General
- Target 2026-07-29_d18e630e71303857bde79f95fff68e92_coinminer_glassworm_helldown_icedid_luca-stealer_njrat_stealc
- Size 2.4MB
- Sample260729-14nymsff62
- SHA256 949c185c70d78e08c86fad5c449aa4e5002e4baee545a3ff7ec549110a660398
- MD5 d18e630e71303857bde79f95fff68e92
- SHA1 c1f0b979bcebcc7fbb94d58fd232d30afb192146
- SHA512 719415abeb6dba48565741cdf65119bfa5957d596211c1c4920bc0facb9ba8b391ddd3a30c2c2637fd5fb934f7655863a74bfa354f3dfe79a89d5885c4b2b725
- SSDEEP 49152:D+rQpOwXWUVZ7Dc4cvep1F8uUoNJ0FE4n:W+WUVbcEhv8EC
- TLSH T12CB58E27A3A800E9D1BAC278CE579606E7737405137267EF16A087961F67BE41F3EB01
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-29_d18e630e71303857bde79f95fff68e92_coinminer_glassworm_helldown_icedid_luca-stealer_njrat_stealc.exe
Resource
win10v2004-20260513-en
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-29_d18e630e71303857bde79f95fff68e92_coinminer_glassworm_helldown_icedid_luca-stealer_njrat_stealc.exe
Resource
win11ltsc2024-20260709-en
1 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-29_d18e630e71303857bde79f95fff68e92_coinminer_glassworm_helldown_icedid_luca-stealer_njrat_stealc
- Size 2.4MB
- SHA256 949c185c70d78e08c86fad5c449aa4e5002e4baee545a3ff7ec549110a660398
- MD5 d18e630e71303857bde79f95fff68e92
- SHA1 c1f0b979bcebcc7fbb94d58fd232d30afb192146
- SHA512 719415abeb6dba48565741cdf65119bfa5957d596211c1c4920bc0facb9ba8b391ddd3a30c2c2637fd5fb934f7655863a74bfa354f3dfe79a89d5885c4b2b725
- SSDEEP 49152:D+rQpOwXWUVZ7Dc4cvep1F8uUoNJ0FE4n:W+WUVbcEhv8EC
- TLSH T12CB58E27A3A800E9D1BAC278CE579606E7737405137267EF16A087961F67BE41F3EB01
- MD5 SHA1 SHA512 SSDEEP TLSH
Score8/10-
Downloads MZ/PE file
-
Deletes itself
-
Executes dropped EXE
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.