2026-06-27_9dd765a9492d87a7806e310305ce9462_cobalt-strike_gazer_glassworm_icedid_mespinoza_njrat_ryuk_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-06-27_9dd765a9492d87a7806e310305ce9462_cobalt-strike_gazer_glassworm_icedid_mespinoza_njrat_ryuk_vidar
Size 6.0MB
Sample260629-e8epwaet9j
SHA256 a99fce19ed0483b9e1a8624ab23ffa0a8f6de5d261e06f9ef396e594b3b0e025
MD5 9dd765a9492d87a7806e310305ce9462
SHA1 98264e34446055aea3428daf2a3452a9a491b673
SHA512 06693ece3510d6f60a596a1afd19aa44f5e05bcfeb0fa26a268c2f9ac409bfd061621c8b55434ddf3922239ce75a11d14d381b70d166bbc07b45c8b3ee6e829a
SSDEEP 98304:fW299s6IwDyVVcPoZUDuobbocUth7ZpMcRAO:fW299s6IwDUVcPaUDEcUthrP
TLSH
T14456388572BDC19ADB27803BC656BF2BF5727854076057CB02E0469BAEE3FD04A3A711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-06-27_9dd765a9492d87a7806e310305ce9462_cobalt-strike_gazer_glassworm_icedid_mespinoza_njrat_ryuk_vidar

File Explorer

2026-06-27_9dd765a9492d87a7806e310305ce9462_cobalt-strike_gazer_glassworm_icedid_mespinoza_njrat_ryuk_vidar

.exe 6.0MB

2026-06-27_9dd765a9492d87a7806e310305ce9462_cobalt-strike_gazer_glassworm_icedid_mespinoza_njrat_ryuk_vidar

IMPHASH 86fa6a3cdc95eb94578f2e624ce383f5
SHA256 a99fce19ed0483b9e1a8624ab23ffa0a8f6de5d261e06f9ef396e594b3b0e025
MD5 9dd765a9492d87a7806e310305ce9462
SHA1 98264e34446055aea3428daf2a3452a9a491b673
SHA512 06693ece3510d6f60a596a1afd19aa44f5e05bcfeb0fa26a268c2f9ac409bfd061621c8b55434ddf3922239ce75a11d14d381b70d166bbc07b45c8b3ee6e829a
SSDEEP 98304:fW299s6IwDyVVcPoZUDuobbocUth7ZpMcRAO:fW299s6IwDUVcPaUDEcUthrP
TLSH
T14456388572BDC19ADB27803BC656BF2BF5727854076057CB02E0469BAEE3FD04A3A711
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

3828164

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

/tmp/job8093345349309443078/build/dmengine.pdb

ole32

CoCreateInstance CoInitializeEx CoUninitialize

ws2_32

WSACleanup WSAGetLastError WSAPoll WSAStartup __WSAFDIsSet accept bind closesocket connect freeaddrinfo getaddrinfo gethostbyaddr gethostbyname gethostname getnameinfo getpeername getsockname getsockopt htonl htons inet_ntoa inet_ntop inet_pton ioctlsocket listen ntohl ntohs recv recvfrom select send sendto setsockopt shutdown socket

opengl32

glBindTexture glBlendFunc glClear glClearColor glClearDepth glClearStencil glColorMask glCullFace glDeleteTextures glDepthFunc glDepthMask glDisable glDrawArrays glDrawBuffer glDrawElements glEnable glFlush glFrontFace glGenTextures glGetError glGetFloatv glGetIntegerv glGetString glPixelStorei glPolygonOffset glReadBuffer glReadPixels glScissor glStencilFunc glStencilMask glStencilOp glTexImage2D glTexParameterf glTexParameteri glTexSubImage2D glViewport wglGetProcAddress

steam_api64

SteamAPI_GetHSteamPipe SteamAPI_GetHSteamUser SteamAPI_IsSteamRunning SteamAPI_ManualDispatch_FreeLastCallback SteamAPI_ManualDispatch_GetAPICallResult SteamAPI_ManualDispatch_GetNextCallback SteamAPI_ManualDispatch_Init SteamAPI_ManualDispatch_RunFrame SteamAPI_RestartAppIfNecessary SteamAPI_Shutdown SteamInternal_ContextInit SteamInternal_FindOrCreateUserInterface SteamInternal_SteamAPI_Init

