General
- Target 2026-08-28_e5ec048d0f60c8ded282f42a59d64679_coinminer_elex_glassworm_icedid_njrat_qakbot
- Size 4.4MB
- Sample260828-hsbj3afm8y
- SHA256 0064092921cc0c8b5f18f128a5c6c8bb8c79f1f6cb3da07f57966910eb613c7f
- MD5 e5ec048d0f60c8ded282f42a59d64679
- SHA1 38350bf566c3b72c0d1ede2ab1ed35f78e008c98
- SHA512 b5418f64e680bb93dac45b7b3d28cb5120ece45e5451524a76bb0de01cbb30a81cbdf845be0817342f80d6362717a6cc8cf7516d47c1699285ba27f290ec6295
- SSDEEP 49152:SPcrboZDTNN6dZ4gTvtPcmZx8JUUYGR7TrnyCp:q6X4gDeUoU4ny0
- TLSH T10526B21173F94885F2F36B30AEB581145B36BDA56AF2C62E314C518E1FB5A50BE31B32
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
3 signatures
Behavioral task
behavioral1
Sample
2026-08-28_e5ec048d0f60c8ded282f42a59d64679_coinminer_elex_glassworm_icedid_njrat_qakbot.exe
Resource
win10v2004-20260513-en
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-28_e5ec048d0f60c8ded282f42a59d64679_coinminer_elex_glassworm_icedid_njrat_qakbot.exe
Resource
win11ltsc2024-20260709-en
6 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-28_e5ec048d0f60c8ded282f42a59d64679_coinminer_elex_glassworm_icedid_njrat_qakbot
- Size 4.4MB
- SHA256 0064092921cc0c8b5f18f128a5c6c8bb8c79f1f6cb3da07f57966910eb613c7f
- MD5 e5ec048d0f60c8ded282f42a59d64679
- SHA1 38350bf566c3b72c0d1ede2ab1ed35f78e008c98
- SHA512 b5418f64e680bb93dac45b7b3d28cb5120ece45e5451524a76bb0de01cbb30a81cbdf845be0817342f80d6362717a6cc8cf7516d47c1699285ba27f290ec6295
- SSDEEP 49152:SPcrboZDTNN6dZ4gTvtPcmZx8JUUYGR7TrnyCp:q6X4gDeUoU4ny0
- TLSH T10526B21173F94885F2F36B30AEB581145B36BDA56AF2C62E314C518E1FB5A50BE31B32
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10-
Detects executables built or packed with MPress PE compressor
-
Detects executables referencing many IR and analysis tools
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE