General
- Target 2026-07-14_d8694977ddd9ad80d3ad32257d1e6165_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_megazord_njrat_satacom_stealc_utkonos_vidar_zxxz
- Size 51.0MB
- Sample260714-gpf5pshs51
- SHA256 1013c83e81f3b9d2f8f7e97998693028dd33b8d1ec4d1207229082bb1f4b3945
- MD5 d8694977ddd9ad80d3ad32257d1e6165
- SHA1 74778de6c6186201a2ea603dfecc80932b36981a
- SHA512 e8208380ac4b5f8e0315a76e821ec29bc240263af8a129bfc7024c4a96f076917fd73eefbff82b1762e8ffa1a8e85deafc304dafc66ae722c278e5d0151b71e8
- SSDEEP 393216:k/VODhlcJj9dY4NPH+z+EZ68EPURvcqFH9Y+kD/OoxD/lE1GuAhIQiQqX+BVS9Ln:k/VShMwjpXUa/bS8Pb/Eg+TtIlwqlHUa
- TLSH T1FEC7AE16A3A126EAC677D078874B5507FAB2B00713308BEB369C47B12F63AE45D7E750
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2026-07-14_d8694977ddd9ad80d3ad32257d1e6165_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_me.exe
Resource
win10v2004-20260513-en
10 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-14_d8694977ddd9ad80d3ad32257d1e6165_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_megazord_njrat_satacom_stealc_utkonos_vidar_zxxz
- Size 51.0MB
- SHA256 1013c83e81f3b9d2f8f7e97998693028dd33b8d1ec4d1207229082bb1f4b3945
- MD5 d8694977ddd9ad80d3ad32257d1e6165
- SHA1 74778de6c6186201a2ea603dfecc80932b36981a
- SHA512 e8208380ac4b5f8e0315a76e821ec29bc240263af8a129bfc7024c4a96f076917fd73eefbff82b1762e8ffa1a8e85deafc304dafc66ae722c278e5d0151b71e8
- SSDEEP 393216:k/VODhlcJj9dY4NPH+z+EZ68EPURvcqFH9Y+kD/OoxD/lE1GuAhIQiQqX+BVS9Ln:k/VShMwjpXUa/bS8Pb/Eg+TtIlwqlHUa
- TLSH T1FEC7AE16A3A126EAC677D078874B5507FAB2B00713308BEB369C47B12F63AE45D7E750
- MD5 SHA1 SHA512 SSDEEP TLSH
-
UPX dump on OEP (original entry point)
-
Executes dropped EXE
-
Loads dropped DLL
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.