2026-07-21_91a54e4f1ca548f6b0e25dc1302cf3f0_cobalt-strike_coinminer_glassworm_poet-rat

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-21_91a54e4f1ca548f6b0e25dc1302cf3f0_cobalt-strike_coinminer_glassworm_poet-rat
Size 4.3MB
Sample260721-sdlftswxc1
SHA256 f6c6b6226be554041024ad1f7b8590dcd2ec10cd6f2dd6b18c15cc8c91adbb28
MD5 91a54e4f1ca548f6b0e25dc1302cf3f0
SHA1 a14750bf2d1b21b10414c864cac643461fe7f8b9
SHA512 00acfa0be6445669652a123deeb354e73364bee834bf29fcd2289351adfe022a68b83a629e192afd8612e52acd3b19e16960b088a032ea78a4f1a1895ddf9b1c
SSDEEP 49152:xdYTVVPCvI6aJ3O/ZoEW9CatG8EeRHFi0fg+iEjXQmjbYFUqidI:jEVtwHaJ38ZVafmQimjST
TLSH
T179260853F8E704EBD6BFE23482E293227A72346543327BC35E9409695A59FE47A7D300
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-21_91a54e4f1ca548f6b0e25dc1302cf3f0_cobalt-strike_coinminer_glassworm_poet-rat

File Explorer

2026-07-21_91a54e4f1ca548f6b0e25dc1302cf3f0_cobalt-strike_coinminer_glassworm_poet-rat

.exe 4.3MB

2026-07-21_91a54e4f1ca548f6b0e25dc1302cf3f0_cobalt-strike_coinminer_glassworm_poet-rat

IMPHASH 99983bb0ff7ab601bda78f3c926c7ba6
SHA256 f6c6b6226be554041024ad1f7b8590dcd2ec10cd6f2dd6b18c15cc8c91adbb28
MD5 91a54e4f1ca548f6b0e25dc1302cf3f0
SHA1 a14750bf2d1b21b10414c864cac643461fe7f8b9
SHA512 00acfa0be6445669652a123deeb354e73364bee834bf29fcd2289351adfe022a68b83a629e192afd8612e52acd3b19e16960b088a032ea78a4f1a1895ddf9b1c
SSDEEP 49152:xdYTVVPCvI6aJ3O/ZoEW9CatG8EeRHFi0fg+iEjXQmjbYFUqidI:jEVtwHaJ38ZVafmQimjST
TLSH
T179260853F8E704EBD6BFE23482E293227A72346543327BC35E9409695A59FE47A7D300
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5392

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

AddVectoredExceptionHandler CloseHandle CreateEventA CreateIoCompletionPort CreateThread CreateWaitableTimerA DeleteCriticalSection DuplicateHandle EnterCriticalSection ExitProcess FreeEnvironmentStringsW GetConsoleMode GetCurrentProcess GetCurrentProcessId GetCurrentThreadId GetEnvironmentStringsW GetLastError GetProcAddress GetProcessAffinityMask GetQueuedCompletionStatus GetStartupInfoA GetStdHandle GetSystemInfo GetSystemTimeAsFileTime GetThreadContext GetTickCount InitializeCriticalSection LeaveCriticalSection LoadLibraryA LoadLibraryW QueryPerformanceCounter ResumeThread RtlAddFunctionTable RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind SetConsoleCtrlHandler SetErrorMode SetEvent SetProcessPriorityBoost SetThreadPriority SetUnhandledExceptionFilter SetWaitableTimer Sleep SuspendThread SwitchToThread TerminateProcess TlsGetValue UnhandledExceptionFilter VirtualAlloc VirtualFree VirtualProtect VirtualQuery WaitForSingleObject WriteConsoleW WriteFile __C_specific_handler

msvcrt

__dllonexit __getmainargs __initenv __iob_func __lconv_init __set_app_type __setusermatherr _acmdln _amsg_exit _beginthread _cexit _errno _fmode _initterm _lock _onexit _unlock abort calloc exit fprintf free fwrite malloc memcpy signal strlen strncmp vfprintf

winmm

timeBeginPeriod

ws2_32

WSAGetOverlappedResult

opencl

clBuildProgram clCreateBuffer clCreateCommandQueue clCreateContext clCreateKernel clCreateProgramWithSource clEnqueueCopyBuffer clEnqueueMapBuffer clEnqueueMapImage clEnqueueNDRangeKernel clEnqueueReadBuffer clEnqueueReadImage clEnqueueUnmapMemObject clEnqueueWriteBuffer clEnqueueWriteImage clFinish clFlush clGetDeviceIDs clGetDeviceInfo clGetEventProfilingInfo clGetKernelInfo clGetKernelWorkGroupInfo clGetPlatformIDs clGetPlatformInfo clGetProgramBuildInfo clGetSupportedImageFormats clReleaseCommandQueue clReleaseContext clReleaseEvent clReleaseKernel clReleaseMemObject clReleaseProgram clSetKernelArg clWaitForEvents clCreateUserEvent clSetUserEventStatus clEnqueueBarrierWithWaitList clEnqueueFillBuffer clEnqueueMarkerWithWaitList

Name

.text

Size

3.7MB

Virtual Size

3.7MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

181KB

Virtual Size

180KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

143KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

512B

Virtual Size

104B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

104B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

Size

1024B

Virtual Size

800B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/19

Size

35KB

Virtual Size

35KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/31

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/45

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/57

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/70

Size

1024B

Virtual Size

976B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/81

Size

13KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-21_91a54e4f1ca548f6b0e25dc1302cf3f0_cobalt-strike_coinminer_glassworm_poet-rat

kernel32

msvcrt

winmm

ws2_32

opencl

generic