General
- Target 2026-09-04_313098906f9e7c98f39cb0e937f87368_cobalt-strike_glassworm_icedid_njrat_stealc
- Size 3.3MB
- Sample260905-scelwstwfy
- SHA256 fc430c310d2a96a6067d07d249acf7eea0d298fe024e31217c503e7830ba6921
- MD5 313098906f9e7c98f39cb0e937f87368
- SHA1 8248af011d8d07b2492525b2da9cb1d6304eb914
- SHA512 7c74546ab629ffac2e0d0a5aaff380f3f605568137b294447dfb4e420f2f88eaaebba41a80287bf97593f9b266699b5a97809fc6a263a12eb211b933cdbef680
- SSDEEP 49152:Ck5+/Gu8m00Vm3VzikQXAB3U0o5S57bZibARI0x4X4rDnzhJhjH2Dw:C8xmPm35fe9kRK
- TLSH T1F8F5CE76B2AC40E9E273E0B8C506A653DE76B447073193CB27D049562F776F90EBAB10
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2026-09-04_313098906f9e7c98f39cb0e937f87368_cobalt-strike_glassworm_icedid_njrat_stealc.exe
Resource
win10v2004-20260513-en
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-09-04_313098906f9e7c98f39cb0e937f87368_cobalt-strike_glassworm_icedid_njrat_stealc.exe
Resource
win11ltsc2024-20260709-en
6 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-09-04_313098906f9e7c98f39cb0e937f87368_cobalt-strike_glassworm_icedid_njrat_stealc
- Size 3.3MB
- SHA256 fc430c310d2a96a6067d07d249acf7eea0d298fe024e31217c503e7830ba6921
- MD5 313098906f9e7c98f39cb0e937f87368
- SHA1 8248af011d8d07b2492525b2da9cb1d6304eb914
- SHA512 7c74546ab629ffac2e0d0a5aaff380f3f605568137b294447dfb4e420f2f88eaaebba41a80287bf97593f9b266699b5a97809fc6a263a12eb211b933cdbef680
- SSDEEP 49152:Ck5+/Gu8m00Vm3VzikQXAB3U0o5S57bZibARI0x4X4rDnzhJhjH2Dw:C8xmPm35fe9kRK
- TLSH T1F8F5CE76B2AC40E9E273E0B8C506A653DE76B447073193CB27D049562F776F90EBAB10
- MD5 SHA1 SHA512 SSDEEP TLSH
Score7/10-
Executes dropped EXE
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.