General
- Target 2026-08-10_1ea4a045f0a27363877e2f6b8b842bf2_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_qakbot_satacom_stealc
- Size 6.0MB
- Sample260810-rd82fsgf75
- SHA256 7f2b83a86f31bd78510432551ba35044ace72bcee05d1be938053619f664cdfd
- MD5 1ea4a045f0a27363877e2f6b8b842bf2
- SHA1 73c4df215d4b004210dda8ea85dc397e10a9f12e
- SHA512 5498d327567b2750c678a8dae0f37f85b8b9af68b682713b188b04e1792b496da2e302284385c41d7c13362eb421fa2c386d9ef75c816a79586173a1fdcab229
- SSDEEP 98304:Xl+0x9FjO509xZqNcxfH64NWgr28z4V5YtH:1hx9M509XqNcxfH64IF8zM5
- TLSH T13856AE56A6A450ECD5B7C178CA468617E7F2BC0513719BCF06A0A67A1F33AE12F3E710
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-10_1ea4a045f0a27363877e2f6b8b842bf2_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
Resource
win10v2004-20260513-en
25 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-10_1ea4a045f0a27363877e2f6b8b842bf2_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
Resource
win11ltsc2024-20260709-en
17 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-10_1ea4a045f0a27363877e2f6b8b842bf2_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_qakbot_satacom_stealc
- Size 6.0MB
- SHA256 7f2b83a86f31bd78510432551ba35044ace72bcee05d1be938053619f664cdfd
- MD5 1ea4a045f0a27363877e2f6b8b842bf2
- SHA1 73c4df215d4b004210dda8ea85dc397e10a9f12e
- SHA512 5498d327567b2750c678a8dae0f37f85b8b9af68b682713b188b04e1792b496da2e302284385c41d7c13362eb421fa2c386d9ef75c816a79586173a1fdcab229
- SSDEEP 98304:Xl+0x9FjO509xZqNcxfH64NWgr28z4V5YtH:1hx9M509XqNcxfH64IF8zM5
- TLSH T13856AE56A6A450ECD5B7C178CA468617E7F2BC0513719BCF06A0A67A1F33AE12F3E710
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops file in System32 directory
MITRE ATT&CK Enterprise v16
Defense Evasion
Modify Registry
1Subvert Trust Controls
2Install Root Certificate
2Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1