General
- Target 2026-07-11_11eef532e67076ea475a53284f9de887_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar_zxxz
- Size 32.6MB
- Sample260711-126exaay6k
- SHA256 17f9d8fa069ccb15795834b3c6cf6c83d3174f1a70c72ed46a207110ff2225ea
- MD5 11eef532e67076ea475a53284f9de887
- SHA1 af697eae1488cf8fb3567c529f693e7b9714bec4
- SHA512 4a23d749cfea1d13dbcd40fdd76c5d92d8d9c16189c4d13a5e9c9859b1a2a3e0279d4dcc2a3aa9cbb959105eb3b48ae7d4827fa4efa32d48d850356e078ab302
- SSDEEP 393216:uQgHDlanaGBXvDKtz+bhPWES4tiNQPNrIKc4gaPbUAgrO4mg6Q6l+ZArYsFRDKfv:u3on1HvSzxAMN6CZArYsC
- TLSH T1E9779D03B2A601D5E4B7D1388AA74203D772B8674731DACF325D02161FBBAE09A7F765
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-11_11eef532e67076ea475a53284f9de887_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar_zxxz.exe
Resource
win10v2004-20260513-en
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-11_11eef532e67076ea475a53284f9de887_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar_zxxz.exe
Resource
win11ltsc2024-20260709-en
8 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-11_11eef532e67076ea475a53284f9de887_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar_zxxz
- Size 32.6MB
- SHA256 17f9d8fa069ccb15795834b3c6cf6c83d3174f1a70c72ed46a207110ff2225ea
- MD5 11eef532e67076ea475a53284f9de887
- SHA1 af697eae1488cf8fb3567c529f693e7b9714bec4
- SHA512 4a23d749cfea1d13dbcd40fdd76c5d92d8d9c16189c4d13a5e9c9859b1a2a3e0279d4dcc2a3aa9cbb959105eb3b48ae7d4827fa4efa32d48d850356e078ab302
- SSDEEP 393216:uQgHDlanaGBXvDKtz+bhPWES4tiNQPNrIKc4gaPbUAgrO4mg6Q6l+ZArYsFRDKfv:u3on1HvSzxAMN6CZArYsC
- TLSH T1E9779D03B2A601D5E4B7D1388AA74203D772B8674731DACF325D02161FBBAE09A7F765
- MD5 SHA1 SHA512 SSDEEP TLSH
Score7/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Enumerates processes with tasklist