2026-06-10_1af10790a1e43b3a62f28fbb460887fc_amadey_cobalt-strike_coinminer_dosia_glassworm_icedid_njrat_poet-rat_quasar-rat_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-06-10_1af10790a1e43b3a62f28fbb460887fc_amadey_cobalt-strike_coinminer_dosia_glassworm_icedid_njrat_poet-rat_quasar-rat_vidar
Size 71.8MB
Sample260610-a551faby2x
SHA256 ec1c638ec0d2afd3fb7e75031d4d1a7271df843b97a9f360f789e1f4f9c64290
MD5 1af10790a1e43b3a62f28fbb460887fc
SHA1 806c1d36bfbbb61f342fde77872a50ff320fa9c1
SHA512 08385acd0cfd037f4c7e077e9f8d5fda3e8a6da22a3d4332da8253e77a45fb0c7ae0347de6ae9ad705e182fd9a8f5211f51809810b94bb26c434b75e09ca1742
SSDEEP 196608:N5VjSGhrqNLbc+FFmb43OgrRVXrqNblvQkq2QB2TpCjPxTjH+uqBYXAV:N5VHhrqNHcTgrRNrqN/QB2pOxTjyuc
TLSH
T1C7F7C546F605CDCAF86292B8449B8F61A332ECB08760939733A577296FFE78C4DB1544
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-06-10_1af10790a1e43b3a62f28fbb460887fc_amadey_cobalt-strike_coinminer_dosia_glassworm_icedid_njrat_poet-rat_quasar-rat_vidar

File Explorer

2026-06-10_1af10790a1e43b3a62f28fbb460887fc_amadey_cobalt-strike_coinminer_dosia_glassworm_icedid_njrat_poet-rat_quasar-rat_vidar

.exe 71.8MB

2026-06-10_1af10790a1e43b3a62f28fbb460887fc_amadey_cobalt-strike_coinminer_dosia_glassworm_icedid_njrat_poet-rat_quasar-rat_vidar

IMPHASH e611cb40dae30a74fa3f15a0e816a66a
SHA256 ec1c638ec0d2afd3fb7e75031d4d1a7271df843b97a9f360f789e1f4f9c64290
MD5 1af10790a1e43b3a62f28fbb460887fc
SHA1 806c1d36bfbbb61f342fde77872a50ff320fa9c1
SHA512 08385acd0cfd037f4c7e077e9f8d5fda3e8a6da22a3d4332da8253e77a45fb0c7ae0347de6ae9ad705e182fd9a8f5211f51809810b94bb26c434b75e09ca1742
SSDEEP 196608:N5VjSGhrqNLbc+FFmb43OgrRVXrqNblvQkq2QB2TpCjPxTjH+uqBYXAV:N5VHhrqNHcTgrRNrqN/QB2pOxTjyuc
TLSH
T1C7F7C546F605CDCAF86292B8449B8F61A332ECB08760939733A577296FFE78C4DB1544
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

91816

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

gdiplus

GdipDisposeImage GdipCreateHBITMAPFromBitmap GdiplusShutdown GdiplusStartup GdipCreateBitmapFromStream

