General
- Target 2026-08-30_ca6f4e8da061e7ea723c1856b0c0984f_glassworm_icedid_imuler_njrat_stealc_vidar_xmrig
- Size 1.8MB
- Sample260831-e4fflsdk41
- SHA256 6915fc4ec7975133a37b6615fe5f92d3b32d3d2f17adbcb7f719d0aa84da8ed0
- MD5 ca6f4e8da061e7ea723c1856b0c0984f
- SHA1 cce6c3c1f9c12284738b80cd54a7365fd41e9192
- SHA512 61c751fdd7e9c3e4b89a3704193f99c10a26504f39e4c98946cd46ea5add800f06ad01a84e5b15508dbf7f5659415d0ec883d878d0375c261a040d7a969428e2
- SSDEEP 49152:00wjnJMOWh50kC1/dVFdx6e0EALKWVTffZiPAcRq6jHjnz8Dhtd+egz22Q:00GnJMOWPClFdx6e0EALKWVTffZiPAcS
- TLSH T16A95AE6D729041F9C6AFC178C91B890FF7F13859436495EB12A157AA2F237D0CA3AF21
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
2026-08-30_ca6f4e8da061e7ea723c1856b0c0984f_glassworm_icedid_imuler_njrat_stealc_vidar_xmrig.exe
Resource
win10v2004-20260513-en
9 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-30_ca6f4e8da061e7ea723c1856b0c0984f_glassworm_icedid_imuler_njrat_stealc_vidar_xmrig
- Size 1.8MB
- SHA256 6915fc4ec7975133a37b6615fe5f92d3b32d3d2f17adbcb7f719d0aa84da8ed0
- MD5 ca6f4e8da061e7ea723c1856b0c0984f
- SHA1 cce6c3c1f9c12284738b80cd54a7365fd41e9192
- SHA512 61c751fdd7e9c3e4b89a3704193f99c10a26504f39e4c98946cd46ea5add800f06ad01a84e5b15508dbf7f5659415d0ec883d878d0375c261a040d7a969428e2
- SSDEEP 49152:00wjnJMOWh50kC1/dVFdx6e0EALKWVTffZiPAcRq6jHjnz8Dhtd+egz22Q:00GnJMOWPClFdx6e0EALKWVTffZiPAcS
- TLSH T16A95AE6D729041F9C6AFC178C91B890FF7F13859436495EB12A157AA2F237D0CA3AF21
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Suspicious use of NtCreateUserProcessOtherParentProcess
-
XMRig Miner payload
-
Executes dropped EXE
-
Drops file in System32 directory