General
- Target 2026-08-23_3cef6a74ca38a2e789465ff12d0596d1_avaddon_cobalt-strike_coinminer_glassworm_icedid_njrat_pos_satacom_stealc_vidar_zxxz
- Size 66.4MB
- Sample260824-qvlf2sydkh
- SHA256 14030dbb22ddba896e4c81016e6ff03a38867c24ef07b9f5e0647d568ae7ff4e
- MD5 3cef6a74ca38a2e789465ff12d0596d1
- SHA1 ae1945b2be09e2173193c53e44777862e57418ab
- SHA512 915708ad25a39cf20194995466b3302b6b54b59d3f05122c5bb77a4023a8af593640d118a9950f8b6e01fc7ed08262ce8954c7fed3ac6f8baa3622b3ac82436a
- SSDEEP 393216:RQgHDlanaGBXvDKtz+bhPWES4tiNQPNrIKc4gaPbUAgrO4mgq96l+ZArYsFRlyXC:R3on1HvSzxAMNqFZArYs6XN049cv
- TLSH T1ADE7BE03B2E505A3D5679234C99B0203E772B4234B34DADB719C43582FAB7E09A7F7A5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
10 signatures
Behavioral task
behavioral1
Sample
2026-08-23_3cef6a74ca38a2e789465ff12d0596d1_avaddon_cobalt-strike_coinminer_glassworm_icedid_njrat_p.exe
Resource
win10v2004-20260513-en
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-23_3cef6a74ca38a2e789465ff12d0596d1_avaddon_cobalt-strike_coinminer_glassworm_icedid_njrat_p.exe
Resource
win11ltsc2024-20260709-en
5 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-23_3cef6a74ca38a2e789465ff12d0596d1_avaddon_cobalt-strike_coinminer_glassworm_icedid_njrat_pos_satacom_stealc_vidar_zxxz
- Size 66.4MB
- SHA256 14030dbb22ddba896e4c81016e6ff03a38867c24ef07b9f5e0647d568ae7ff4e
- MD5 3cef6a74ca38a2e789465ff12d0596d1
- SHA1 ae1945b2be09e2173193c53e44777862e57418ab
- SHA512 915708ad25a39cf20194995466b3302b6b54b59d3f05122c5bb77a4023a8af593640d118a9950f8b6e01fc7ed08262ce8954c7fed3ac6f8baa3622b3ac82436a
- SSDEEP 393216:RQgHDlanaGBXvDKtz+bhPWES4tiNQPNrIKc4gaPbUAgrO4mgq96l+ZArYsFRlyXC:R3on1HvSzxAMNqFZArYs6XN049cv
- TLSH T1ADE7BE03B2E505A3D5679234C99B0203E772B4234B34DADB719C43582FAB7E09A7F7A5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score7/10-
Loads dropped DLL
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.