dbghelp

MiniDumpWriteDump StackWalk64 SymCleanup SymFromAddr SymFunctionTableAccess64 SymGetLineFromAddr64 SymGetModuleBase64 SymInitialize SymSetOptions

shell32

CommandLineToArgvW DragAcceptFiles DragFinish DragQueryFileW DragQueryPoint SHGetFolderPathW ShellExecuteA

user32

AdjustWindowRect AdjustWindowRectEx BringWindowToTop CallWindowProcA CallWindowProcW ChangeDisplaySettingsExW ClientToScreen ClipCursor CloseClipboard CreateIconIndirect CreateWindowExW DefWindowProcW DestroyIcon DestroyWindow DispatchMessageW EmptyClipboard EnumDisplayDevicesA EnumDisplayDevicesW EnumDisplayMonitors EnumDisplaySettingsA EnumDisplaySettingsExA EnumDisplaySettingsExW EnumDisplaySettingsW FlashWindow GetActiveWindow GetClassLongPtrW GetClientRect GetClipCursor GetClipboardData GetCursorPos GetDC GetForegroundWindow GetIconInfo GetKeyState GetLayeredWindowAttributes GetMessageTime GetMonitorInfoA GetMonitorInfoW GetPropW GetRawInputData GetRawInputDeviceInfoA GetRawInputDeviceList GetSystemMetrics GetWindowLongPtrA GetWindowLongPtrW GetWindowLongW GetWindowPlacement GetWindowRect IsIconic IsWindowUnicode IsWindowVisible IsZoomed LoadCursorA LoadCursorFromFileA LoadCursorW LoadImageA LoadImageW MapVirtualKeyW MonitorFromWindow MoveWindow MsgWaitForMultipleObjects OffsetRect OpenClipboard PeekMessageW PostMessageW PtInRect RegisterClassExW RegisterDeviceNotificationW RegisterRawInputDevices ReleaseCapture ReleaseDC RemovePropW ScreenToClient SendMessageA SendMessageW SetCapture SetClipboardData SetCursor SetCursorPos SetFocus SetForegroundWindow SetLayeredWindowAttributes SetPropW SetRect SetWindowLongPtrA SetWindowLongPtrW SetWindowLongW SetWindowPlacement SetWindowPos SetWindowTextW ShowCursor ShowWindow SystemParametersInfoW ToUnicode TrackMouseEvent TranslateMessage UnregisterClassA UnregisterClassW UnregisterDeviceNotification WaitMessage WindowFromPoint

psapi

EnumProcessModules GetModuleFileNameExA GetModuleInformation

gdi32

ChoosePixelFormat CreateBitmap CreateDCW CreateDIBSection CreateRectRgn DeleteDC DeleteObject DescribePixelFormat GetDIBits GetDeviceCaps GetDeviceGammaRamp GetObjectW SetDeviceGammaRamp SetPixelFormat SwapBuffers

