566c565475f08b11035ab8f56358604528ae70dfa07007bb7f1ce75c85139678

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
19/05/2026, 19:08

Target
2026-05-19_a1d669b71333d47b780f8987e442b395_coinminer_glassworm_helldown_icedid_luca-stealer_njrat_stealc.exe
Size 2.0MB
Sample260519-xtjz6ady6n
SHA256 566c565475f08b11035ab8f56358604528ae70dfa07007bb7f1ce75c85139678
MD5 a1d669b71333d47b780f8987e442b395
SHA1 275d4150f70b922fad88e1a90bc7dbd8109afe2b
SHA512 e5bc6850020dc3ff298d0e9023d23ccdfc441c70e24c72183b8ef0012ae3818d894b244e75151cc54dc0205c933e89f4f9b864a9f4044c490702d9a2dcec9750
SSDEEP 24576:XjzoIkvDVyaIV3nbd2KXX5OzYLruKQyNuJ5vThUmxnyLqh0lhSMXlAa1HwtNEDf:TzoyaIV3nb7Xhjunlx4BAs4
TLSH
T1D2A59D17A3E840E9E1FAC27CCA539A0AE772744603A197EF16A047561F63BF10E7E744
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

Contacts third-party web service commonly abused for C2 1 TTPs 7 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

C:\Users\Admin\AppData\Local\Temp\2026-05-19_a1d669b71333d47b780f8987e442b395_coinminer_glassworm_helldown_icedid_luca-stealer_njrat_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-19_a1d669b71333d47b780f8987e442b395_coinminer_glassworm_helldown_icedid_luca-stealer_njrat_stealc.exe"
1⤵
PID:4500

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

Exfiltration

Impact