b6b64fb78b886a2c700d7a791942d7595024e77fb7cd75cb1a4895d65a7ed483

General

Target
2026-10-14_c24e84a3405aaa00060d32f8a9a26a19_glassworm_icedid_luca-stealer_mass-logger_njrat
Size 1.9MB
Sample261014-pyjaesds6x
SHA256 b6b64fb78b886a2c700d7a791942d7595024e77fb7cd75cb1a4895d65a7ed483
MD5 c24e84a3405aaa00060d32f8a9a26a19
SHA1 13304dbd88dcdfd5ee665570c060c756e7b645bd
SHA512 cf7afb78c973f1f4cac945b11a97cdb938cfd8091d4bb64f69bdcc168c7fc3508969c1d2d6f807d77d508145accdddf116944aca3ba77d0770fc6eb227894401
SSDEEP 49152:6hb1BhEqzqEXoj15e4w8xhACEKzs57Xci5NLd:6hb9EqzbojPJw80Rp7XcO1
TLSH
T1E295DF5623F40264F2FFA674D9B24A16CA72F80BCA71E74F06C4549E0E73B909D25B63
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-10-14_c24e84a3405aaa00060d32f8a9a26a19_glassworm_icedid_luca-stealer_mass-logger_njrat
- Size 1.9MB
- SHA256 b6b64fb78b886a2c700d7a791942d7595024e77fb7cd75cb1a4895d65a7ed483
- MD5 c24e84a3405aaa00060d32f8a9a26a19
- SHA1 13304dbd88dcdfd5ee665570c060c756e7b645bd
- SHA512 cf7afb78c973f1f4cac945b11a97cdb938cfd8091d4bb64f69bdcc168c7fc3508969c1d2d6f807d77d508145accdddf116944aca3ba77d0770fc6eb227894401
- SSDEEP 49152:6hb1BhEqzqEXoj15e4w8xhACEKzs57Xci5NLd:6hb9EqzbojPJw80Rp7XcO1
- TLSH
  T1E295DF5623F40264F2FFA674D9B24A16CA72F80BCA71E74F06C4549E0E73B909D25B63
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

collection discovery spyware stealer
- Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.
- Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers
- Detects executables containing possible sandbox analysis VM names
- Detects executables containing possible sandbox analysis VM usernames
- Detects executables embedding registry key / value combination indicative of disabling Windows Defen
- Detects executables referencing many confidential data stores found in browsers, mail clients, crypt
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- Suspicious use of SetThreadContext
behavioral1 behavioral2