494f4e26d6be3a3911e8cf23f251a5c1ca0f0e86729acde98b2bd4e429eb8a0a

General

Target
2026-08-17_ec4a43692b5d864314d65998f8d8a111_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar
Size 40.7MB
Sample260817-plz3eabk2y
SHA256 494f4e26d6be3a3911e8cf23f251a5c1ca0f0e86729acde98b2bd4e429eb8a0a
MD5 ec4a43692b5d864314d65998f8d8a111
SHA1 7080ed111c2fb729225924a8b952121ff43f1d5a
SHA512 a2f0b8e668592d73b73c461c56d57b576499e7c360ec536a453107ee9d36d07eac0f59f2d18e0cd294be02b25c540ac4cd739208e49cb1a899f1e6c6e47ed20b
SSDEEP 49152:UJXVSCM39nmT5ocV1Nxst3ZbypRxG80FfElQ+XwxhxuhSnY53G3SrXJAdrFejnti:Uu/9nmHZLxG80DuKA3XAD8ntZfh6fgCl
TLSH
T130974C02F7054AAFE07A9234489B8F61E335D8B146B1937723F55B2C1EEF34C4EA6964
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-08-17_ec4a43692b5d864314d65998f8d8a111_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar
- Size 40.7MB
- SHA256 494f4e26d6be3a3911e8cf23f251a5c1ca0f0e86729acde98b2bd4e429eb8a0a
- MD5 ec4a43692b5d864314d65998f8d8a111
- SHA1 7080ed111c2fb729225924a8b952121ff43f1d5a
- SHA512 a2f0b8e668592d73b73c461c56d57b576499e7c360ec536a453107ee9d36d07eac0f59f2d18e0cd294be02b25c540ac4cd739208e49cb1a899f1e6c6e47ed20b
- SSDEEP 49152:UJXVSCM39nmT5ocV1Nxst3ZbypRxG80FfElQ+XwxhxuhSnY53G3SrXJAdrFejnti:Uu/9nmHZLxG80DuKA3XAD8ntZfh6fgCl
- TLSH
  T130974C02F7054AAFE07A9234489B8F61E335D8B146B1937723F55B2C1EEF34C4EA6964
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution exploit persistence privilege_escalation spyware trojan upx
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Detects executables calling ClearMyTracksByProcess
- Detects executables containing artifacts associated with disabling Widnows Defender
- UPX dump on OEP (original entry point)
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Drops file in Drivers directory
- Modifies RDP port number used by Windows
- Possible privilege escalation attempt
  exploit
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2