General
- Target 2026-09-13_ecbc964bdd37f10413b1ac803944ef0e_cobalt-strike_coinminer_elex_glassworm_icedid_luca-stealer_njrat_revil_stealc_vidar
- Size 3.5MB
- Sample260913-krv87avcrb
- SHA256 a5b4a621eb596c37ff15fa6c872c1304f881376f7dbd45cad1aa099d2bfc25ff
- MD5 ecbc964bdd37f10413b1ac803944ef0e
- SHA1 2712674c1a8a5c407de8e601c6bd43b5e3c6fc14
- SHA512 5ea164a04a435e5581c9ee5711c92e622d6d432234b24e1d87b7eb5a930fa5b28c980ce2fcce6145302c1d279dcca900fdcad96efc1681f79a90550a17b32147
- SSDEEP 49152:BCMndVKSfF5MCL7L/4Bn2ZGA+21DW0Zl+lNal2L6kb3NNo31wvmT6CdPLbFlHTRl:UMndVKUG6GtejZl5DwvilbFl+MHJz
- TLSH T158068D57A7A801F9C4B7D178C9674A03E7F1B80613709BDB03B09A652F236E29E3E751
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-09-13_ecbc964bdd37f10413b1ac803944ef0e_cobalt-strike_coinminer_elex_glassworm_icedid_luca-steal.exe
Resource
win10v2004-20260911-en
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-09-13_ecbc964bdd37f10413b1ac803944ef0e_cobalt-strike_coinminer_elex_glassworm_icedid_luca-steal.exe
Resource
win11ltsc2024-20260911-en
8 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-09-13_ecbc964bdd37f10413b1ac803944ef0e_cobalt-strike_coinminer_elex_glassworm_icedid_luca-stealer_njrat_revil_stealc_vidar
- Size 3.5MB
- SHA256 a5b4a621eb596c37ff15fa6c872c1304f881376f7dbd45cad1aa099d2bfc25ff
- MD5 ecbc964bdd37f10413b1ac803944ef0e
- SHA1 2712674c1a8a5c407de8e601c6bd43b5e3c6fc14
- SHA512 5ea164a04a435e5581c9ee5711c92e622d6d432234b24e1d87b7eb5a930fa5b28c980ce2fcce6145302c1d279dcca900fdcad96efc1681f79a90550a17b32147
- SSDEEP 49152:BCMndVKSfF5MCL7L/4Bn2ZGA+21DW0Zl+lNal2L6kb3NNo31wvmT6CdPLbFlHTRl:UMndVKUG6GtejZl5DwvilbFl+MHJz
- TLSH T158068D57A7A801F9C4B7D178C9674A03E7F1B80613709BDB03B09A652F236E29E3E751
- MD5 SHA1 SHA512 SSDEEP TLSH
Score7/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Adds Run key to start application