General
- Target 2026-08-23_4b7e89e739abb057d6101173a55cf830_amadey_coinminer_glassworm_hijackloader_icedid_luca-stealer_njrat_stealc
- Size 23.0MB
- Sample260824-pkklbstshy
- SHA256 e64cd1ddffd68444f4444e5c98cb63fe9d1086b8e23a2edbf5fda843a5335b5b
- MD5 4b7e89e739abb057d6101173a55cf830
- SHA1 fa353b16aa27c86a284618950e6550abb411b115
- SHA512 3c6967a5162a67500044d1e4289a6f75f729316b08eff5ce0711f0689b1506ac6e7979c9cef08d11d94a1767e8cfd6ad6ab1a84b1695b0ed60d74f1220040ee8
- SSDEEP 393216:HWqywxqhNYEUzpogQ7VPA1c7IuSduT4GPDxGWcS4xC3C+/:H+Dq1HZdusiEzS4xCS+/
- TLSH T11137E00373E440A4E1BA92358A67C637D672BC150B3196DF56E09D6B3F32BE15A3D322
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
6 signatures
Behavioral task
behavioral1
Sample
2026-08-23_4b7e89e739abb057d6101173a55cf830_amadey_coinminer_glassworm_hijackloader_icedid_luca-stealer_njrat_stealc.exe
Resource
win10v2004-20260513-en
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-23_4b7e89e739abb057d6101173a55cf830_amadey_coinminer_glassworm_hijackloader_icedid_luca-stealer_njrat_stealc.exe
Resource
win11ltsc2024-20260709-en
5 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-23_4b7e89e739abb057d6101173a55cf830_amadey_coinminer_glassworm_hijackloader_icedid_luca-stealer_njrat_stealc
- Size 23.0MB
- SHA256 e64cd1ddffd68444f4444e5c98cb63fe9d1086b8e23a2edbf5fda843a5335b5b
- MD5 4b7e89e739abb057d6101173a55cf830
- SHA1 fa353b16aa27c86a284618950e6550abb411b115
- SHA512 3c6967a5162a67500044d1e4289a6f75f729316b08eff5ce0711f0689b1506ac6e7979c9cef08d11d94a1767e8cfd6ad6ab1a84b1695b0ed60d74f1220040ee8
- SSDEEP 393216:HWqywxqhNYEUzpogQ7VPA1c7IuSduT4GPDxGWcS4xC3C+/:H+Dq1HZdusiEzS4xCS+/
- TLSH T11137E00373E440A4E1BA92358A67C637D672BC150B3196DF56E09D6B3F32BE15A3D322
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10-
Detected Nirsoft tools
Free utilities often used by attackers which can steal passwords, product keys, etc.
-
Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers
-
Detects executables manipulated with Fody
-
Detects executables referencing many IR and analysis tools
-
UPX dump on OEP (original entry point)