General
- Target 2026-08-05_c4ee6b82c18d5ec89de4df487d233efa_coinminer_glassworm_icedid_luca-stealer_njrat_quasar-rat_stealc_xmrig
- Size 7.2MB
- Sample260805-kzypaatdld
- SHA256 15cd26a4beea99788f0e0082eb6d945ba3d38a4de6481c361fcfc9dd02827233
- MD5 c4ee6b82c18d5ec89de4df487d233efa
- SHA1 02d634c8ec9ea029e8bed3aea7fea09f4a98ba34
- SHA512 050b7a82f291a6a0025318d3056d2dbc6b52578308a9488a1b867e9bed33e8b5794cf367f4bcd69fa2b59af06b152cd1f25d6414029748ce7804a0b20f922bb9
- SSDEEP 98304:KeYQZ4/01fu+zC6Ob2cUl/6pRedsp/KepIKJaz3eHp+ee6Mjr:50s1fhzCt6cUIp+spiep70qHpNcjr
- TLSH T1C3767D57A2A540E8C83BC178C6965633E7B2B8155330ABDF16A4D7361F33AD05E3EB24
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
2026-08-05_c4ee6b82c18d5ec89de4df487d233efa_coinminer_glassworm_icedid_luca-stealer_njrat_quasar-rat_stealc_xmrig.exe
Resource
win10v2004-20260513-en
9 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-05_c4ee6b82c18d5ec89de4df487d233efa_coinminer_glassworm_icedid_luca-stealer_njrat_quasar-rat_stealc_xmrig
- Size 7.2MB
- SHA256 15cd26a4beea99788f0e0082eb6d945ba3d38a4de6481c361fcfc9dd02827233
- MD5 c4ee6b82c18d5ec89de4df487d233efa
- SHA1 02d634c8ec9ea029e8bed3aea7fea09f4a98ba34
- SHA512 050b7a82f291a6a0025318d3056d2dbc6b52578308a9488a1b867e9bed33e8b5794cf367f4bcd69fa2b59af06b152cd1f25d6414029748ce7804a0b20f922bb9
- SSDEEP 98304:KeYQZ4/01fu+zC6Ob2cUl/6pRedsp/KepIKJaz3eHp+ee6Mjr:50s1fhzCt6cUIp+spiep70qHpNcjr
- TLSH T1C3767D57A2A540E8C83BC178C6965633E7B2B8155330ABDF16A4D7361F33AD05E3EB24
- MD5 SHA1 SHA512 SSDEEP TLSH
-
XMRig Miner payload
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
-
Suspicious use of SetThreadContext