2026-07-20_40ae3efb65b6a5f586b1a3f4b63ceab2_cobalt-strike_coinminer_glassworm_icedid_njrat_quasar-rat_remcos_ryuk_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-20_40ae3efb65b6a5f586b1a3f4b63ceab2_cobalt-strike_coinminer_glassworm_icedid_njrat_quasar-rat_remcos_ryuk_stealc
Size 5.3MB
Sample260720-yadjpsds6j
SHA256 67aeac3a979c59de086a2d5a37534c3e29a127be9bcf0cbc28524bc0849eaf64
MD5 40ae3efb65b6a5f586b1a3f4b63ceab2
SHA1 430d4a2cae74f5bf08a6b4f961104400c45a146b
SHA512 af44f41d9581d073ad0201fafeb08820a58c5671d2e912e7a5ea602c45a27e08a9eb426bd06f4ca74f13e2be455a2b1ebf0753af9f07e9f5748e3a6be40abec4
SSDEEP 98304:1vMDEOxibKzR/BPCqFHc4CxOw7LYHeYpZrJihjFum+/:1vaDLKI1LFihYj/
TLSH
T1F4469D43F2E664FCCA16C134930BA773E9357C490721ADAB46D4AB303EB69505F2EB64
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

2026-07-20_40ae3efb65b6a5f586b1a3f4b63ceab2_cobalt-strike_coinminer_glassworm_icedid_njrat_quasar-rat_remcos_ryuk_stealc

.exe 5.3MB

2026-07-20_40ae3efb65b6a5f586b1a3f4b63ceab2_cobalt-strike_coinminer_glassworm_icedid_njrat_quasar-rat_remcos_ryuk_stealc

IMPHASH dc8bad76b42ff71801bbfb54b0a32852
SHA256 67aeac3a979c59de086a2d5a37534c3e29a127be9bcf0cbc28524bc0849eaf64
MD5 40ae3efb65b6a5f586b1a3f4b63ceab2
SHA1 430d4a2cae74f5bf08a6b4f961104400c45a146b
SHA512 af44f41d9581d073ad0201fafeb08820a58c5671d2e912e7a5ea602c45a27e08a9eb426bd06f4ca74f13e2be455a2b1ebf0753af9f07e9f5748e3a6be40abec4
SSDEEP 98304:1vMDEOxibKzR/BPCqFHc4CxOw7LYHeYpZrJihjFum+/:1vaDLKI1LFihYj/
TLSH
T1F4469D43F2E664FCCA16C134930BA773E9357C490721ADAB46D4AB303EB69505F2EB64
MD5 SHA1 SHA512 SSDEEP TLSH

Digest

dc:5e:e9:1b:c8:46:06:8d:c3:4a:4b:a5:f4:37:30:a4:b7:b3:61:9c:71:6c:59:dc:65:42:17:0d:fe:bf:2e:69

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=IP Davydov Egor Denisovich,O=IP Davydov Egor Denisovich,L=Penza,ST=Penza Oblast,C=RU,1.2.840.113549.1.9.1=#0c15706f7263686573313333374070726f746f6e2e6d65

Chains

Jul 19, 2026

CN=IP Davydov Egor Denisovich,O=IP Davydov Egor Denisovich,L=Penza,ST=Penza Oblast,C=RU,1.2.840.113549.1.9.1=#0c15706f7263686573313333374070726f746f6e2e6d65

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Subject

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Serial Number

77:bd:0e:03:a1:b7:08:f8:54:ab:06:72:10:d9:04:47

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 28, 2020 - Jul 28, 2030

Subject

CN=IP Davydov Egor Denisovich,O=IP Davydov Egor Denisovich,L=Penza,ST=Penza Oblast,C=RU,1.2.840.113549.1.9.1=#0c15706f7263686573313333374070726f746f6e2e6d65

Serial Number

22:a3:64:90:5c:11:f8:26:73:bc:a4:dd

Issuer

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 23, 2026 - Mar 24, 2027

Subject

CN=Globalsign R45 TSA for CodeSign 202510,O=GlobalSign nv-sa,C=BE

Serial Number

84:72:3f:c1:95:cc:16:f1:db:2b:a2:f6:60:df:2b:e4

Issuer

CN=GlobalSign Offline R45 Timestamping CA 2025,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 15, 2025 - Jan 10, 2037

