2026-05-23_9243c183367473cb4d1604c25e0f6a8f_cobalt-strike_coinminer_elex_glassworm_hijackloader_mespinoza_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-05-23_9243c183367473cb4d1604c25e0f6a8f_cobalt-strike_coinminer_elex_glassworm_hijackloader_mespinoza_vidar
Size 2.0MB
Sample260523-vmfcaaex7n
SHA256 74d22520a3bfe9bc1bf13d5bf3a8b7fa70e7c7feebc68124f4555ae22be16954
MD5 9243c183367473cb4d1604c25e0f6a8f
SHA1 74f74d57b813011583ac0e7a092316df02e6624e
SHA512 0e01592c07f244c57af4f8c15562c5513528901e8f6b5bd902bac76a6e26076567cca5befddbe8fafb77470c8856d2b4d273b8d5386066f0f45042cd51545a47
SSDEEP 24576:SuDKnxYaXJi2Y3MpbwnCvzb4cbmYdTyVDUoAI7D5TvinrmkBRiU:9DkYOMwwnMb4PmyVFv56rV5
TLSH
T15DA5F311B68986B5CC4F0E3085519636FA23BC5F7F1E77CB1E407A2A2AB76C06D35263
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-05-23_9243c183367473cb4d1604c25e0f6a8f_cobalt-strike_coinminer_elex_glassworm_hijackloader_mespinoza_vidar

File Explorer

2026-05-23_9243c183367473cb4d1604c25e0f6a8f_cobalt-strike_coinminer_elex_glassworm_hijackloader_mespinoza_vidar

.exe 2.0MB

2026-05-23_9243c183367473cb4d1604c25e0f6a8f_cobalt-strike_coinminer_elex_glassworm_hijackloader_mespinoza_vidar

IMPHASH 286f72003d945e10bc4564c5a22c2246
SHA256 74d22520a3bfe9bc1bf13d5bf3a8b7fa70e7c7feebc68124f4555ae22be16954
MD5 9243c183367473cb4d1604c25e0f6a8f
SHA1 74f74d57b813011583ac0e7a092316df02e6624e
SHA512 0e01592c07f244c57af4f8c15562c5513528901e8f6b5bd902bac76a6e26076567cca5befddbe8fafb77470c8856d2b4d273b8d5386066f0f45042cd51545a47
SSDEEP 24576:SuDKnxYaXJi2Y3MpbwnCvzb4cbmYdTyVDUoAI7D5TvinrmkBRiU:9DkYOMwwnMb4PmyVFv56rV5
TLSH
T15DA5F311B68986B5CC4F0E3085519636FA23BC5F7F1E77CB1E407A2A2AB76C06D35263
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

21661

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

P:\Target\x86\ship\licensing\x-none\ospprearm.pdb

ole32

CLSIDFromString

vcruntime140

wcsrchr _except_handler4_common __vcrt_InitializeCriticalSectionEx __telemetry_main_return_trigger __telemetry_main_invoke_trigger __std_exception_destroy __std_exception_copy memcpy __CxxFrameHandler3 _CxxThrowException memmove memset

msvcp140

_Thrd_id ?_Xout_of_range@std@@YAXPBD@Z ?_Xlength_error@std@@YAXPBD@Z ?_Xbad_alloc@std@@YAXXZ

api-ms-win-crt-string-l1-1-0

strncpy_s isdigit wcsncpy_s _stricmp wcscmp wcsncat_s wcscpy_s wcscat_s

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vfprintf __p__commode _set_fmode __acrt_iob_func

api-ms-win-crt-convert-l1-1-0

_wtol

api-ms-win-crt-runtime-l1-1-0

_register_onexit_function _initialize_onexit_table terminate _controlfp_s _errno _invalid_parameter_noinfo_noreturn _invalid_parameter_noinfo _register_thread_local_exe_atexit_callback _c_exit __p___wargv __p___argc _exit exit _initterm_e _initterm _get_initial_wide_environment _initialize_wide_environment _configure_wide_argv _crt_atexit _set_app_type _seh_filter_exe _cexit

api-ms-win-crt-heap-l1-1-0

free _set_new_mode malloc

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale __initialize_lconv_for_unsigned_char

kernel32

IsWow64Process GetSystemInfo RaiseException GetCurrentProcessId GetCurrentProcess CloseHandle DeleteCriticalSection VerSetConditionMask GetLastError SetErrorMode FreeLibrary GetModuleHandleW GetProcAddress LoadLibraryExW VerifyVersionInfoW MultiByteToWideChar WideCharToMultiByte EnterCriticalSection LeaveCriticalSection VirtualQuery TerminateProcess LoadLibraryExA IsDebuggerPresent InitializeSListHead IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter CreateEventW WaitForSingleObjectEx ResetEvent SetEvent WerRegisterMemoryBlock VirtualProtect GetTickCount GetCurrentThreadId HeapSetInformation GetProcessHeap QueryPerformanceCounter GetShortPathNameA GetModuleFileNameW GetModuleFileNameA GetSystemTimeAsFileTime InitializeCriticalSectionEx

advapi32

RegCloseKey RegQueryValueExW RegGetValueW RegCreateKeyExW RegOpenKeyExW

Sharing

General

Malware Config

Signatures

File Explorer

2026-05-23_9243c183367473cb4d1604c25e0f6a8f_cobalt-strike_coinminer_elex_glassworm_hijackloader_mespinoza_vidar

ole32

vcruntime140

msvcp140

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

kernel32

advapi32

generic