General
- Target 2026-09-09_cd070f6e02365cd67d0d1cb2f63c608a_aspxspy_ezcob_glassworm_icedid_njrat_poison-ivy_stealc_vidar_xmrig
- Size 2.3MB
- Sample260910-3b3bnsxcrc
- SHA256 fe43d9461f1cbe353313901b764283dfbaa9434ecb762da30f8d1199fe4b3d5e
- MD5 cd070f6e02365cd67d0d1cb2f63c608a
- SHA1 3f9cf8a4b781b8fc71fd92527713677c29e3c947
- SHA512 7aabfc93b157e4da936984c52a4bf365683a2f5604eacc3f61fc47fd8ed47c6475cb88dd9b400e5f92418cf8716ecaa54982e7f3b9ad4625f3fab6fd4daca938
- SSDEEP 49152:00wjnJMOWh50kC1/dVFdx6e0EALKWVTffZiPAcRq6jHjnz8DhN7jcmWH/xbnbJoi:00GnJMOWPClFdx6e0EALKWVTffZiPAcr
- TLSH T1B8B5C06D626141F9C6AFC138C91B890FF7F138594374A5EB12A1579A2F237D0CA3AF21
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
2026-09-09_cd070f6e02365cd67d0d1cb2f63c608a_aspxspy_ezcob_glassworm_icedid_njrat_poison-ivy_stealc_vidar_xmrig.exe
Resource
win10v2004-20260513-en
9 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-09-09_cd070f6e02365cd67d0d1cb2f63c608a_aspxspy_ezcob_glassworm_icedid_njrat_poison-ivy_stealc_vidar_xmrig
- Size 2.3MB
- SHA256 fe43d9461f1cbe353313901b764283dfbaa9434ecb762da30f8d1199fe4b3d5e
- MD5 cd070f6e02365cd67d0d1cb2f63c608a
- SHA1 3f9cf8a4b781b8fc71fd92527713677c29e3c947
- SHA512 7aabfc93b157e4da936984c52a4bf365683a2f5604eacc3f61fc47fd8ed47c6475cb88dd9b400e5f92418cf8716ecaa54982e7f3b9ad4625f3fab6fd4daca938
- SSDEEP 49152:00wjnJMOWh50kC1/dVFdx6e0EALKWVTffZiPAcRq6jHjnz8DhN7jcmWH/xbnbJoi:00GnJMOWPClFdx6e0EALKWVTffZiPAcr
- TLSH T1B8B5C06D626141F9C6AFC138C91B890FF7F138594374A5EB12A1579A2F237D0CA3AF21
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Suspicious use of NtCreateUserProcessOtherParentProcess
-
XMRig Miner payload
-
Executes dropped EXE
-
Drops file in System32 directory