General
- Target 2026-07-20_de41d4e2683b37973f69cfa5b3764c11_coinminer_glassworm_icedid_njrat_pos_remcos_vidar
- Size 11.7MB
- Sample260720-sv499sev7p
- SHA256 159ac297552c7465553acc1598d2b80cff560a0d3a78788496f457e28459b85d
- MD5 de41d4e2683b37973f69cfa5b3764c11
- SHA1 fc1c5ad8c712af6d6f0fbaab5570af6842385a4c
- SHA512 6e191158e8beba5e81162e23a8ec2531e10b32258924166e4a1e2d82077d16befef06bed1227801c7119488fac071642dba54c568ba1c67c39cc273b33f36e77
- SSDEEP 196608:sjt2oB00A04cg3oTHt/l3eXnffmGUR/mQCwS3/kC2S3/kC:sjt2Cm0FTHtIPfiYkC1kC
- TLSH T18CC64B4377A48DA6D5BAE336C7531E11B7B2B0486F13D3DB11C487AA2E13782AD2531E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
3 signatures
Behavioral task
behavioral1
Sample
2026-07-20_de41d4e2683b37973f69cfa5b3764c11_coinminer_glassworm_icedid_njrat_pos_remcos_vidar.exe
Resource
win10v2004-20260513-en
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-20_de41d4e2683b37973f69cfa5b3764c11_coinminer_glassworm_icedid_njrat_pos_remcos_vidar.exe
Resource
win11ltsc2024-20260709-en
2 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-20_de41d4e2683b37973f69cfa5b3764c11_coinminer_glassworm_icedid_njrat_pos_remcos_vidar
- Size 11.7MB
- SHA256 159ac297552c7465553acc1598d2b80cff560a0d3a78788496f457e28459b85d
- MD5 de41d4e2683b37973f69cfa5b3764c11
- SHA1 fc1c5ad8c712af6d6f0fbaab5570af6842385a4c
- SHA512 6e191158e8beba5e81162e23a8ec2531e10b32258924166e4a1e2d82077d16befef06bed1227801c7119488fac071642dba54c568ba1c67c39cc273b33f36e77
- SSDEEP 196608:sjt2oB00A04cg3oTHt/l3eXnffmGUR/mQCwS3/kC2S3/kC:sjt2Cm0FTHtIPfiYkC1kC
- TLSH T18CC64B4377A48DA6D5BAE336C7531E11B7B2B0486F13D3DB11C487AA2E13782AD2531E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10-
Detects encrypted or obfuscated .NET executables
-
Detects executables packed with Dotfuscator
-
Executes dropped EXE
-
Drops file in System32 directory