2026-06-30_94ea63cda088f00b5042561359240699_cobalt-strike_coinminer_glassworm_poet-rat

Sharing

Copy URL Twitter E-mail

General

Target
2026-06-30_94ea63cda088f00b5042561359240699_cobalt-strike_coinminer_glassworm_poet-rat
Size 4.3MB
Sample260701-ebenlsdx9p
SHA256 b3dc55225a027673ffe40f879b8c7cb63f74c541fb26753054c5d137820890e6
MD5 94ea63cda088f00b5042561359240699
SHA1 8bbaea3c089da5ce802481c4e7749ba88b6ea6b5
SHA512 3f1c0f73f73087917d9f07eecc9170d7215441306416ab450700f29bd3a5e0f5b980b7b2a8d43d310f769c3caf5dd62d0dd760271e4e8dac25628f8a59ebc3da
SSDEEP 49152:xdYTVVPCvI6aJ3O/ZoEW9CatG8EeRHFi0fg+iEjXQmjbYFUqido:jEVtwHaJ38ZVafmQimjSr
TLSH
T1C4260853F8E704EBD6BFE23482E293227A72346543327BC35E9409695A59FE47A7D300
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-06-30_94ea63cda088f00b5042561359240699_cobalt-strike_coinminer_glassworm_poet-rat

File Explorer

2026-06-30_94ea63cda088f00b5042561359240699_cobalt-strike_coinminer_glassworm_poet-rat

.exe 4.3MB

2026-06-30_94ea63cda088f00b5042561359240699_cobalt-strike_coinminer_glassworm_poet-rat

IMPHASH 99983bb0ff7ab601bda78f3c926c7ba6
SHA256 b3dc55225a027673ffe40f879b8c7cb63f74c541fb26753054c5d137820890e6
MD5 94ea63cda088f00b5042561359240699
SHA1 8bbaea3c089da5ce802481c4e7749ba88b6ea6b5
SHA512 3f1c0f73f73087917d9f07eecc9170d7215441306416ab450700f29bd3a5e0f5b980b7b2a8d43d310f769c3caf5dd62d0dd760271e4e8dac25628f8a59ebc3da
SSDEEP 49152:xdYTVVPCvI6aJ3O/ZoEW9CatG8EeRHFi0fg+iEjXQmjbYFUqido:jEVtwHaJ38ZVafmQimjSr
TLSH
T1C4260853F8E704EBD6BFE23482E293227A72346543327BC35E9409695A59FE47A7D300
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5392

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

AddVectoredExceptionHandler CloseHandle CreateEventA CreateIoCompletionPort CreateThread CreateWaitableTimerA DeleteCriticalSection DuplicateHandle EnterCriticalSection ExitProcess FreeEnvironmentStringsW GetConsoleMode GetCurrentProcess GetCurrentProcessId GetCurrentThreadId GetEnvironmentStringsW GetLastError GetProcAddress GetProcessAffinityMask GetQueuedCompletionStatus GetStartupInfoA GetStdHandle GetSystemInfo GetSystemTimeAsFileTime GetThreadContext GetTickCount InitializeCriticalSection LeaveCriticalSection LoadLibraryA LoadLibraryW QueryPerformanceCounter ResumeThread RtlAddFunctionTable RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind SetConsoleCtrlHandler SetErrorMode SetEvent SetProcessPriorityBoost SetThreadPriority SetUnhandledExceptionFilter SetWaitableTimer Sleep SuspendThread SwitchToThread TerminateProcess TlsGetValue UnhandledExceptionFilter VirtualAlloc VirtualFree VirtualProtect VirtualQuery WaitForSingleObject WriteConsoleW WriteFile __C_specific_handler

msvcrt

__dllonexit __getmainargs __initenv __iob_func __lconv_init __set_app_type __setusermatherr _acmdln _amsg_exit _beginthread _cexit _errno _fmode _initterm _lock _onexit _unlock abort calloc exit fprintf free fwrite malloc memcpy signal strlen strncmp vfprintf

winmm

timeBeginPeriod

ws2_32

WSAGetOverlappedResult

opencl

clBuildProgram clCreateBuffer clCreateCommandQueue clCreateContext clCreateKernel clCreateProgramWithSource clEnqueueCopyBuffer clEnqueueMapBuffer clEnqueueMapImage clEnqueueNDRangeKernel clEnqueueReadBuffer clEnqueueReadImage clEnqueueUnmapMemObject clEnqueueWriteBuffer clEnqueueWriteImage clFinish clFlush clGetDeviceIDs clGetDeviceInfo clGetEventProfilingInfo clGetKernelInfo clGetKernelWorkGroupInfo clGetPlatformIDs clGetPlatformInfo clGetProgramBuildInfo clGetSupportedImageFormats clReleaseCommandQueue clReleaseContext clReleaseEvent clReleaseKernel clReleaseMemObject clReleaseProgram clSetKernelArg clWaitForEvents clCreateUserEvent clSetUserEventStatus clEnqueueBarrierWithWaitList clEnqueueFillBuffer clEnqueueMarkerWithWaitList

Name

.text

Size

3.7MB

Virtual Size

3.7MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

181KB

Virtual Size

180KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

143KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

512B

Virtual Size

104B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

104B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

Size

1024B

Virtual Size

800B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/19

Size

35KB

Virtual Size

35KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/31

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/45

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/57

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/70

Size

1024B

Virtual Size

976B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/81

Size

13KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-06-30_94ea63cda088f00b5042561359240699_cobalt-strike_coinminer_glassworm_poet-rat

kernel32

msvcrt

winmm

ws2_32

opencl

generic