version

VerQueryValueW GetFileVersionInfoW GetFileVersionInfoSizeW

comdlg32

GetOpenFileNameW GetSaveFileNameW CommDlgExtendedError

winmm

PlaySoundW

imm32

ImmGetDefaultIMEWnd

kernel32

LoadLibraryA GetProcAddress WritePrivateProfileStringW GetPrivateProfileStringW GetPrivateProfileIntW lstrcmpW SetCurrentDirectoryW GetSystemDirectoryW DeleteFileW lstrcpynW GlobalFree GlobalUnlock GlobalLock GlobalAlloc SizeofResource LockResource LoadResource SetEnvironmentVariableA CompareStringW GetProcessHeap SetEndOfFile GetStringTypeW SetFilePointer WriteConsoleW ReadFile LCMapStringW IsValidCodePage GetOEMCP GetCPInfo SetStdHandle GetSystemTimeAsFileTime GetCurrentProcessId GetTickCount QueryPerformanceCounter FlsAlloc GetCurrentThreadId SetLastError FlsFree FlsSetValue FlsGetValue GetEnvironmentStringsW FreeEnvironmentStringsW HeapCreate GetVersion HeapSetInformation FlushFileBuffers GetConsoleMode GetConsoleCP WriteFile DeleteCriticalSection InitializeCriticalSectionAndSpinCount GetStdHandle SetHandleCount LeaveCriticalSection EnterCriticalSection RtlUnwindEx ExitProcess HeapSize Sleep RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind FindResourceW CloseHandle lstrcpyW GetLastError CreateMutexW lstrcmpiW GetSystemDefaultLangID GetEnvironmentVariableW lstrlenW GetModuleFileNameW GetLocalTime ExpandEnvironmentStringsA EncodePointer DecodePointer HeapAlloc IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter TerminateProcess RtlPcToFileHeader RaiseException GetFileType PeekNamedPipe GetFileInformationByHandle FileTimeToLocalFileTime FileTimeToSystemTime HeapReAlloc GetStartupInfoW GetCommandLineW FindFirstFileW WideCharToMultiByte GetACP SetErrorMode FindClose GetCurrentProcess FreeLibrary SetCurrentDirectoryA MultiByteToWideChar lstrcatW GetCurrentDirectoryA GetCurrentDirectoryW GetTempPathW CreateFileW GetVersionExA GetModuleHandleA LoadLibraryW GetSystemDirectoryA GetModuleHandleW GetVersionExW GetLocaleInfoW VirtualAlloc HeapFree

user32

SetWindowTextW TrackPopupMenuEx EnableMenuItem CreateIconIndirect GetIconInfo GetRawInputDeviceInfoW GetRawInputDeviceList LoadIconW SetFocus EndDialog GetDlgItemInt IsWindowEnabled SetDlgItemInt SystemParametersInfoW GetWindowRect GetDlgItem EnableWindow DefWindowProcW PostQuitMessage DestroyMenu EndPaint BeginPaint ReleaseDC GetDC SetWindowPos GetSystemMetrics GetClassNameW GetWindowTextW KillTimer PostMessageW TrackPopupMenu CheckMenuItem ModifyMenuW SetMenuDefaultItem GetCursorPos SetForegroundWindow GetForegroundWindow DestroyWindow CreateDialogParamW GetSubMenu LoadMenuW RegisterWindowMessageW RegisterHotKey UnregisterHotKey UpdateWindow GetWindowTextLengthW SetLayeredWindowAttributes CreateWindowExW RegisterClassExW LoadCursorW DispatchMessageW IsWindow SendMessageA EnumChildWindows GetWindowLongA CallWindowProcW GetMonitorInfoW EnumDisplayMonitors GetWindowLongPtrW SetWindowLongPtrW OpenClipboard EmptyClipboard SetClipboardData CloseClipboard DialogBoxIndirectParamW GetParent ScreenToClient MonitorFromPoint GetMonitorInfoA GetClientRect TranslateMessage GetMessageW DestroyIcon CopyIcon DialogBoxParamW MessageBoxW LoadImageW SetTimer MessageBeep keybd_event SendMessageW GetKeyState FindWindowW GetDlgItemTextW SetDlgItemTextW wsprintfW SendDlgItemMessageW ShowWindow

gdi32

DeleteDC CreateCompatibleDC GetStockObject GetObjectA CreateFontIndirectA GetDIBColorTable DeleteObject SetDIBits SelectObject SetBkColor TextOutW SetTextColor GetDeviceCaps GetDIBits GetObjectW

advapi32

RegQueryValueExA RegOpenKeyExA RegCloseKey RegDeleteValueW RegSetValueExW RegQueryValueExW RegCreateKeyExW RegOpenKeyExW

shell32

Shell_NotifyIconW DragFinish DragQueryFileW DragAcceptFiles ShellExecuteW SHGetPathFromIDListW SHGetSpecialFolderLocation

ole32

CreateStreamOnHGlobal CoUninitialize CoInitialize CoCreateInstance

shlwapi

StrCmpNIW

Sharing

General

Malware Config

Signatures

File Explorer

2026-06-10_1af10790a1e43b3a62f28fbb460887fc_amadey_cobalt-strike_coinminer_dosia_glassworm_icedid_njrat_poet-rat_quasar-rat_vidar

gdiplus

version

comdlg32

winmm

imm32

kernel32

user32

gdi32

advapi32

shell32

ole32

shlwapi

generic