Subject

CN=GlobalSign Offline R45 Timestamping CA 2025,O=GlobalSign nv-sa,C=BE

Serial Number

83:da:86:37:b7:9f:0c:84:0c:94:7b:84:0a:52:78:1f

Issuer

CN=GlobalSign Timestamping Root R45,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jul 16, 2025 - Jul 16, 2041

Subject

CN=GlobalSign Timestamping Root R45,O=GlobalSign nv-sa,C=BE

Serial Number

78:4a:aa:81:73:66:9c:90:09:54:e4:21:c9:47:eb:c0

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Dec 9, 2020 - Dec 10, 2034

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Serial Number

45:e6:bb:03:83:33:c3:85:65:48:e6:ff:45:51

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Dec 10, 2014 - Dec 10, 2034

Minor OS version

Major OS version

Entry point

3877716

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

advapi32

CloseServiceHandle ControlService ConvertStringSecurityDescriptorToSecurityDescriptorA CreateProcessWithTokenW CryptAcquireContextA CryptAcquireContextW CryptCreateHash CryptDestroyHash CryptDestroyKey CryptEncrypt CryptGenRandom CryptGetHashParam CryptHashData CryptImportKey CryptReleaseContext EnumServicesStatusExA EventRegister EventSetInformation EventUnregister EventWriteTransfer GetTokenInformation GetUserNameW OpenProcessToken OpenSCManagerA OpenServiceA RegCloseKey RegCreateKeyExW RegDeleteTreeA RegGetValueW RegOpenKeyExW RegQueryValueExW RegSetValueExW

d3d11

D3D11CreateDeviceAndSwapChain

ntdll

NtClose RtlCaptureContext RtlInitUnicodeString RtlLookupFunctionEntry RtlPcToFileHeader RtlUnwind RtlUnwindEx RtlVirtualUnwind VerSetConditionMask

ws2_32

WSACleanup WSACloseEvent WSACreateEvent WSAEnumNetworkEvents WSAEventSelect WSAGetLastError WSAIoctl WSAResetEvent WSASetEvent WSASetLastError WSAStartup WSAWaitForMultipleEvents __WSAFDIsSet accept bind closesocket connect freeaddrinfo getaddrinfo gethostbyname gethostname getpeername getsockname getsockopt htonl htons inet_ntop inet_pton ioctlsocket listen ntohs recv recvfrom select send sendto setsockopt socket

kernel32

AcquireSRWLockExclusive CloseHandle CompareStringEx CompareStringW CopyFileW CreateDirectoryW CreateEventA CreateEventW CreateFileA CreateFileMappingA CreateFileW CreateMutexA CreateProcessW CreateThread CreateToolhelp32Snapshot DecodePointer DeleteCriticalSection DeleteFileW DuplicateHandle EncodePointer EnterCriticalSection EnumSystemLocalesW ExitProcess ExitThread FileTimeToSystemTime FindClose FindFirstFileA FindFirstFileExW FindFirstFileW FindNextFileA FindNextFileW FlsAlloc FlsFree FlsGetValue FlsSetValue FlushFileBuffers FormatMessageA FormatMessageW FreeEnvironmentStringsW FreeLibrary FreeLibraryAndExitThread GetACP GetCPInfo GetCommandLineA GetCommandLineW GetConsoleMode GetConsoleOutputCP GetCurrentDirectoryW GetCurrentProcess GetCurrentProcessId GetCurrentThreadId GetDateFormatW GetDriveTypeW GetEnvironmentStringsW GetEnvironmentVariableA GetEnvironmentVariableW GetExitCodeThread GetFileAttributesExW GetFileAttributesW GetFileInformationByHandle GetFileSizeEx GetFileType GetFullPathNameW GetLastError GetLocaleInfoA GetLocaleInfoEx GetLocaleInfoW GetLogicalProcessorInformationEx GetModuleFileNameW GetModuleHandleA GetModuleHandleExA GetModuleHandleExW GetModuleHandleW GetOEMCP GetProcAddress GetProcessHeap GetStartupInfoW GetStdHandle GetStringTypeW GetSystemDirectoryA GetSystemDirectoryW GetSystemTimeAsFileTime GetSystemTimePreciseAsFileTime GetTickCount GetTimeFormatW GetTimeZoneInformation GetUserDefaultLCID GetUserDefaultUILanguage GlobalAlloc GlobalFree GlobalLock GlobalUnlock HeapAlloc HeapFree HeapReAlloc HeapSize InitOnceBeginInitialize InitOnceComplete InitializeCriticalSection InitializeCriticalSectionEx InitializeSListHead IsDebuggerPresent IsProcessorFeaturePresent IsValidCodePage IsValidLocale K32EnumProcessModulesEx K32GetModuleBaseNameA LCMapStringEx LCMapStringW LeaveCriticalSection LoadLibraryA LoadLibraryExW LoadLibraryW LocalAlloc LocalFree MapViewOfFile MoveFileExW MultiByteToWideChar OpenMutexA OpenProcess OutputDebugStringA OutputDebugStringW PeekNamedPipe Process32First Process32Next QueryPerformanceCounter QueryPerformanceFrequency RaiseException ReadConsoleW ReadFile ReleaseMutex ReleaseSRWLockExclusive SetCurrentDirectoryW SetEndOfFile SetEnvironmentVariableW SetEvent SetFilePointerEx SetLastError SetStdHandle SetUnhandledExceptionFilter Sleep SleepConditionVariableSRW SleepEx SystemTimeToTzSpecificLocalTime TerminateProcess TryAcquireSRWLockExclusive UnhandledExceptionFilter UnmapViewOfFile VerifyVersionInfoW VirtualAlloc VirtualFree VirtualProtect VirtualQuery WaitForMultipleObjects WaitForSingleObject WaitForSingleObjectEx WakeAllConditionVariable WakeConditionVariable WideCharToMultiByte WriteConsoleW WriteFile lstrlenA

