njrat_stealc.exe
Resource
win10v2004-20260513-en
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-22_d015017802a1ab788422be9fe7ff3a17_cobalt-strike_glassworm_icedid_luca-stealer_njrat_stealc.exe
Resource
win11ltsc2024-20260710-en
5 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-22_d015017802a1ab788422be9fe7ff3a17_cobalt-strike_glassworm_icedid_luca-stealer_njrat_stealc
- Size 462KB
- SHA256 0b91078ce5f197d5eada20886539a4309e9a27531eeab3e84f0e5d3935c75d4b
- MD5 d015017802a1ab788422be9fe7ff3a17
- SHA1 9e127a4794dccaf342107d38002411f4dd924508
- SHA512 cbfe7af66110d3cae11d28d5de3cf6ad093e6a99c32aa9372c5d16e2427d9e85d973f6ea659e67362acd4b82677e84f71b072bcd35ae80347cf8430982ad3963
- SSDEEP 6144:NJSwpI8qcj3yKOybyjUpbJgvTmF2QCK8ad2eT2V55VHBqiI:bIo27W9QQCK662V3Vhq
- TLSH T19DA47D26979401F9E0B7D278CE475D42EB71780A03B1AADF03D099B25F676E05E3EB12
- MD5 SHA1 SHA512 SSDEEP TLSH
Score6/10-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.