General
- Target 2026-07-23_8a4144d0b368a8e15f57f52d7204855a_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar_zxxz
- Size 33.8MB
- Sample260723-glgbasw1bv
- SHA256 ab63bf2dcd79c229d1a92d821e2fa821586d8f19c524eba986db2e95b10735d7
- MD5 8a4144d0b368a8e15f57f52d7204855a
- SHA1 29c1f0d7ad7a34a345080ef58934156b35ed6d9d
- SHA512 ec6491e3ff65c0d4771c2ce0d2ba93b3cc899c7d61f8b7904e7298c7d3bc2856d11e2c97414eb812c0f53b94340c116d3542eeb4241778a9494ac2b8afe1f44b
- SSDEEP 393216:pQgHDlanaGBXvDKtz+bhPWES4tiNQPNrIKc4gaPbUAgrO4mgQ+6l+ZArYsGaMqzo:p3on1HvSzxAMNQ0ZArY/OlkJ
- TLSH T12B779D03B2A501D5E8B7D1388AA74203D772B8674731CACF325D02561FBBAE09A7F765
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-23_8a4144d0b368a8e15f57f52d7204855a_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar_zxxz.exe
Resource
win10v2004-20260513-en
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-23_8a4144d0b368a8e15f57f52d7204855a_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar_zxxz.exe
Resource
win11ltsc2024-20260709-en
10 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-23_8a4144d0b368a8e15f57f52d7204855a_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar_zxxz
- Size 33.8MB
- SHA256 ab63bf2dcd79c229d1a92d821e2fa821586d8f19c524eba986db2e95b10735d7
- MD5 8a4144d0b368a8e15f57f52d7204855a
- SHA1 29c1f0d7ad7a34a345080ef58934156b35ed6d9d
- SHA512 ec6491e3ff65c0d4771c2ce0d2ba93b3cc899c7d61f8b7904e7298c7d3bc2856d11e2c97414eb812c0f53b94340c116d3542eeb4241778a9494ac2b8afe1f44b
- SSDEEP 393216:pQgHDlanaGBXvDKtz+bhPWES4tiNQPNrIKc4gaPbUAgrO4mgQ+6l+ZArYsGaMqzo:p3on1HvSzxAMNQ0ZArY/OlkJ
- TLSH T12B779D03B2A501D5E8B7D1388AA74203D772B8674731CACF325D02561FBBAE09A7F765
- MD5 SHA1 SHA512 SSDEEP TLSH
Score7/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Enumerates processes with tasklist
-
Executes a VBScript file via the Windows Script Host.