General
- Target 2026-07-23_958b23fa5a1aff4f9ae434fdb584e02c_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar_zxxz
- Size 33.8MB
- Sample260724-aap1qsxwct
- SHA256 07a80af211482e78603801ff666324ec8473df61e60bc465b41ad5f18bbaf1b7
- MD5 958b23fa5a1aff4f9ae434fdb584e02c
- SHA1 66ac3b58db0df292e0f28181727f60e57a8d1d1d
- SHA512 2ed55ad2c3010b9729f54aa1468d60561e37ea7e88c713c9ca4cdfd4e2266458f0c0e434f15b1a2cf1385c815402bc605e1404014e0ee1f5e24a9a03e29fa700
- SSDEEP 393216:XQgHDlanaGBXvDKtz+bhPWES4tiNQPNrIKc4gaPbUAgrO4mgf+6l+ZArYsGaMqmH:X3on1HvSzxAMNf0ZArY/oLMz
- TLSH T165779D03B2A501D5E8B7D1388AA74203D772B8674731CACF325D02561FBBAE09A7F765
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-23_958b23fa5a1aff4f9ae434fdb584e02c_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar_zxxz.exe
Resource
win10v2004-20260513-en
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-23_958b23fa5a1aff4f9ae434fdb584e02c_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar_zxxz.exe
Resource
win11ltsc2024-20260709-en
10 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-23_958b23fa5a1aff4f9ae434fdb584e02c_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar_zxxz
- Size 33.8MB
- SHA256 07a80af211482e78603801ff666324ec8473df61e60bc465b41ad5f18bbaf1b7
- MD5 958b23fa5a1aff4f9ae434fdb584e02c
- SHA1 66ac3b58db0df292e0f28181727f60e57a8d1d1d
- SHA512 2ed55ad2c3010b9729f54aa1468d60561e37ea7e88c713c9ca4cdfd4e2266458f0c0e434f15b1a2cf1385c815402bc605e1404014e0ee1f5e24a9a03e29fa700
- SSDEEP 393216:XQgHDlanaGBXvDKtz+bhPWES4tiNQPNrIKc4gaPbUAgrO4mgf+6l+ZArYsGaMqmH:X3on1HvSzxAMNf0ZArY/oLMz
- TLSH T165779D03B2A501D5E8B7D1388AA74203D772B8674731CACF325D02561FBBAE09A7F765
- MD5 SHA1 SHA512 SSDEEP TLSH
Score7/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Enumerates processes with tasklist
-
Executes a VBScript file via the Windows Script Host.