user32

ClientToScreen CloseClipboard CreateWindowExA DefWindowProcA DestroyWindow DispatchMessageA EmptyClipboard GetCapture GetClientRect GetClipboardData GetCursorPos GetDC GetDesktopWindow GetForegroundWindow GetKeyState GetKeyboardLayout GetMessageExtraInfo GetWindowRect IsWindowUnicode LoadCursorA LoadIconA MessageBoxA MonitorFromWindow OpenClipboard PeekMessageA PostQuitMessage RegisterClassExA ReleaseCapture ReleaseDC ScreenToClient SetCapture SetClassLongPtrA SetClipboardData SetCursor SetCursorPos SetForegroundWindow SetProcessDPIAware SetWindowPos ShowWindow TrackMouseEvent TranslateMessage UnregisterClassA UpdateWindow WaitForInputIdle

shell32

CommandLineToArgvW SHGetKnownFolderPath ShellExecuteA ShellExecuteW

ole32

CoInitializeEx CoTaskMemFree StringFromGUID2

shlwapi

PathCanonicalizeW

dbghelp

SymCleanup SymFromAddr SymFromName SymGetLineFromAddr64 SymGetOptions SymInitialize SymInitializeW SymLoadModuleExW SymSetOptions

gdi32

CreateRectRgn DeleteObject GetDeviceCaps

crypt32

CertAddCertificateContextToStore CertCloseStore CertCreateCertificateChainEngine CertEnumCertificatesInStore CertFindCertificateInStore CertFindExtension CertFreeCertificateChain CertFreeCertificateChainEngine CertFreeCertificateContext CertGetCertificateChain CertGetNameStringW CertOpenStore CertOpenSystemStoreA CryptDecodeObjectEx CryptQueryObject CryptStringToBinaryW PFXImportCertStore

imm32

ImmGetContext ImmReleaseContext ImmSetCandidateWindow ImmSetCompositionWindow

d3dcompiler_47

D3DCompile

dwmapi

DwmEnableBlurBehindWindow DwmGetColorizationColor DwmIsCompositionEnabled

bcrypt

BCryptGenRandom

Name

.text

Size

3.9MB

Virtual Size

3.9MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.2MB

Virtual Size

1.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

25KB

Virtual Size

80KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

92KB

Virtual Size

91KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

50B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_RDATA

Size

512B

Virtual Size

500B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

42KB

Virtual Size

42KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

13KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-20_40ae3efb65b6a5f586b1a3f4b63ceab2_cobalt-strike_coinminer_glassworm_icedid_njrat_quasar-rat_remcos_ryuk_stealc

advapi32

d3d11

ntdll

ws2_32

kernel32

user32

shell32

ole32

shlwapi

dbghelp

gdi32

crypt32

imm32

d3dcompiler_47

dwmapi

bcrypt

generic