Analysis
- max time kernel
148s - max time network
149s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
19/05/2026, 19:08
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-05-19_a1d669b71333d47b780f8987e442b395_coinminer_glassworm_helldown_icedid_luca-stealer_njrat_stealc.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-05-19_a1d669b71333d47b780f8987e442b395_coinminer_glassworm_helldown_icedid_luca-stealer_njrat_stealc.exe
Resource
win11-20260513-en
windows11-21h2-x64
2 signatures
150 seconds
General
- Target 2026-05-19_a1d669b71333d47b780f8987e442b395_coinminer_glassworm_helldown_icedid_luca-stealer_njrat_stealc.exe
- Size 2.0MB
- Sample260519-xtjz6ady6n
- SHA256 566c565475f08b11035ab8f56358604528ae70dfa07007bb7f1ce75c85139678
- MD5 a1d669b71333d47b780f8987e442b395
- SHA1 275d4150f70b922fad88e1a90bc7dbd8109afe2b
- SHA512 e5bc6850020dc3ff298d0e9023d23ccdfc441c70e24c72183b8ef0012ae3818d894b244e75151cc54dc0205c933e89f4f9b864a9f4044c490702d9a2dcec9750
- SSDEEP 24576:XjzoIkvDVyaIV3nbd2KXX5OzYLruKQyNuJ5vThUmxnyLqh0lhSMXlAa1HwtNEDf:TzoyaIV3nb7Xhjunlx4BAs4
- TLSH T1D2A59D17A3E840E9E1FAC27CCA539A0AE772744603A197EF16A047561F63BF10E7E744
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
Malware Config
Signatures
- Contacts third-party web service commonly abused for C2 1 TTPs 64 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
flow ioc 170 raw.githubusercontent.com 179 raw.githubusercontent.com 260 raw.githubusercontent.com 24 raw.githubusercontent.com 27 raw.githubusercontent.com 335 raw.githubusercontent.com 388 raw.githubusercontent.com 254 raw.githubusercontent.com 295 raw.githubusercontent.com 162 raw.githubusercontent.com 326 raw.githubusercontent.com 394 raw.githubusercontent.com 86 raw.githubusercontent.com 194 raw.githubusercontent.com 219 raw.githubusercontent.com 235 raw.githubusercontent.com 343 raw.githubusercontent.com 384 raw.githubusercontent.com 29 raw.githubusercontent.com 99 raw.githubusercontent.com 136 raw.githubusercontent.com 266 raw.githubusercontent.com 124 raw.githubusercontent.com 180 raw.githubusercontent.com 241 raw.githubusercontent.com 278 raw.githubusercontent.com 325 raw.githubusercontent.com 327 raw.githubusercontent.com 35 raw.githubusercontent.com 94 raw.githubusercontent.com 168 raw.githubusercontent.com 236 raw.githubusercontent.com 337 raw.githubusercontent.com 351 raw.githubusercontent.com 184 raw.githubusercontent.com 185 raw.githubusercontent.com 209 raw.githubusercontent.com 228 raw.githubusercontent.com 352 raw.githubusercontent.com 62 raw.githubusercontent.com 96 raw.githubusercontent.com 230 raw.githubusercontent.com 293 raw.githubusercontent.com 74 raw.githubusercontent.com 84 raw.githubusercontent.com 105 raw.githubusercontent.com 274 raw.githubusercontent.com 301 raw.githubusercontent.com 148 raw.githubusercontent.com 204 raw.githubusercontent.com 221 raw.githubusercontent.com 242 raw.githubusercontent.com 270 raw.githubusercontent.com 302 raw.githubusercontent.com 304 raw.githubusercontent.com 307 raw.githubusercontent.com 284 raw.githubusercontent.com 1 raw.githubusercontent.com 9 raw.githubusercontent.com 79 raw.githubusercontent.com 129 raw.githubusercontent.com 308 raw.githubusercontent.com 135 raw.githubusercontent.com 193 raw.githubusercontent.com - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 672 2026-05-19_a1d669b71333d47b780f8987e442b395_coinminer_glassworm_helldown_icedid_luca-stealer_njrat_stealc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-19_a1d669b71333d47b780f8987e442b395_coinminer_glassworm_helldown_icedid_luca-stealer_njrat_stealc.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-19_a1d669b71333d47b780f8987e442b395_coinminer_glassworm_helldown_icedid_luca-stealer_njrat_stealc.exe"1⤵
- Suspicious use of FindShellTrayWindow
PID:672