2026-07-19_781c07c19ad9c67d17a23de9b6b5f034_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-19_781c07c19ad9c67d17a23de9b6b5f034_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar
Size 19.2MB
Sample260720-blgdeadx4y
SHA256 8f70d7a5672117db9c664d7ea447b420a9615dbdb34b92c0bd134295a1a577e7
MD5 781c07c19ad9c67d17a23de9b6b5f034
SHA1 e1de16dcc18a5363eace41fa3b5ffc15b7ba72f0
SHA512 64f7045a96d92b441d61bfcb7e0114bb1bb4d4f75935fcae98db5605d42cd90cf45fc073007ef7db1872bf679b34e13b69bdf904ab180ae31b9c458a3ec604f7
SSDEEP 393216:vTGHQQXPzf8as/+QOGaT6YlvsTgF2MlOk:vK5Mc
TLSH
T196175A1976BE01E5E17AC079D603932BDDB1709A033C96FF538189D9AF217E86A3CB41
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects executables embedding anti-forensic artifacts of deleting shim cache 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_DeleteShimCache

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-19_781c07c19ad9c67d17a23de9b6b5f034_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar

File Explorer

2026-07-19_781c07c19ad9c67d17a23de9b6b5f034_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar

.exe 19.2MB

2026-07-19_781c07c19ad9c67d17a23de9b6b5f034_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar

IMPHASH c96be1b230e0d3e752fd71d8081a50aa
SHA256 8f70d7a5672117db9c664d7ea447b420a9615dbdb34b92c0bd134295a1a577e7
MD5 781c07c19ad9c67d17a23de9b6b5f034
SHA1 e1de16dcc18a5363eace41fa3b5ffc15b7ba72f0
SHA512 64f7045a96d92b441d61bfcb7e0114bb1bb4d4f75935fcae98db5605d42cd90cf45fc073007ef7db1872bf679b34e13b69bdf904ab180ae31b9c458a3ec604f7
SSDEEP 393216:vTGHQQXPzf8as/+QOGaT6YlvsTgF2MlOk:vK5Mc
TLSH
T196175A1976BE01E5E17AC079D603932BDDB1709A033C96FF538189D9AF217E86A3CB41
MD5 SHA1 SHA512 SSDEEP TLSH

Detects executables embedding anti-forensic artifacts of deleting shim cache
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

10127264

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

E:\Private\Traceless\Traceless\x64\Debug\obj\svchost.pdb

ws2_32

WSAIoctl htons getsockname getpeername connect WSACleanup WSASetLastError ntohs inet_pton WSAGetLastError WSAWaitForMultipleEvents bind closesocket listen recv htonl WSASetEvent WSAResetEvent WSAEventSelect WSAEnumNetworkEvents WSACreateEvent WSACloseEvent getsockopt send setsockopt socket WSAStartup getaddrinfo freeaddrinfo inet_ntop recvfrom sendto ioctlsocket gethostname inet_addr inet_ntoa gethostbyaddr gethostbyname accept getservbyport shutdown __WSAFDIsSet select getservbyname

crypt32

CryptProtectData CryptUnprotectData CertOpenSystemStoreW CertGetCertificateContextProperty CertDuplicateCertificateContext CertFreeCertificateChain CertGetCertificateChain CertFreeCertificateChainEngine CertCreateCertificateChainEngine CryptQueryObject CertGetNameStringW CertFindExtension CertAddCertificateContextToStore CryptDecodeObjectEx CertOpenSystemStoreA CertGetIntendedKeyUsage CertGetEnhancedKeyUsage PFXImportCertStore CryptStringToBinaryW CertFreeCertificateContext CertFindCertificateInStore CertEnumCertificatesInStore CertCloseStore CertOpenStore

d3d11

D3D11CreateDeviceAndSwapChain

d3dcompiler_43

D3DCompile

urlmon

URLDownloadToFileW URLDownloadToFileA

dwmapi

DwmEnableBlurBehindWindow DwmGetWindowAttribute DwmExtendFrameIntoClientArea DwmFlush DwmGetColorizationColor DwmIsCompositionEnabled

ntdll

RtlInitAnsiString RtlPcToFileHeader RtlAnsiStringToUnicodeString NtLoadDriver NtUnloadDriver RtlLookupFunctionEntry RtlUnwindEx RtlUnwind NtQuerySystemInformation ZwReadVirtualMemory ZwWriteVirtualMemory VerSetConditionMask RtlVirtualUnwind RtlCaptureContext

winhttp

WinHttpCrackUrl WinHttpReceiveResponse WinHttpSendRequest WinHttpOpenRequest WinHttpSetOption WinHttpQueryDataAvailable WinHttpReadData WinHttpConnect WinHttpCloseHandle WinHttpOpen WinHttpQueryHeaders

