General
- Target 2026-07-18_4cda2dba9fdaee694156bc1a9627f1b1_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_stealc
- Size 29.1MB
- Sample260718-bgd3gse191
- SHA256 8bfb5c610625902db67168ecd0666f34b03ea68dfd6e21c6e8fca2d484ca0e90
- MD5 4cda2dba9fdaee694156bc1a9627f1b1
- SHA1 ddcc8556aba7c055920052e0224f6519f30d714c
- SHA512 5653b78c8f03ae1343e54eaf570d0a99f935c67698ddcba7ebb98426875f06d07a7a558070b1e08cb701ebfe88b8a748628ce60737469e13ac40a9719368bc1b
- SSDEEP 393216:wzBb45FdeXVxBmekhXu72ywSkavEj82lFd+shQPRPzkoglSlfdVIAy1z1:wa53I9l2lFJQAlSlfM71z
- TLSH T1FC67F15472F8159DE07B8275D6636012E7B1B81A0761D3FF291362BE2F637E04E3AB42
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
3 signatures
Behavioral task
behavioral1
Sample
2026-07-18_4cda2dba9fdaee694156bc1a9627f1b1_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe
Resource
win10v2004-20260513-en
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-18_4cda2dba9fdaee694156bc1a9627f1b1_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe
Resource
win11ltsc2024-20260709-en
7 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-18_4cda2dba9fdaee694156bc1a9627f1b1_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_stealc
- Size 29.1MB
- SHA256 8bfb5c610625902db67168ecd0666f34b03ea68dfd6e21c6e8fca2d484ca0e90
- MD5 4cda2dba9fdaee694156bc1a9627f1b1
- SHA1 ddcc8556aba7c055920052e0224f6519f30d714c
- SHA512 5653b78c8f03ae1343e54eaf570d0a99f935c67698ddcba7ebb98426875f06d07a7a558070b1e08cb701ebfe88b8a748628ce60737469e13ac40a9719368bc1b
- SSDEEP 393216:wzBb45FdeXVxBmekhXu72ywSkavEj82lFd+shQPRPzkoglSlfdVIAy1z1:wa53I9l2lFJQAlSlfM71z
- TLSH T1FC67F15472F8159DE07B8275D6636012E7B1B81A0761D3FF291362BE2F637E04E3AB42
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10-
Detects executables packed with unregistered version of .NET Reactor
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.