0ef0281916b409b7d163329e85d158a41465f0cbddf9e8b8f866debde8f75963

Analysis

max time kernel
149s
max time network
149s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
01/06/2026, 06:41

Target
2026-06-01_94816a38e7084a7f272cb2de3cbd50be_cobalt-strike_coinminer_glassworm_icedid_njrat_stealc.exe
Size 32.2MB
Sample260601-hf97vsd16s
SHA256 0ef0281916b409b7d163329e85d158a41465f0cbddf9e8b8f866debde8f75963
MD5 94816a38e7084a7f272cb2de3cbd50be
SHA1 992f917314f88917af11c41533f59ae20f753d5e
SHA512 664ef028e2629ce01ac1116a0af1398ed1be67126ce406d69fe17581f2e6bac2b0e3b98cc37e1eff1da3520847ee257cb7b1f211af94bf4e528e41e692c92418
SSDEEP 786432:sQvzLP2lP1dG1gxvL182Ms2TMtYIS0L10Gnr+8vnUfNgs/T0+ctrZxa:ZvzaXQQ/x1PPwgs/strZx
TLSH
T12A774CDF16E7658DF4F8AC34C0002D1AE5607E2D9F19A5E3C176B17037399C82A6EA93
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
3196	2026-06-01_94816a38e7084a7f272cb2de3cbd50be_cobalt-strike_coinminer_glassworm_icedid_njrat_stealc.exe
3196	2026-06-01_94816a38e7084a7f272cb2de3cbd50be_cobalt-strike_coinminer_glassworm_icedid_njrat_stealc.exe

C:\Users\Admin\AppData\Local\Temp\2026-06-01_94816a38e7084a7f272cb2de3cbd50be_cobalt-strike_coinminer_glassworm_icedid_njrat_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-01_94816a38e7084a7f272cb2de3cbd50be_cobalt-strike_coinminer_glassworm_icedid_njrat_stealc.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:3196