General
- Target 2026-06-30_57391dc9a0e4dc9f9bbc393f4711743b_cobalt-strike_emotet_glassworm_hijackloader_icedid_njrat_remcos_stealc_vidar
- Size 11.3MB
- Sample260630-2d2x9ahs4j
- SHA256 dec73ef3a1c634a15678693872108a692dff47922de07c3f39a5ad166589cf33
- MD5 57391dc9a0e4dc9f9bbc393f4711743b
- SHA1 18005856413152b3cc2960a8a3b3f66c71e1af2b
- SHA512 a218a50ba5922705f33526d1d9f0c9a81cec0d296063b007dc11a2905a0f82b327c570268231ff59f51f97cea1ea6bbdfe3f85ba4fb1d761886130c6d66c349f
- SSDEEP 196608:gbqLaFxTBYq6vtKa7uQ1gqr0Axf+N4zwl2WhlUNbRmCg:gbqLeNBYq6V+oxfc4zg2WfyRVg
- TLSH T17FC6AFFBB122C698C1CACA7064978FB25F61BD1509B2035263CA271F6F36D405DAE4DE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-06-30_57391dc9a0e4dc9f9bbc393f4711743b_cobalt-strike_emotet_glassworm_hijackloader_icedid_njrat_remcos_stealc_vidar.exe
Resource
win10v2004-20260513-en
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-06-30_57391dc9a0e4dc9f9bbc393f4711743b_cobalt-strike_emotet_glassworm_hijackloader_icedid_njrat_remcos_stealc_vidar.exe
Resource
win11ltsc2024-20260630-en
8 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-06-30_57391dc9a0e4dc9f9bbc393f4711743b_cobalt-strike_emotet_glassworm_hijackloader_icedid_njrat_remcos_stealc_vidar
- Size 11.3MB
- SHA256 dec73ef3a1c634a15678693872108a692dff47922de07c3f39a5ad166589cf33
- MD5 57391dc9a0e4dc9f9bbc393f4711743b
- SHA1 18005856413152b3cc2960a8a3b3f66c71e1af2b
- SHA512 a218a50ba5922705f33526d1d9f0c9a81cec0d296063b007dc11a2905a0f82b327c570268231ff59f51f97cea1ea6bbdfe3f85ba4fb1d761886130c6d66c349f
- SSDEEP 196608:gbqLaFxTBYq6vtKa7uQ1gqr0Axf+N4zwl2WhlUNbRmCg:gbqLeNBYq6V+oxfc4zg2WfyRVg
- TLSH T17FC6AFFBB122C698C1CACA7064978FB25F61BD1509B2035263CA271F6F36D405DAE4DE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score7/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Suspicious use of SetThreadContext