kernel32

GetStdHandle GetCommandLineW SetEnvironmentVariableW SetCurrentDirectoryW FindClose FindFirstFileA FindNextFileA ReleaseMutex CreateMutexW GetSystemDirectoryW SetDllDirectoryW AllocConsole SetConsoleTextAttribute GetConsoleWindow GetModuleHandleExW GetEnvironmentVariableW CreateRemoteThread VirtualAllocEx VirtualFreeEx VirtualProtect LoadLibraryExA Module32FirstW Module32NextW K32GetModuleFileNameExA SizeofResource FindResourceW K32GetModuleInformation GetStartupInfoW GlobalAlloc GlobalUnlock GlobalLock GlobalFree QueryPerformanceCounter QueryPerformanceFrequency GetLocaleInfoA GetFileSizeEx CreateEventW GetExitCodeThread CreateThreadpoolWait SetThreadpoolWait CloseThreadpoolWait FindFirstFileW FindNextFileW RemoveDirectoryW GetWindowsDirectoryW GetModuleFileNameA FreeConsole GetConsoleMode SetConsoleMode WriteConsoleA WriteConsoleW SetConsoleCtrlHandler FillConsoleOutputCharacterA FillConsoleOutputCharacterW FillConsoleOutputAttribute SetConsoleCP SetConsoleOutputCP GetConsoleScreenBufferInfo SetConsoleScreenBufferSize SetConsoleCursorPosition SetConsoleWindowInfo SetConsoleTitleA GetVolumeInformationW GetComputerNameW MoveFileExW CopyFileW OpenMutexW GetFullPathNameW K32GetModuleBaseNameW ReleaseSRWLockExclusive AcquireSRWLockExclusive EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection LoadLibraryW SleepEx WaitForSingleObjectEx GetSystemTimeAsFileTime GetEnvironmentVariableA GetFileType PeekNamedPipe WaitForMultipleObjects VerifyVersionInfoW ReadConsoleA ReadConsoleW InitializeSRWLock ReleaseSRWLockShared ResumeThread TlsAlloc TlsGetValue TlsSetValue TlsFree VirtualLock SwitchToFiber DeleteFiber CreateFiberEx GetSystemDirectoryA FormatMessageA InitializeCriticalSection TryEnterCriticalSection MultiByteToWideChar CreateSemaphoreA GetACP ConvertFiberToThread ConvertThreadToFiberEx HeapReAlloc MapViewOfFile UnmapViewOfFile CreateFileMappingA MoveFileW QueryFullProcessImageNameW LocalFree LocalAlloc GetProcAddress GetModuleHandleW GetModuleFileNameW WriteProcessMemory ReadProcessMemory VirtualQueryEx GetTickCount64 GetTickCount GetSystemTime GetSystemInfo OpenProcess CreateProcessW TerminateProcess GetCurrentProcess Sleep WaitForSingleObject CreatePipe GetLocaleInfoEx CreateDirectoryW FindFirstFileExW GetDiskFreeSpaceExW GetFileAttributesExW GetFileInformationByHandle GetFinalPathNameByHandleW K32GetMappedFileNameA Thread32Next K32EnumProcessModules Thread32First GetModuleHandleA FormatMessageW GetThreadTimes CreateFile2 AreFileApisANSI CreateDirectoryExW CopyFile2 CreateHardLinkW GetFileInformationByHandleEx CreateSymbolicLinkW GetSystemTimePreciseAsFileTime SwitchToThread GetLogicalProcessorInformationEx TryAcquireSRWLockExclusive TryAcquireSRWLockShared SleepConditionVariableSRW GetStringTypeW RaiseException WakeConditionVariable WakeAllConditionVariable GetLastError CloseHandle GetTempPathW WriteFile SetFileTime SetFilePointer SetFileInformationByHandle SetFileAttributesW SetEndOfFile GetTempFileNameW GetFileSize GetFileAttributesW DeleteFileW CreateFileW CreateFileA DecodePointer CompareStringEx GetCPInfo LCMapStringEx IsDebuggerPresent SetUnhandledExceptionFilter VirtualQuery EncodePointer SuspendThread OpenThread CompareFileTime VirtualProtectEx GetExitCodeProcess ExitProcess GetCurrentDirectoryW LoadLibraryA FreeLibrary GetCurrentThreadId DeviceIoControl GetProcessHeap HeapFree HeapAlloc GetCurrentProcessId SetLastError GetFileAttributesExA CreateDirectoryA GetCurrentDirectoryA VirtualFree VirtualAlloc Process32NextW Process32FirstW CreateToolhelp32Snapshot AcquireSRWLockShared InitializeSListHead InterlockedPushEntrySList InterlockedFlushSList LoadLibraryExW FlsAlloc FlsGetValue FlsSetValue FlsFree HeapSize HeapValidate CreateThread ExitThread FreeLibraryAndExitThread DuplicateHandle GetDriveTypeW SystemTimeToTzSpecificLocalTime FileTimeToSystemTime SetFilePointerEx IsProcessorFeaturePresent GetConsoleOutputCP GetCurrentThread UnhandledExceptionFilter HeapQueryInformation OutputDebugStringW IsThreadAFiber WideCharToMultiByte ReleaseSemaphore GetDateFormatW GetTimeFormatW SystemTimeToFileTime CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW FlushFileBuffers GetTimeZoneInformation SetStdHandle IsValidCodePage GetOEMCP GetCommandLineA GetEnvironmentStringsW ReadFile FreeEnvironmentStringsW

