General
- Target 2026-10-02_53d9ba283acfd0b36306be3bef96c33f_cobalt-strike_glassworm_icedid_luca-stealer_njrat_stealc
- Size 612KB
- Sample261003-prdrcsydle
- SHA256 edc27384dba8328ed57c0166ac6ca57abf941bc9b38d8ae0abe69226358f2b69
- MD5 53d9ba283acfd0b36306be3bef96c33f
- SHA1 d5cbb5096615132a5956b573e72fa406e2d9a590
- SHA512 6256257eb191c33ed48b95d368a26d3b283414b41feaae961848b6ad75509b566e07a05a9582bb78e9eac84906819cd46a18b5604aef7fe2300a050016e460a7
- SSDEEP 6144:RsOuDEeORd7FJCg5qREfT1hobs+/XU3gqDqHL9BjoSFzeb6MPOHyJY+y3UAPcYMo:B15NSsKicl7HuJd5ibfqrzG
- TLSH T1FCD44C26679411FCE0B6D179CE424C12E776740A07B1AAEF07D046A29F2B6E49F3E713
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
4 signatures
Behavioral task
behavioral1
Sample
2026-10-02_53d9ba283acfd0b36306be3bef96c33f_cobalt-strike_glassworm_icedid_luca-stealer_njrat_stealc.exe
Resource
win10v2004-20260911-en
5 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-10-02_53d9ba283acfd0b36306be3bef96c33f_cobalt-strike_glassworm_icedid_luca-stealer_njrat_stealc
- Size 612KB
- SHA256 edc27384dba8328ed57c0166ac6ca57abf941bc9b38d8ae0abe69226358f2b69
- MD5 53d9ba283acfd0b36306be3bef96c33f
- SHA1 d5cbb5096615132a5956b573e72fa406e2d9a590
- SHA512 6256257eb191c33ed48b95d368a26d3b283414b41feaae961848b6ad75509b566e07a05a9582bb78e9eac84906819cd46a18b5604aef7fe2300a050016e460a7
- SSDEEP 6144:RsOuDEeORd7FJCg5qREfT1hobs+/XU3gqDqHL9BjoSFzeb6MPOHyJY+y3UAPcYMo:B15NSsKicl7HuJd5ibfqrzG
- TLSH T1FCD44C26679411FCE0B6D179CE424C12E776740A07B1AAEF07D046A29F2B6E49F3E713
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1