General
- Target 2026-11-02_c31619bd09833f54c572fc3906c45432_coinminer_glassworm_hammertoss_hijackloader_icedid_luca-stealer_njrat_poet-rat_quasar-rat_stealc_vidar
- Size 30.6MB
- Sample261102-3fl59adx9v
- SHA256 1858a40496a1f027d267ec1409c84f17df43f46619f6f2ff7d25dbef1ffca8a8
- MD5 c31619bd09833f54c572fc3906c45432
- SHA1 8aa693d8b5b7fb962e8fb394a5c9d3100d94ffb4
- SHA512 35d4c162658d1e0d94e02ac449c5043d7e99c2573f37277a0e5f71ddf2313dbafce35d402931b2ba5e4878ff4cb93cef2664c7cfcfe89dfd69f23466c4c7c133
- SSDEEP 393216:0SD2sm2Eyxq5RAGEJjwZBKfiJyI4MoIhprEBEdBbkkB43:0SqIpeZBKSgMnrrkEd
- TLSH T16067AD1473E89F26C5AF4F75A0F1062093B6B44A6B62D78F328C56FA1F53B905D213A3
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
3 signatures
Behavioral task
behavioral1
Sample
2026-11-02_c31619bd09833f54c572fc3906c45432_coinminer_glassworm_hammertoss_hijackloader_icedid_luca-.exe
Resource
win10v2004-20260911-en
17 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-11-02_c31619bd09833f54c572fc3906c45432_coinminer_glassworm_hammertoss_hijackloader_icedid_luca-.exe
Resource
win11ltsc2024-20260911-en
15 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-11-02_c31619bd09833f54c572fc3906c45432_coinminer_glassworm_hammertoss_hijackloader_icedid_luca-stealer_njrat_poet-rat_quasar-rat_stealc_vidar
- Size 30.6MB
- SHA256 1858a40496a1f027d267ec1409c84f17df43f46619f6f2ff7d25dbef1ffca8a8
- MD5 c31619bd09833f54c572fc3906c45432
- SHA1 8aa693d8b5b7fb962e8fb394a5c9d3100d94ffb4
- SHA512 35d4c162658d1e0d94e02ac449c5043d7e99c2573f37277a0e5f71ddf2313dbafce35d402931b2ba5e4878ff4cb93cef2664c7cfcfe89dfd69f23466c4c7c133
- SSDEEP 393216:0SD2sm2Eyxq5RAGEJjwZBKfiJyI4MoIhprEBEdBbkkB43:0SqIpeZBKSgMnrrkEd
- TLSH T16067AD1473E89F26C5AF4F75A0F1062093B6B44A6B62D78F328C56FA1F53B905D213A3
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detects Windows executables referencing non-Windows User-Agents
-
Uses browser remote debugging
Can be used to control the browser and steal sensitive information such as credentials and session cookies.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL
-
Checks whether UAC is enabled