7e3156d703d74df132edb03a913d107f46a45fc6f6615177cf47f33d62ece4f5

General

Target
2026-09-13_5792d520df1d1cb1b2b7a361a1e8d30e_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar
Size 7.0MB
Sample260913-semqaaycke
SHA256 7e3156d703d74df132edb03a913d107f46a45fc6f6615177cf47f33d62ece4f5
MD5 5792d520df1d1cb1b2b7a361a1e8d30e
SHA1 493ea674e1aaa796748e676bad0eaf5faf36e46a
SHA512 15de148183ef2fa6f7dfc7d9afdf636bfc5f5fe51cb9f8b175f0d72ef2c9ca2d52caeec9fe02478b9134e6da2bd432750f23d028588965001c2b5417ba2c3da2
SSDEEP 196608:X9Iih8Fwj5aeNyFJMIDJhgsAGKyRtrAbg:mLFMyFqyhgsht8g
TLSH
T1897633B0A7A409E1EDF6493E884F884AC1F4FC152314EE8B4274627A5F637195D3FBA1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  2026-09-13_5792d520df1d1cb1b2b7a361a1e8d30e_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar
- Size 7.0MB
- SHA256 7e3156d703d74df132edb03a913d107f46a45fc6f6615177cf47f33d62ece4f5
- MD5 5792d520df1d1cb1b2b7a361a1e8d30e
- SHA1 493ea674e1aaa796748e676bad0eaf5faf36e46a
- SHA512 15de148183ef2fa6f7dfc7d9afdf636bfc5f5fe51cb9f8b175f0d72ef2c9ca2d52caeec9fe02478b9134e6da2bd432750f23d028588965001c2b5417ba2c3da2
- SSDEEP 196608:X9Iih8Fwj5aeNyFJMIDJhgsAGKyRtrAbg:mLFMyFqyhgsht8g
- TLSH
  T1897633B0A7A409E1EDF6493E884F884AC1F4FC152314EE8B4274627A5F637195D3FBA1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

defense_evasion discovery execution upx
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Disables one or more Microsoft Defender components
  Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.
  defense_evasion
- Loads dropped DLL
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- Discovers running processes
  Running process information can be used to identify security tools or plan follow-on actions.
  discovery
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2