kernel32

AcquireSRWLockExclusive AllocConsole AttachConsole CloseHandle CompareStringW CreateDirectoryW CreateEventExW CreateFileA CreateFileW CreatePipe CreateProcessW CreateThread DecodePointer DeleteCriticalSection DeleteFileW DuplicateHandle EncodePointer EnterCriticalSection EnumSystemLocalesW ExitProcess FileTimeToSystemTime FindClose FindFirstFileExW FindFirstFileW FindNextFileW FlsAlloc FlsFree FlsGetValue FlsSetValue FlushFileBuffers FormatMessageA FormatMessageW FreeEnvironmentStringsW FreeLibrary GetACP GetCPInfo GetCommandLineA GetCommandLineW GetConsoleMode GetConsoleOutputCP GetConsoleWindow GetCurrentDirectoryW GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetDateFormatW GetDriveTypeW GetEnvironmentStringsW GetExitCodeProcess GetFileAttributesExW GetFileInformationByHandle GetFileSizeEx GetFileType GetFullPathNameW GetLastError GetLocaleInfoW GetModuleFileNameA GetModuleFileNameW GetModuleHandleA GetModuleHandleExA GetModuleHandleExW GetModuleHandleW GetOEMCP GetProcAddress GetProcessHeap GetStartupInfoW GetStdHandle GetStringTypeW GetSystemTimeAsFileTime GetTempPathW GetTickCount GetTimeFormatW GetTimeZoneInformation GetUserDefaultLCID GetVersionExA GlobalAlloc GlobalFree GlobalLock GlobalUnlock HeapAlloc HeapFree HeapQueryInformation HeapReAlloc HeapSize InitializeConditionVariable InitializeCriticalSection InitializeCriticalSectionAndSpinCount InitializeCriticalSectionEx InitializeSListHead InterlockedFlushSList InterlockedPushEntrySList IsDebuggerPresent IsProcessorFeaturePresent IsValidCodePage IsValidLocale LCMapStringW LeaveCriticalSection LoadLibraryA LoadLibraryExA LoadLibraryExW LocalAlloc LocalFree MoveFileExA MoveFileExW MultiByteToWideChar OutputDebugStringW PeekNamedPipe QueryPerformanceCounter QueryPerformanceFrequency RaiseException ReadConsoleW ReadFile ReleaseSRWLockExclusive RemoveDirectoryW RtlCaptureContext RtlCaptureStackBackTrace RtlLookupFunctionEntry RtlPcToFileHeader RtlRestoreContext RtlUnwind RtlUnwindEx RtlVirtualUnwind SetConsoleCtrlHandler SetCurrentDirectoryW SetEndOfFile SetEnvironmentVariableW SetFilePointerEx SetLastError SetStdHandle SetThreadExecutionState SetUnhandledExceptionFilter Sleep SleepConditionVariableCS SleepConditionVariableSRW SystemTimeToTzSpecificLocalTime TerminateProcess TlsAlloc TlsFree TlsGetValue TlsSetValue TryEnterCriticalSection UnhandledExceptionFilter VerSetConditionMask VirtualAlloc VirtualFree VirtualProtect VirtualQuery WaitForSingleObject WakeAllConditionVariable WakeConditionVariable WideCharToMultiByte WriteConsoleW WriteFile