user32

GetKeyboardLayout EmptyClipboard GetClipboardData SetClipboardData CloseClipboard OpenClipboard SetWindowLongW TrackMouseEvent mouse_event GetMessageExtraInfo GetKeyState GetCapture SetCapture ReleaseCapture IsWindowUnicode SetCursorPos SetCursor IsChild MsgWaitForMultipleObjects UnregisterClassW PostQuitMessage LoadCursorW GetWindowThreadProcessId GetCursorPos SetLayeredWindowAttributes ScreenToClient SetWindowLongPtrW GetWindowLongPtrW FillRect GetProcessWindowStation EndPaint BeginPaint LockSetForegroundWindow GetForegroundWindow UpdateWindow SetFocus BringWindowToTop SetWindowDisplayAffinity SetWindowPos ShowWindow DestroyWindow CreateWindowExW GetClassInfoExW RegisterClassExW DefWindowProcW AttachThreadInput PeekMessageW DispatchMessageW TranslateMessage SetProcessDPIAware AllowSetForegroundWindow ReleaseDC GetDC GetSystemMetrics SendInput GetAsyncKeyState EnumDisplayMonitors GetMonitorInfoW MonitorFromWindow MonitorFromPoint FindWindowA ClientToScreen MessageBoxW GetWindowRect GetClientRect SetForegroundWindow IsWindowEnabled EnableWindow MoveWindow IsWindow PostMessageW InvalidateRect GetUserObjectInformationW

gdi32

GetDeviceCaps CreateRectRgn SetBrushOrgEx SetStretchBltMode StretchBlt Polyline TextOutW MoveToEx ExtCreatePen SetTextColor SetBkMode LineTo GetTextExtentPoint32W GetStockObject CreateSolidBrush CreatePen CreateFontW SelectObject GetDIBits DeleteObject DeleteDC CreateCompatibleDC CreateCompatibleBitmap BitBlt

advapi32

ControlService RegGetValueW RegDeleteTreeW RegSetValueExW RegDeleteKeyW RegCreateKeyExW SetTokenInformation RevertToSelf PrivilegeCheck DuplicateTokenEx SetThreadToken CreateProcessAsUserW RegEnumValueA RegQueryValueExA CryptEnumProvidersW CryptSignHashW RegDeleteValueA RegCreateKeyExA ConvertSidToStringSidA RegQueryValueExW GetUserNameA GetTokenInformation RegSetValueExA RegOpenKeyA RegDeleteKeyA RegCreateKeyA SetEntriesInAclW QueryServiceStatusEx OpenServiceW OpenSCManagerW CloseServiceHandle RegSetKeySecurity RegQueryInfoKeyW RegOpenKeyExW RegGetKeySecurity RegEnumValueW RegEnumKeyExW RegDeleteValueW RegCloseKey LookupPrivilegeValueW SetSecurityDescriptorDacl InitializeSecurityDescriptor FreeSid AllocateAndInitializeSid AdjustTokenPrivileges OpenProcessToken QueryServiceStatus StartServiceW GetUserNameW CryptAcquireContextW CryptReleaseContext CryptGetHashParam CryptCreateHash CryptHashData CryptDestroyHash DeregisterEventSource RegisterEventSourceW ReportEventW CryptGenRandom CryptDestroyKey CryptSetHashParam CryptGetProvParam CryptGetUserKey CryptExportKey CryptDecrypt

shell32

SHGetKnownFolderPath ShellExecuteA SHGetFolderPathA SHCreateDirectoryExW ShellExecuteExW SHGetFolderPathW ShellExecuteW

ole32

CoCreateInstance CoInitializeEx CoTaskMemFree StringFromGUID2 CoUninitialize

shlwapi

PathStripPathW PathFileExistsW

dbghelp

SymGetTypeFromName SymInitialize SymLoadModuleEx SymGetTypeInfo SymFromName SymUnloadModule64 SymCleanup SymSetOptions

bcrypt

BCryptGenRandom

imm32

ImmGetContext ImmSetCompositionWindow ImmSetCandidateWindow ImmReleaseContext

iphlpapi

GetAdaptersAddresses

Name

.text

Size

11.1MB

Virtual Size

11.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

3.5MB

Virtual Size

3.5MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3.8MB

Virtual Size

3.9MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

684KB

Virtual Size

684KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.msvcjmc

Size

30KB

Virtual Size

29KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

76KB

Virtual Size

76KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-19_781c07c19ad9c67d17a23de9b6b5f034_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar

ws2_32

crypt32

d3d11

d3dcompiler_43

urlmon

dwmapi

ntdll

winhttp

kernel32

user32

gdi32

advapi32

shell32

ole32

shlwapi

dbghelp

bcrypt

imm32

iphlpapi

generic