privateloader | 2026-05-26_578408000b3600c4c149688721ae30d8_cobalt-strike_coinminer_glassworm_icedid_njrat_remcos_satacom_stealc_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-05-26_578408000b3600c4c149688721ae30d8_cobalt-strike_coinminer_glassworm_icedid_njrat_remcos_satacom_stealc_vidar
Size 8.8MB
Sample260526-gap43aex5t
SHA256 07df1d2963ef3dacddad4c3a7a6a7b7cc4e7afff486b3722daab252b10965494
MD5 578408000b3600c4c149688721ae30d8
SHA1 83b94e3e493d8002d36453b8e265fe541f6d5312
SHA512 1a331cfe5e10e90861b481064753ba3fa8d9bf67c61148d6474592a923cd81d0c1d13f3f8289cff2c496c3299f62a77bcd110d748caea6ee94e2862d426f8e30
SSDEEP 196608:8Uli98CCRrsW5pl/uk2YisAv/XXYbTmkeYo6PY:86o8CCRRpdYYisAv/XXYbTmk51g
TLSH
T14D968E1262A9D1E8E0B6D138C96645F6E2B27C19CB7097CF1590BE693F73AE05F39310
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

loader privateloader

Malware Config

Signatures

Family: PrivateLoader
PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
loader privateloader

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-05-26_578408000b3600c4c149688721ae30d8_cobalt-strike_coinminer_glassworm_icedid_njrat_remcos_satacom_stealc_vidar

File Explorer

2026-05-26_578408000b3600c4c149688721ae30d8_cobalt-strike_coinminer_glassworm_icedid_njrat_remcos_satacom_stealc_vidar

.exe 8.8MB

2026-05-26_578408000b3600c4c149688721ae30d8_cobalt-strike_coinminer_glassworm_icedid_njrat_remcos_satacom_stealc_vidar

IMPHASH 5b99d091bc5043af5410d5c243c5a1b2
SHA256 07df1d2963ef3dacddad4c3a7a6a7b7cc4e7afff486b3722daab252b10965494
MD5 578408000b3600c4c149688721ae30d8
SHA1 83b94e3e493d8002d36453b8e265fe541f6d5312
SHA512 1a331cfe5e10e90861b481064753ba3fa8d9bf67c61148d6474592a923cd81d0c1d13f3f8289cff2c496c3299f62a77bcd110d748caea6ee94e2862d426f8e30
SSDEEP 196608:8Uli98CCRrsW5pl/uk2YisAv/XXYbTmkeYo6PY:86o8CCRRpdYYisAv/XXYbTmk51g
TLSH
T14D968E1262A9D1E8E0B6D138C96645F6E2B27C19CB7097CF1590BE693F73AE05F39310
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