iphlpapi

GetAdaptersAddresses

advapi32

CryptAcquireContextW CryptGenRandom CryptReleaseContext

?dmHashClone32@@YAXPEAUHashState32@@PEBU1@_N@Z ?dmHashClone64@@YAXPEAUHashState64@@PEBU1@_N@Z ?dmHashFinal32@@YAIPEAUHashState32@@@Z ?dmHashFinal64@@YA_KPEAUHashState64@@@Z ?dmHashInit32@@YAXPEAUHashState32@@_N@Z ?dmHashInit64@@YAXPEAUHashState64@@_N@Z ?dmHashRelease32@@YAXPEAUHashState32@@@Z ?dmHashRelease64@@YAXPEAUHashState64@@@Z ?dmHashReverse32Alloc@@YAPEBXPEAUdmAllocator@@IPEAI@Z ?dmHashReverse64Alloc@@YAPEBXPEAUdmAllocator@@_KPEAI@Z ?dmHashReverseSafe32Alloc@@YAPEBDPEAUdmAllocator@@I@Z ?dmHashReverseSafe64Alloc@@YAPEBDPEAUdmAllocator@@_K@Z ?dmHashUpdateBuffer32@@YAXPEAUHashState32@@PEBXI@Z ?dmHashUpdateBuffer64@@YAXPEAUHashState64@@PEBXI@Z AmdPowerXpressRequestHighPerformance DecryptXTeaCTR EncryptXTeaCTR LZ4CompressBuffer LZ4DecompressBuffer LZ4MaxCompressedSize NvOptimusEnablement Particle_CreateContext Particle_CreateInstance Particle_DeletePrototype Particle_DestroyContext Particle_DestroyInstance Particle_GenerateVertexData Particle_GetContextMaxParticleCount Particle_GetEmitterCount Particle_GetInstanceStats Particle_GetMaterial Particle_GetMaterialPath Particle_GetStats Particle_GetTileSource Particle_GetTileSourcePath Particle_GetVertexBufferSize Particle_Hash Particle_IsSleeping Particle_NewPrototype Particle_NewPrototypeFromDDF Particle_ReloadInstance Particle_ReloadPrototype Particle_RenderEmitter Particle_ResetAttributeScratchBuffer Particle_ResetInstance Particle_ResetRenderConstant Particle_SetContextMaxParticleCount Particle_SetMaterial Particle_SetPosition Particle_SetRenderConstant Particle_SetRotation Particle_SetScale Particle_SetTileSource Particle_StartInstance Particle_StopInstance Particle_Update Particle_WriteAttributeToScratchBuffer __swprintf_l __vswprintf_l _fprintf_l _fprintf_p _fprintf_p_l _fprintf_s_l _fscanf_l _fscanf_s_l _fwprintf_l _fwprintf_p _fwprintf_p_l _fwprintf_s_l _fwscanf_l _fwscanf_s_l _printf_l _printf_p _printf_p_l _printf_s_l _scanf_l _scanf_s_l _scprintf _scprintf_l _scprintf_p _scprintf_p_l _scwprintf _scwprintf_l _scwprintf_p _scwprintf_p_l _snprintf _snprintf_c _snprintf_c_l _snprintf_l _snprintf_s _snprintf_s_l _snscanf _snscanf_l _snscanf_s _snscanf_s_l _snwprintf _snwprintf_l _snwprintf_s _snwprintf_s_l _snwscanf _snwscanf_l _snwscanf_s _snwscanf_s_l _sprintf_l _sprintf_p _sprintf_p_l _sprintf_s_l _sscanf_l _sscanf_s_l _swprintf _swprintf_c _swprintf_c_l _swprintf_l _swprintf_p _swprintf_p_l _swprintf_s_l _swscanf_l _swscanf_s_l _vfprintf_l _vfprintf_p _vfprintf_p_l _vfprintf_s_l _vfscanf_l _vfscanf_s_l _vfwprintf_l _vfwprintf_p _vfwprintf_p_l _vfwprintf_s_l _vfwscanf_l _vfwscanf_s_l _vprintf_l _vprintf_p _vprintf_p_l _vprintf_s_l _vscanf_l _vscanf_s_l _vscprintf _vscprintf_l _vscprintf_p _vscprintf_p_l _vscwprintf _vscwprintf_l _vscwprintf_p _vscwprintf_p_l _vsnprintf _vsnprintf_c _vsnprintf_c_l _vsnprintf_l _vsnprintf_s _vsnprintf_s_l _vsnwprintf _vsnwprintf_l _vsnwprintf_s _vsnwprintf_s_l _vsnwscanf_l _vsnwscanf_s_l _vsprintf_l _vsprintf_p _vsprintf_p_l _vsprintf_s_l _vsscanf_l _vsscanf_s_l _vswprintf _vswprintf_c _vswprintf_c_l _vswprintf_l _vswprintf_p _vswprintf_p_l _vswprintf_s_l _vswscanf_l _vswscanf_s_l _vwprintf_l _vwprintf_p _vwprintf_p_l _vwprintf_s_l _vwscanf_l _vwscanf_s_l _wprintf_l _wprintf_p _wprintf_p_l _wprintf_s_l _wscanf_l _wscanf_s_l dmHashBuffer32 dmHashBuffer64 dmHashBufferNoReverse32 dmHashBufferNoReverse64 dmHashEnableReverseHash dmHashReverse32 dmHashReverse64 dmHashReverseErase32 dmHashReverseErase64 dmHashReverseSafe32 dmHashReverseSafe64 dmHashString32 dmHashString64 fprintf fprintf_s fscanf fscanf_s fwprintf fwprintf_s fwscanf fwscanf_s printf printf_s scanf scanf_s snprintf sprintf sprintf_s sscanf sscanf_s swprintf swprintf_s swscanf swscanf_s vfprintf vfprintf_s vfscanf vfscanf_s vfwprintf vfwprintf_s vfwscanf vfwscanf_s vprintf vprintf_s vscanf vscanf_s vsnprintf vsnprintf_s vsprintf vsprintf_s vsscanf vsscanf_s vswprintf vswprintf_s vswscanf vswscanf_s vwprintf vwprintf_s vwscanf vwscanf_s wprintf wprintf_s wscanf wscanf_s

Name

.text

Size

4.2MB

Virtual Size

4.2MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

927KB

Virtual Size

926KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

180KB

Virtual Size

870KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

222KB

Virtual Size

221KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.00cfg

Size

512B

Virtual Size

56B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.gxfg

Size

64KB

Virtual Size

63KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_RDATA

Size

512B

Virtual Size

348B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

401KB

Virtual Size

401KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

20KB

Virtual Size

20KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-06-27_9dd765a9492d87a7806e310305ce9462_cobalt-strike_gazer_glassworm_icedid_mespinoza_njrat_ryuk_vidar

ole32

ws2_32

opengl32

steam_api64

dbghelp

shell32

user32

psapi

gdi32

kernel32

iphlpapi

advapi32

generic