General
- Target 2026-07-01_9cd373510932a7ef9af346dc3651fb59_cobalt-strike_coinminer_glassworm_hammertoss_icedid_luca-stealer_njrat_stealc
- Size 28.9MB
- Sample260701-vb9fzsaw6j
- SHA256 ef3c64911f940eedfcaa99d9e24914f5905500930e507fa4d6caac533fd91461
- MD5 9cd373510932a7ef9af346dc3651fb59
- SHA1 a68deab57518f4dc74aff5541f880756d736f805
- SHA512 a2f111e6c37282c090f42459cd175adcf733d8a5fe5467ca1f1009ccc2b5460d6ad8011bec6f20a8454b4faf7e84809fca2570eebf2d833e874fc9029b7e3b71
- SSDEEP 393216:8R1D/nvNFmdxBmekhXu72ywSkavEj82lFd+shQPSPnesVzknWIAa+zrsn/uSppg:8PnfI9l2lFJQ8JQ+0/9p
- TLSH T18C67F01473F82199E077C23596636016E771B95A0B60D7FF29132ABF2E637E00E3A752
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2026-07-01_9cd373510932a7ef9af346dc3651fb59_cobalt-strike_coinminer_glassworm_hammertoss_icedid_luca-stealer_njrat_stealc.exe
Resource
win10v2004-20260513-en
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-01_9cd373510932a7ef9af346dc3651fb59_cobalt-strike_coinminer_glassworm_hammertoss_icedid_luca-stealer_njrat_stealc.exe
Resource
win11ltsc2024-20260629-en
6 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-01_9cd373510932a7ef9af346dc3651fb59_cobalt-strike_coinminer_glassworm_hammertoss_icedid_luca-stealer_njrat_stealc
- Size 28.9MB
- SHA256 ef3c64911f940eedfcaa99d9e24914f5905500930e507fa4d6caac533fd91461
- MD5 9cd373510932a7ef9af346dc3651fb59
- SHA1 a68deab57518f4dc74aff5541f880756d736f805
- SHA512 a2f111e6c37282c090f42459cd175adcf733d8a5fe5467ca1f1009ccc2b5460d6ad8011bec6f20a8454b4faf7e84809fca2570eebf2d833e874fc9029b7e3b71
- SSDEEP 393216:8R1D/nvNFmdxBmekhXu72ywSkavEj82lFd+shQPSPnesVzknWIAa+zrsn/uSppg:8PnfI9l2lFJQ8JQ+0/9p
- TLSH T18C67F01473F82199E077C23596636016E771B95A0B60D7FF29132ABF2E637E00E3A752
- MD5 SHA1 SHA512 SSDEEP TLSH
Score6/10-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.