General
- Target 2026-08-31_b719795f52cb005ae85483c230438297_coinminer_gazer_glassworm_helldown_icedid_luca-stealer_njrat_remcos
- Size 12.5MB
- Sample260831-sxa47scl3z
- SHA256 f4aadb581683088d8e45aeea5dc7602d0f7828bb5d46279c57808938c09164ce
- MD5 b719795f52cb005ae85483c230438297
- SHA1 c1811ee41227695c4c41d9c6abe59c87d418d395
- SHA512 11502d539bc77a7c9f69641877909d8cfde1e3e33d0b576c65d1e0f4725cf2b26b0e311441627795124085d5dc1c8c948edfb876e3da24286a80564fd5e18025
- SSDEEP 196608:DcgTervESTMh5FQR4+S2T0i8Vdb27mOEG:DcznMh5FI4Ih4aiOEG
- TLSH T190D69EAAF2B900D8C45BC17882565723EB71B85A0B7066DF265462B52FB3BE01F7DF04
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-31_b719795f52cb005ae85483c230438297_coinminer_gazer_glassworm_helldown_icedid_luca-stealer_njrat_remcos.exe
Resource
win10v2004-20260513-en
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-31_b719795f52cb005ae85483c230438297_coinminer_gazer_glassworm_helldown_icedid_luca-stealer_njrat_remcos.exe
Resource
win11ltsc2024-20260709-en
8 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-31_b719795f52cb005ae85483c230438297_coinminer_gazer_glassworm_helldown_icedid_luca-stealer_njrat_remcos
- Size 12.5MB
- SHA256 f4aadb581683088d8e45aeea5dc7602d0f7828bb5d46279c57808938c09164ce
- MD5 b719795f52cb005ae85483c230438297
- SHA1 c1811ee41227695c4c41d9c6abe59c87d418d395
- SHA512 11502d539bc77a7c9f69641877909d8cfde1e3e33d0b576c65d1e0f4725cf2b26b0e311441627795124085d5dc1c8c948edfb876e3da24286a80564fd5e18025
- SSDEEP 196608:DcgTervESTMh5FQR4+S2T0i8Vdb27mOEG:DcznMh5FI4Ih4aiOEG
- TLSH T190D69EAAF2B900D8C45BC17882565723EB71B85A0B7066DF265462B52FB3BE01F7DF04
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10-
Enumerates VirtualBox registry keys
-
Identifies VirtualBox via ACPI registry values (likely anti-VM)
-
Looks for VirtualBox Guest Additions in registry
-
Looks for VMWare Tools registry key
-
Looks for VMWare services registry key.