3348700

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

H:\pub_18ntd\rc_bugfix_master_\Build\Release_x64\WPSOffice\wtoolex\wpsupdate.pdb

kernel32

SetEnvironmentVariableW SetCurrentDirectoryW GetCurrentDirectoryW DecodePointer CloseHandle RaiseException GetLastError HeapDestroy HeapAlloc HeapReAlloc HeapFree HeapSize GetProcessHeap InitializeCriticalSectionAndSpinCount DeleteCriticalSection SetEvent CreateMutexW OpenEventW Sleep GetCurrentProcessId GetSystemDirectoryW FreeLibrary GetModuleHandleW GetProcAddress LoadLibraryW GetPrivateProfileIntW CopyFileW CreateFileW DeleteFileW GetFileAttributesExW GetFileSize SetFilePointer WriteFile OutputDebugStringW ReleaseMutex WaitForSingleObject GetCurrentThreadId GetModuleFileNameW lstrlenA MultiByteToWideChar LocalFree VerSetConditionMask ExpandEnvironmentStringsW CreateDirectoryW FindClose FindFirstFileW FindNextFileW GetFileAttributesW GetFileSizeEx ReadFile RemoveDirectoryW GetPrivateProfileStringW MoveFileExW VerifyVersionInfoW EnterCriticalSection LeaveCriticalSection LoadLibraryExW LoadResource SizeofResource FindResourceW lstrcmpiW GetDiskFreeSpaceExW OpenMutexW CreateEventW TerminateProcess CreateThread TerminateThread OpenProcess GetLocalTime GetTickCount FindResourceExW LockResource WritePrivateProfileStringW WideCharToMultiByte GetSystemDefaultLangID GetEnvironmentVariableW GlobalMemoryStatusEx GetNativeSystemInfo GetSystemWow64DirectoryW GetComputerNameW GetGeoInfoW GetUserGeoID GetUserDefaultLCID RtlCaptureContext SetUnhandledExceptionFilter GetCurrentProcess GetProcessId GetLongPathNameW GetExitCodeProcess ProcessIdToSessionId GetVersionExW ReadProcessMemory GetModuleHandleA CreateToolhelp32Snapshot Process32FirstW Process32NextW SetLastError GetWindowsDirectoryW MulDiv lstrlenW ResetEvent WaitForMultipleObjects GlobalFree WaitNamedPipeW GetOverlappedResult CancelIo GetCurrentThread GetExitCodeThread ResumeThread MoveFileW GetDateFormatW GetTimeFormatW CreateFileA DeviceIoControl GetSystemTime SetNamedPipeHandleState InitializeCriticalSection TlsAlloc TlsGetValue TlsSetValue TlsFree FormatMessageW GetModuleHandleExW GetStdHandle GetFileType RtlVirtualUnwind SwitchToFiber DeleteFiber CreateFiber QueryPerformanceCounter GetSystemTimeAsFileTime ConvertFiberToThread ConvertThreadToFiber GetConsoleMode SetConsoleMode ReadConsoleA ReadConsoleW LoadLibraryA QueryPerformanceFrequency SleepEx GetFullPathNameW MoveFileExA GetEnvironmentVariableA CompareFileTime PeekNamedPipe FlushInstructionCache VirtualAlloc VirtualProtect VirtualFree VirtualQuery LoadLibraryExA LocalFileTimeToFileTime SetFileTime SystemTimeToFileTime GetSystemInfo GetStringTypeW InitializeSRWLock ReleaseSRWLockExclusive AcquireSRWLockExclusive InitializeCriticalSectionEx TryEnterCriticalSection FormatMessageA GetFileInformationByHandleEx EncodePointer CompareStringEx GetCPInfo LCMapStringEx GetLocaleInfoEx WaitForSingleObjectEx RtlLookupFunctionEntry UnhandledExceptionFilter IsProcessorFeaturePresent InitializeSListHead IsDebuggerPresent GetStartupInfoW InterlockedPopEntrySList InterlockedPushEntrySList RtlPcToFileHeader RtlUnwindEx FindFirstFileExW SystemTimeToTzSpecificLocalTime FileTimeToSystemTime SetConsoleCtrlHandler ExitThread FreeLibraryAndExitThread ExitProcess GetDriveTypeW GetFileInformationByHandle SetFilePointerEx WriteConsoleW GetConsoleCP CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale EnumSystemLocalesW GetTimeZoneInformation FlushFileBuffers SetStdHandle SetEndOfFile IsValidCodePage GetACP GetOEMCP GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW GetPrivateProfileSectionW GetUserDefaultUILanguage CreateProcessW AreFileApisANSI RtlUnwind

Name

.text

Size

3.9MB

Virtual Size

3.9MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.1MB

Virtual Size

1.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

55KB

Virtual Size

94KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

151KB

Virtual Size

151KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.detourc

Size

8KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.detourd

Size

512B

Virtual Size

24B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_RDATA

Size

512B

Virtual Size

244B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1.8MB

Virtual Size

1.8MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

1.7MB

Virtual Size

1.7MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-05-26_578408000b3600c4c149688721ae30d8_cobalt-strike_coinminer_glassworm_icedid_njrat_remcos_satacom_stealc_vidar

kernel32

generic