General
- Target 2026-08-01_4e9f886499d7a04f33c4c3b8d08e9405_coinminer_glassworm_icedid_luca-stealer_njrat_quasar-rat_stealc_xmrig
- Size 7.2MB
- Sample260801-vgbf5s1fmc
- SHA256 fbaa058c814afef345cf2890d130bf9a56b18bc06b7a9951073a45a45377f278
- MD5 4e9f886499d7a04f33c4c3b8d08e9405
- SHA1 fd5d04f99254ff40f6f32f21b1d24e85ac521d0e
- SHA512 839a0ecb7259c310172af8a33f6cdb4165b117422e6053a055336cf2a8516197bec7c483db929a42365daf46464d26188ab6c5d31c67decb6056f675cc62b558
- SSDEEP 98304:Fc5bsfTzC6Ob2cUl/6pRedsp/KepIKJaz3eHp+ee6Mjr:uRsbzCt6cUIp+spiep70qHpNcjr
- TLSH T1B8768D17A6A540E8C87BC178C6865633E6B1B8195370ABDF16A4D7361F33EE01E3E724
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
2026-08-01_4e9f886499d7a04f33c4c3b8d08e9405_coinminer_glassworm_icedid_luca-stealer_njrat_quasar-rat_stealc_xmrig.exe
Resource
win10v2004-20260513-en
9 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-01_4e9f886499d7a04f33c4c3b8d08e9405_coinminer_glassworm_icedid_luca-stealer_njrat_quasar-rat_stealc_xmrig
- Size 7.2MB
- SHA256 fbaa058c814afef345cf2890d130bf9a56b18bc06b7a9951073a45a45377f278
- MD5 4e9f886499d7a04f33c4c3b8d08e9405
- SHA1 fd5d04f99254ff40f6f32f21b1d24e85ac521d0e
- SHA512 839a0ecb7259c310172af8a33f6cdb4165b117422e6053a055336cf2a8516197bec7c483db929a42365daf46464d26188ab6c5d31c67decb6056f675cc62b558
- SSDEEP 98304:Fc5bsfTzC6Ob2cUl/6pRedsp/KepIKJaz3eHp+ee6Mjr:uRsbzCt6cUIp+spiep70qHpNcjr
- TLSH T1B8768D17A6A540E8C87BC178C6865633E6B1B8195370ABDF16A4D7361F33EE01E3E724
- MD5 SHA1 SHA512 SSDEEP TLSH
-
XMRig Miner payload
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
-
Suspicious use of SetThreadContext