2026-07-08_ebee82263a65d81c2eb3ed5ece9d6234_cobalt-strike_coinminer_glassworm_hijackloader_icedid_njrat_pos_satacom_vidar

General

Target
2026-07-08_ebee82263a65d81c2eb3ed5ece9d6234_cobalt-strike_coinminer_glassworm_hijackloader_icedid_njrat_pos_satacom_vidar
Size 34.4MB
Sample260708-grrdfsbw71
SHA256 7f51299db1473aa36261929022744c40a420cbd33c8beee20c5babfee015c29e
MD5 ebee82263a65d81c2eb3ed5ece9d6234
SHA1 c53d74d90f7032c4bff9014d44cfdde215749686
SHA512 72c70bacc11e3bebc3007e829d3031384381d0cc0b0f923bcc1ecfc70e24a078812cd3c8b1692cb7343c6bdf22d30a3372306cd2784b6c9c053e085df3c83d68
SSDEEP 393216:SHPgeeI9ni1SHDGhAriW1CPwDv3uFhLU2lvzfpiaFHJeoAfWQqMDc07:tI923qtey
TLSH
T191877B56769800E6F877E17888174B13DBB1BC16172497CB20A8F6992F33BD22BBD741
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
2026-07-08_ebee82263a65d81c2eb3ed5ece9d6234_cobalt-strike_coinminer_glassworm_hijackloader_icedid_njrat_pos_satacom_vidar

File Explorer

2026-07-08_ebee82263a65d81c2eb3ed5ece9d6234_cobalt-strike_coinminer_glassworm_hijackloader_icedid_njrat_pos_satacom_vidar

.exe 34.4MB

2026-07-08_ebee82263a65d81c2eb3ed5ece9d6234_cobalt-strike_coinminer_glassworm_hijackloader_icedid_njrat_pos_satacom_vidar

IMPHASH a1a387ebee5028f2a6a0ab777ab343a3
SHA256 7f51299db1473aa36261929022744c40a420cbd33c8beee20c5babfee015c29e
MD5 ebee82263a65d81c2eb3ed5ece9d6234
SHA1 c53d74d90f7032c4bff9014d44cfdde215749686
SHA512 72c70bacc11e3bebc3007e829d3031384381d0cc0b0f923bcc1ecfc70e24a078812cd3c8b1692cb7343c6bdf22d30a3372306cd2784b6c9c053e085df3c83d68
SSDEEP 393216:SHPgeeI9ni1SHDGhAriW1CPwDv3uFhLU2lvzfpiaFHJeoAfWQqMDc07:tI923qtey
TLSH
T191877B56769800E6F877E17888174B13DBB1BC16172497CB20A8F6992F33BD22BBD741
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

dd:ed:69:2d:d5:23:f8:4f:16:20:43:a8:a0:5c:68:f2:43:ea:b8:cc

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=APTX Software

Chains

Nov 9, 2022

CN=APTX Software

Minor OS version

0

Major OS version

6

Entry point

9620

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

shell32

SHFileOperationW SHGetFolderPathW

imagehlp

UnMapAndLoad MapAndLoad

kernel32

TlsGetValue WriteConsoleW HeapReAlloc HeapSize SetFilePointerEx CreateDirectoryW ReadFile SetConsoleCtrlHandler GetCommandLineW WriteFile GetShortPathNameW GetModuleFileNameW GetProcessId SetFilePointer GetTempPathW WaitForSingleObject CreateFileW GetLastError CloseHandle SetEnvironmentVariableA GetCurrentProcessId CreateProcessW GetSystemTimeAsFileTime FormatMessageA GenerateConsoleCtrlEvent GetExitCodeProcess RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentThreadId InitializeSListHead IsDebuggerPresent GetStartupInfoW GetModuleHandleW GetFileSizeEx RtlUnwindEx SetLastError EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsSetValue TlsFree FreeLibrary GetProcAddress LoadLibraryExW EncodePointer RaiseException RtlPcToFileHeader ExitProcess GetModuleHandleExW GetCommandLineA GetStdHandle MultiByteToWideChar HeapAlloc HeapFree LCMapStringW GetFileType WideCharToMultiByte FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle GetStringTypeW GetProcessHeap FlushFileBuffers GetConsoleOutputCP GetConsoleMode

Name

.text

Size

82KB

Virtual Size

81KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

43KB

Virtual Size

43KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

67KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

348B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1024B

Virtual Size

920B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-08_ebee82263a65d81c2eb3ed5ece9d6234_cobalt-strike_coinminer_glassworm_hijackloader_icedid_njrat_pos_satacom_vidar

PE Signature issue

shell32

imagehlp

kernel32

generic