Analysis
- max time kernel
149s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
30/07/2026, 04:42
Static task
static1
Behavioral task
behavioral1
Sample
2026-07-30_f7207cd30d32a1885beeb074b1395218_coinminer_glassworm_helldown_icedid_luca-stealer_njrat_stealc.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-30_f7207cd30d32a1885beeb074b1395218_coinminer_glassworm_helldown_icedid_luca-stealer_njrat_stealc.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
General
- Target 2026-07-30_f7207cd30d32a1885beeb074b1395218_coinminer_glassworm_helldown_icedid_luca-stealer_njrat_stealc.exe
- Size 2.4MB
- Sample260730-fb1rhss1dy
- SHA256 98f2834b4139bde1cc1afcd5f17a995cecb3d232f49de5bacef79ad2aadee8d0
- MD5 f7207cd30d32a1885beeb074b1395218
- SHA1 a42da119ab07146d8bedd8001f4e8edf1b6ff93d
- SHA512 fb1309f98c04d944115819e3c12281f501042ed64921692712be77e31b243c471ed212b74f2b6a6ed0e1edb03ee1f373ee959514459432765d30fbef2d5d320c
- SSDEEP 49152:YjW2u0VJbNSkyympShZSgv93w3+Sa/qoD7r47:38okykSgu3PCD3G
- TLSH T12BB58E27A3E800F9D1BAC278CE479A06E7727405037267EF16A046A55F67BE04F3E752
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
Malware Config
Signatures
- Contacts third-party web service commonly abused for C2 1 TTPs 35 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
flow ioc 32 raw.githubusercontent.com 41 raw.githubusercontent.com 94 raw.githubusercontent.com 163 raw.githubusercontent.com 196 raw.githubusercontent.com 1 raw.githubusercontent.com 60 raw.githubusercontent.com 76 raw.githubusercontent.com 86 raw.githubusercontent.com 90 raw.githubusercontent.com 206 raw.githubusercontent.com 14 raw.githubusercontent.com 54 raw.githubusercontent.com 106 raw.githubusercontent.com 111 raw.githubusercontent.com 120 raw.githubusercontent.com 142 raw.githubusercontent.com 151 raw.githubusercontent.com 200 raw.githubusercontent.com 96 raw.githubusercontent.com 99 raw.githubusercontent.com 159 raw.githubusercontent.com 192 raw.githubusercontent.com 37 raw.githubusercontent.com 66 raw.githubusercontent.com 72 raw.githubusercontent.com 123 raw.githubusercontent.com 130 raw.githubusercontent.com 213 raw.githubusercontent.com 173 raw.githubusercontent.com 182 raw.githubusercontent.com 183 raw.githubusercontent.com 144 raw.githubusercontent.com 155 raw.githubusercontent.com 211 raw.githubusercontent.com - Downloads MZ/PE file 8 IoCs
flow pid Process 37 2636 2026-07-30_f7207cd30d32a1885beeb074b1395218_coinminer_glassworm_helldown_icedid_luca-stealer_njrat_stealc.exe 41 2636 2026-07-30_f7207cd30d32a1885beeb074b1395218_coinminer_glassworm_helldown_icedid_luca-stealer_njrat_stealc.exe 54 2636 2026-07-30_f7207cd30d32a1885beeb074b1395218_coinminer_glassworm_helldown_icedid_luca-stealer_njrat_stealc.exe 66 2636 2026-07-30_f7207cd30d32a1885beeb074b1395218_coinminer_glassworm_helldown_icedid_luca-stealer_njrat_stealc.exe 72 2636 2026-07-30_f7207cd30d32a1885beeb074b1395218_coinminer_glassworm_helldown_icedid_luca-stealer_njrat_stealc.exe 76 2636 2026-07-30_f7207cd30d32a1885beeb074b1395218_coinminer_glassworm_helldown_icedid_luca-stealer_njrat_stealc.exe 79 2636 2026-07-30_f7207cd30d32a1885beeb074b1395218_coinminer_glassworm_helldown_icedid_luca-stealer_njrat_stealc.exe 123 2636 2026-07-30_f7207cd30d32a1885beeb074b1395218_coinminer_glassworm_helldown_icedid_luca-stealer_njrat_stealc.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2636 2026-07-30_f7207cd30d32a1885beeb074b1395218_coinminer_glassworm_helldown_icedid_luca-stealer_njrat_stealc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-30_f7207cd30d32a1885beeb074b1395218_coinminer_glassworm_helldown_icedid_luca-stealer_njrat_stealc.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-30_f7207cd30d32a1885beeb074b1395218_coinminer_glassworm_helldown_icedid_luca-stealer_njrat_stealc.exe"1⤵
- Downloads MZ/PE file
- Suspicious use of FindShellTrayWindow
PID:2636